As risks rise inside and outside of clinical care, hospitals face an uncertain environment where miscalculations and a lack of foresight could have disastrous consequences. Consider the largest initial medical professional liability (MPL) verdict ever—a 2025 $951 million Utah verdict in a 2019 birth injury case, currently mired in the Stewart Health Care bankruptcy.
While the growth in MPL mega verdicts concerns hospital risk executives, they are also coping with an expansion and escalation of risk across their enterprise. The American Society for Health Care Risk Management and the American Health Law Association classified enterprise risk into eight areas: operational risk, clinical and patient safety risk, strategic risk, financial risk, human capital risk, legal and regulatory risk, technology risk, and hazard risk.
Hospital risk executives and managers are transforming their risk management function from one that focused on a group of risks in isolation to an enterprise risk management focus that is strategic, comprehensive, and process-oriented. That means creating a risk management structure that uniformly identifies, assesses, prioritizes, and mitigates risks through an industry-standard framework such as the COSO framework or a framework customized to a specific hospital or health system.
As the hospital liability and enterprise risk management environment grows more complex, hospital risk executives are more concentrated than ever on gaining a holistic view of the broad array of risks their organizations face and staying agile as risks evolve. “My job is to safeguard the organization’s resources, which are human and financial capital and to anticipate what threatens those resources and anticipate and/or respond accordingly, whether it be insurance-wise, risk strategy-wise, or whatever the organization needs,” said Elaine Ziemba, senior vice president and chief risk officer for the Stanford Medicine Enterprise/Stanford Healthcare.
“The fact that our professional discipline of risk management is so expansive to risks we did not contemplate years ago is both exciting and challenging in an environment that is changing so fast,” she continued. “We are dealing with risks that have broad implications across the enterprise. It’s not just clinical care, it involves everything that supports our mission and our organizations, be it supply chain, regulatory influences, financial implications, workforce implications, and more.”
Melissa Updike, CEO of the Kentuckiana Medical Reciprocal Risk Retention Group, prefers to use the term risk quality as the forward-looking component of risk management. The Kentuckiana Medical Reciprocal Risk Retention Group is the largest captive insurance company in Kentucky, which provides hospital liability coverage for entities associated with the University of Louisville Health, Inc., ULP. Inc., and the residents and students at the University of Louisville Schools of Medicine and Dentistry. “We’re always focused on continuing to improve our processes, focused on lessoned learned, promptly follow up on events we identify, and use root cause analysis models,” she said. “These drive where we focus our education and our overall approach to risk management.”
This article is the first of a two-part series that examines the hospital risk environment, the rising severity of MPL and HPL claims and verdicts, clinical risk management, and shifts in clinical risk patterns. The second article will look at the advantages of the captive structure and the outlook for enterprise risk management
2026 Hospital Risk Environment
The hospital risk environment in 2026 is characterized by a several top-level trends, which include rising MPL and HPL verdict severity, a structural cost revenue squeeze, and the increasing scale and consequences of cyberattacks, among other factors.
For hospitals, physicians, and other MPL stakeholders, MPL and HPL verdict severity continues to deteriorate. An analysis by The Doctors Company revealed that mega verdicts are rising at a rapid rate. In 2022, the average of the top 50 MPL verdicts was $32 million, which rose to $48 million in 2023 and $56 million in 2024. Increasing economic and social inflation added $4 billion in insured losses for insurers focused on the physician side of the MPL market. The American Medical Association’s (AMA) Medical Liability Claims Report found that the percentage of practicing physicians sued for malpractice fell to 1.6% in 2024 from 2.3% in 2016. During the same period, the AMA’s Medical Liability Premium Report revealed that the share of physician’s premiums that rose on a year-over-year basis increased from 15.4% to 49.8%.
Hospitals face a structural cost and revenue squeeze. In 2022, half of all US hospitals and health systems operated at a financial loss. While finances improved overall for hospitals in 2023 and 2024, 40% of hospitals and health systems operated at a loss. Total hospital expenses rose at a rate of 7.5% as patient volumes, especially of higher-acuity patients with multiple conditions, increased. The aging US population means that sicker patients are staying longer in hospitals as reimbursement for those patients declines. Workforce costs for healthcare workers and support staff are rising. These factors pressure hospital margins, which means hospital executives need to be more creative in deploying the resources they have to manage risks.
In the US Federal Bureau of Investigation Internet Crime Report 2025, healthcare and public health were named as the top sector targeted for cyberthreats, with 460 ransomware attacks and 182 data breaches for a total of 642 cyber events. Increasingly, cyberattacks are a patient safety issue as they can create life-threatening care delays and disruptions to critical hospital services. The Change Healthcare cyberattack demonstrates how cyber risk has become systemic, as 94% of hospitals surveyed reported a financial impact when the health transaction processing subsidiary of UnitedHealth Group was successfully breached in a ransomware attack by a Russian-linked ransomware group.
MPL and HPL Case Claims and Verdict Severity
Claims and verdict severity impact health systems across the US, but are particularly challenging in areas where there are no caps on either actual medical liability damages or noneconomic damages. Whether caps exist or not is usually dependent upon either the jurisdictional constitution or past judicial rulings; the MPL Association and the American Medical Association provide listings of state liability reforms that captures caps, limits, attorney fee limits, whether periodic payments are permitted and collateral source reform.
In Kentucky, there are no caps on either economic or damages in medical malpractice cases. “The lack of caps in Kentucky means that there are no caps on attorneys fees either, which means the higher the demand or the higher the award, the higher their fee,” said Updike. “Plaintiffs are not focused on a fair settlement, a fair and reasonable resolution. Instead they are focused on their fees at 40 to 50% of the case resolution [amount].”
“Every single day cases are not evaluated based on the true damages,” she continued. “They are evaluated based on the policy limit. And some won’t even accept the policy limit. It’s concerning. The numbers submitted as damages in a case are not equivalent to real life situations. We had a case in January where the plaintiff lawyer blackboarded $70 million in damages.
“We got a defense verdict, but still, if you have a couple of jurors that see their job as righting social wrongs globally instead of the specific case facts they are supposed to focus on and decide to award every bit of, that’s devastating to a healthcare organization,” she added. “Ultimately the community is harmed. There are states where the medical malpractice environment is so egregious healthcare providers and systems are leaving.”
Clinical Risk Management
“Clinical risk management specifically is concerned with improving the quality and safety of healthcare services by identifying the circumstances and opportunities that put patients at risk of harm and acting to prevent or control those risks,” according to the World Health Organization (WHO). There are a variety of frameworks and tools hospital and health system risk executives and clinical care teams can use as part of their clinical risk management processes, including the WHO four-step clinical risk management process, the Joint Commission Sentinel Event Policy and Procedures, and the American Society for Healthcare Risk Management Enterprise Risk Management Framework.
“Areas of risk we focus on include doing review with our claims committee, risk trends, and claims trends,” said Updike. “From a risk management perspective, one of the areas that we are working on are pressure injuries. We partnered with the national expert with the National Pressure Injury Advisory Panel to put together specific electronic training about this problem.”
A pressure injury, which is also known as a bedsore or pressure ulcer, is an injury to the skin or the tissue underlying the skin caused by pressure, friction, and moisture. Pressure injuries occur in older adults, individuals with spinal cord injuries, and the critically ill. Hospital-acquired pressure injuries cost health systems an estimated $26.8 billion annually and affect more than 2.5 million patients in the US. They are linked to as many as 60,000 deaths on an annual basis.
“We are a Level One Trauma Center, we get gunshot wounds, spinal cord injuries, traumatic injuries, and very, very ill patients, but pressure injuries are very difficult because skin is the largest organ in the body,” she added. “We focus on changing behaviors and changing the overall culture. We’ve started doing touch charts to document all of our interactions with a patient. That way if a plaintiff alleges that a family member wasn’t sufficiently cared for, we have the documentation to back up the high level of care we provide. We can say we had, for example, 200 interactions with a patient whether that’s changing a tube, changing an IV, taking them to a test, changing linens to counter the theme that patients are just in their beds and are never getting touched, which isn’t reality. Even with the best care, pressure injuries are unavoidable for many patients.”
The ultimate risk management goal of the Kentuckiana Medical Reciprocal Risk Retention Group with the emphasis on pressure injury education and prevention for patients and families and prevention documentation is to use a scorecard to measure progress in clinical care areas so that they can evaluate progress in preventing pressure injuries and claims based on the established processes within education, documentation, and communication, Updike noted.
Shifts in Clinical Risk Patterns
Over the last three decades, hospitals and health systems made significant, but uneven, progress in patient safety with an emphasis on learning from errors to prevent them in the future. Today, hospital risk executives seek to stay current on shifting clinical risk patterns to identify emergent risks.
Ziemba identified the level of knowledge and questions that patients are coming to their providers with based on knowledge they’ve acquired through generative AI as a a potential shift in clinical risk. “There can be significant clinical risk around patients asking AI about their symptoms and coming in to their appointments with a list of questions,” she said. “Maybe what they learn is correct and maybe it isn’t, but the relationship between the healthcare system or hospital and the patient now has a layer in between it. While information is empowering and hopefully helpful, the use of AI generated information can serve as a great starting point to the patient-clinician discussion.”
“Managing and supporting patients with knowledge and expectations is a delicate issue right now,” she continued. “You don’t want to say they are wrong because that isn’t helpful and you don’t want to prevent someone from getting the care they want or need simply by your approach to the knowledge they show up with.”
Access to care is another shift in clinical risk. Patients deferred care during the COVID-19 pandemic. Excluding patients hospitalized for COVID-19, patients who sought care during and after the pandemic surges stayed longer in hospitals and were sicker. The result was more complex and costly care for hospitals. Americans were already postponing care due to rising costs, a trend that is likely to increase in the wake of the expiration of pandemic subsidies for Affordable Care Act health insurance plans. Prior to the expiration of subsidies, nearly one in three American adults skipped needed care due to costs. After the subsidies, millions of Americans dropped their health insurance and are likely to postpone healthcare due to costs.
“We saw during COVID how people put off seeking care and then came to us with more advanced problems,” said Ziemba. “It’s important clinically that we recognize what people are experiencing and that because people may generally not access healthcare in as timely a fashion as they could, so therefore, we are dealing with more chronic and more significant risk profiles.”
Ziemba noted that a lack of supportive resources and community networks is another significant clinical risk. “We are a very mobile society and sometimes fragmented and I do think healthcare is a team sport,” she said. “These kinds of population health challenges where people may not be getting to their appointments to deal with their chronic conditions because they don’t have access to rides or support or the money to do that can be challenging for all.”
“There are challenges around aftercare,” she continued. “You could have a surgery and we’re very good about your pre-op workup and your surgical procedure and making sure you get home, but a lot of time home support is challenging. We and insurers focus on readmissions, but readmissions are likely a result of something not going well once you are discharged.”
Up Next
Now that you better understand the clinical risk environment within HPL, in the next article in this two-part series you’ll learn about enterprise risk management and how captive insurance entities can help manage both clinical and enterprise risks.