Medical Cannabis Clinic Insurance UK | Specialist Broker

Published: 4 July 2026 | Reading time: 24 minutes | Category: Alternative Therapies | Author: John Miller, Miller & Partner

Why does a medical cannabis clinic need specialist insurance treatment?

Medical cannabis clinics occupy a strange position in the insurance market: they are fully legal, CQC-regulated medical businesses run by GMC-registered specialists — and yet many insurers will not touch them. Medical cannabis has been legally prescribable in the UK since 1 November 2018, when cannabis-based products for medicinal use were rescheduled to Schedule 2, and a private-pay sector of around 40 CQC-regulated clinics and tens of thousands of patients has grown up since. But the word "cannabis" still triggers reflexive caution across the insurance market, and the underlying risk — a clinic prescribing an unlicensed, controlled medicine, often for conditions where the evidence base is still developing — is genuinely complex. The result is a legitimate medical business that is treated as an adverse, hard-to-place risk.

This is the territory Miller & Partner works in. As a specialist broker for adverse and hard-to-place risks, we place cover for legitimate businesses the standard market shuns — including clinics that have been refused cover elsewhere or non-renewed because a mainstream insurer's appetite changed. This guide explains why cannabis stigma makes legal clinics so hard to insure, why medical malpractice is the cover that defines the risk, how controlled-drug and CQC duties shape your programme, and how to present a clinic so specialist underwriters actually want to write it.

What must a cannabis clinic policy include that a standard clinic policy won't?

A medical cannabis clinic is, in most respects, a private medical clinic — and the covers a good clinic policy carries (medical malpractice, public liability, CQC-related protection, cyber) all apply. But a standard clinic wording is written for mainstream practice, and it rarely contemplates the three things that make a cannabis clinic distinctive: the unlicensed, controlled nature of the medicine, the controlled-drug handling duties, and the reputational and appetite issues around cannabis itself. A generic clinic policy — or worse, a mainstream policy that simply hasn't been told the clinic prescribes cannabis — can leave the biggest exposures uncovered or the whole contract voidable. The comparison below shows where a standard clinic wording falls short. Our guides to the ADHD clinic and weight-loss clinic cover the wider private-clinic landscape.

Why does cannabis stigma make legal clinics so hard to insure?

Here is the paradox at the heart of this niche: a medical cannabis clinic is more heavily regulated than most private clinics — CQC, GMC, MHRA, the Home Office and controlled-drug law all bear on it — and yet it is harder to insure than a comparable clinic doing mainstream work. The reason is not the actual risk profile; it is the word "cannabis". Many insurers and reinsurers apply blanket cannabis exclusions that were written with the illicit or recreational market in mind, and never updated to distinguish a legitimate, prescription-only, CQC-regulated clinic from the thing those exclusions were aimed at. Faced with the word, a mainstream underwriter's simplest answer is "no".

This is a classic adverse-risk situation: the business is legitimate, but the market's reflexes are against it. The consequence for clinic operators is real — narrow appetite, high premiums, sudden non-renewals when an insurer's cannabis stance changes mid-cycle, and a constant risk of being lumped in with the illicit market they have nothing to do with. The way through is specialist placement and disciplined presentation: demonstrating the regulated, clinical, controlled nature of the operation to the small number of markets that will underwrite it on its merits. It's the same challenge we handle for other legitimate sectors the mainstream unfairly shuns, set out in our guide to business insurance when you've been refused elsewhere.

Why is medical malpractice the cover that defines a cannabis clinic?

Strip away the cannabis-specific issues and a clinic's core exposure is the same as any medical practice: clinical negligence — the risk that a patient is harmed by a failure in assessment, prescribing, monitoring or advice, and brings a claim. Medical malpractice (professional indemnity for clinicians) is therefore the cover that defines the risk, and it is a specialist, capacity-constrained line at the best of times. For a cannabis clinic the exposure is sharpened by the nature of what's prescribed: an unlicensed, psychoactive, controlled medicine, frequently for chronic pain, anxiety or other conditions where patients have often exhausted conventional options and expectations run high.

Because the prescriber carries personal responsibility for an unlicensed medicine, and the clinic carries entity-level and vicarious exposure for its clinicians, the malpractice programme has to cover both properly. Underwriters will look hard at clinical governance: how patients are assessed and screened (including for contraindications such as psychosis risk), how consent to an unlicensed medicine is taken and recorded, how treatment is monitored and reviewed, and how prescribing is audited. A clinic that can evidence rigorous, guideline-aware governance is presenting a fundamentally more insurable malpractice risk than one that can't — this is the professional-services exposure our professional indemnity insurance guide addresses in the wider context.

Why does unlicensed prescribing raise your clinical-negligence exposure?

Almost every cannabis-based product prescribed in the UK is unlicensed — it has no MHRA marketing authorisation because it hasn't been through the clinical-trial process that licensed medicines have. That legal reality, set by the 2018 rescheduling, sits at the centre of a cannabis clinic's clinical-negligence exposure. Prescribing an unlicensed medicine is lawful for a GMC-specialist, but it shifts more responsibility onto the prescriber: they must justify why an unlicensed product is appropriate, ensure the patient gives informed consent understanding its unlicensed status, follow GMC guidance on unlicensed medicines, and report adverse reactions through the MHRA Yellow Card scheme.

For insurance, this matters because a claim following an adverse outcome will scrutinise exactly those steps. Was the patient properly assessed and screened? Was informed consent to an unlicensed medicine documented? Was the prescribing within the specialist's area of practice and consistent with available guidance? Was treatment monitored? The absence of good documentation on any of these turns a defensible clinical decision into an indefensible claim. Underwriters know this, which is why a clinic's consent, governance and audit processes are so central to how its malpractice cover is rated — and why sloppy record-keeping is one of the fastest routes to both a lost claim and a hard renewal.

What insurance covers does a medical cannabis clinic need?

A cannabis clinic programme is genuinely combined, and the covers must be structured together — with cannabis prescribing disclosed throughout — so a single incident doesn't fall between sections. The core structure looks like this:

Medical malpractice / professional indemnity

The defining cover: clinical negligence claims against the clinic and its clinicians for assessment, prescribing, monitoring or advice. Must be written knowing the clinic prescribes CBMPs. See professional indemnity insurance.

Public liability

Third-party injury and property damage at the premises — the general clinic exposure. See high-risk public liability.

Employers' liability

Legally required under the Employers' Liability (Compulsory Insurance) Act 1969 for clinical and administrative staff.

Cyber & data

Patient records are special-category health data — and cannabis-patient data is especially sensitive. A breach brings ICO and claims exposure suited to cyber insurance.

Regulatory, product, BI and management liability

Defence-cost and interruption cover around CQC action; product liability where the unlicensed-product supply chain is engaged (see product recall); business interruption if prescribing is suspended; and directors' & officers' cover, since directors can be named personally after a serious regulatory or clinical failure.

How do controlled-drug duties shape your risk?

Cannabis-based medicinal products are Schedule 2 controlled drugs under the Misuse of Drugs Regulations 2001, and that classification brings a set of duties that don't apply to ordinary medicines. Depending on the clinic's model, these can include Home Office licensing for import and supply, secure storage to controlled-drug standards, controlled-drug register record-keeping, safe destruction procedures, and management of the ever-present risk of diversion — controlled drugs going astray, whether through theft, loss or misuse. The CQC's annual "safer management of controlled drugs" reporting means this is an area regulators actively scrutinise.

For insurance, controlled-drug handling adds exposures a normal clinic policy never sees: theft and diversion of high-value, high-risk stock; regulatory action if CD management falls short; and the reputational and business-interruption fallout if a clinic's controlled-drug governance is found wanting. A clinic that can evidence proper CD security, registers, audits and Home Office compliance is both meeting its legal duties and materially de-risking its insurance profile. Where a clinic holds or dispenses stock, the crime, stock and business-interruption elements of the programme need sizing to that controlled-drug reality.

What does CQC registration and inspection mean for cover?

Any clinic prescribing cannabis-based medicinal products in England must be registered with the Care Quality Commission and is subject to its inspection regime. The CQC applies its standard assessment framework to cannabis clinics — with specific lines of enquiry around prescribing governance, scope of practice, and controlled-drug management — and rates services from "inadequate" to "outstanding", with powers to impose conditions, suspend or cancel registration where it finds concerns. Because there is no mandated cannabis-prescribing training, the CQC has flagged variation in prescribing practice across the sector, which keeps this area under scrutiny.

For insurance, CQC status is both a rating factor and a live exposure. A clean registration and good rating help present the clinic as a well-governed risk; a poor rating, conditions, or enforcement action are red flags that harden terms or prompt non-renewal. And a CQC investigation itself carries cost — legal defence, management time, and potential suspension of prescribing that interrupts income. A well-structured programme provides regulatory defence-cost and business-interruption support around CQC action, alongside the clinical malpractice cover. Keeping CQC compliance tight is, in insurance terms, one of the most valuable things a clinic can do.

Why is patient data a serious exposure for a cannabis clinic?

Every clinic holds health records, which are special-category personal data under the UK GDPR and demand the highest standard of protection. For a cannabis clinic the sensitivity is greater still: a record that a named individual is a cannabis patient is exactly the kind of information that can cause real harm if exposed — to employment, insurance, family or reputation — precisely because of the stigma discussed above. A data breach at a cannabis clinic is therefore not just an IT incident; it's a potential harm event with regulatory, claims and reputational consequences.

The exposure runs through the whole operation: online eligibility questionnaires, video consultations, electronic records, and repeat-prescription and delivery systems all handle sensitive data. A breach can trigger ICO investigation and penalties, claims from affected patients, and the cost of notification and remediation. Cyber insurance sized for special-category health data — covering breach response, regulatory defence, and third-party claims — is a core part of a cannabis clinic's programme, not an optional extra. Underwriters increasingly expect to see genuine data-security controls behind it.