CRICO and the Risk Management Foundation of the Harvard Medical Institutions: The 2026 Anatomy of the Harvard Captive, the CBS Database, and the CARe Early-Resolution Model

If you are a medical-malpractice defense attorney practicing in Massachusetts, a hospital risk-management executive at an academic medical center anywhere in the country, a patient-safety researcher in the post-To Err Is Human tradition, or a vendor selling workflow infrastructure into the U.S. medical-professional-liability market, the same insurance entity comes up over and over again. It is not a commercial carrier. It is not a Bermuda single-parent captive. It is not a national mutual. It is a Massachusetts-domiciled shared captive insuring roughly 125,000 providers across the Harvard medical institutions, formed in 1976, and it has produced more peer-reviewed clinical-risk research than any other malpractice insurer on the planet. It is CRICO — the Controlled Risk Insurance Company, operating as the insurance arm of the Risk Management Foundation of the Harvard Medical Institutions.

This piece walks the CRICO model end-to-end. The captive structure and ownership. The covered footprint — Massachusetts General Hospital, Brigham and Women's, Beth Israel Deaconess, Boston Children's, Dana-Farber, Harvard Medical School faculty, Cambridge Health Alliance, and the broader Harvard-affiliated provider population. The Comparative Benchmarking System (CBS) closed-claims database that CRICO Strategies operates and licenses back to a large share of the rest of the U.S. healthcare system. The four clinical-risk dimensions CRICO has built its taxonomy around. The CARe (Communication, Apology and Resolution) early-resolution program that shaped what AHRQ later codified as CANDOR. The Massachusetts defense panel that handles CRICO's outside-counsel work. And, in 2026, what the model means for the AI workflow tooling now being procured into the captive segment of the MPL market. This is not a sales pitch; it is a structural primer on the most-studied captive in U.S. healthcare.

The load-bearing fact: CRICO is the captive insurer for the Harvard medical system

The Risk Management Foundation of the Harvard Medical Institutions, Inc. (RMF) is a Cambridge-based not-for-profit entity owned by the Harvard medical institutions, and the captive insurance vehicles it operates — including Controlled Risk Insurance Company, Ltd. (CRICO) and related affiliates — underwrite the professional-liability and general-liability exposure of the Harvard system. CRICO's own public materials at rmf.harvard.edu describe the covered population in terms similar to those used by the carrier in its trade-press disclosures: approximately 125,000 physicians, residents, nurses, and other clinicians across the Harvard-affiliated medical centers, the Harvard Medical School faculty, and affiliated outpatient and community-health entities. The covered institutions publicly identified in CRICO materials include:

• Massachusetts General Hospital (MGH)
• Brigham and Women's Hospital
• Beth Israel Deaconess Medical Center
• Boston Children's Hospital
• Dana-Farber Cancer Institute (DFCI)
• Harvard Medical School and Harvard School of Dental Medicine faculty
• Cambridge Health Alliance
• Additional Harvard-affiliated hospitals, ambulatory centers, and community-health programs

CRICO is consistently identified in the MPL Association's captive-side member roster and in industry trade-press coverage as one of the largest shared-captive medmal insurers in the United States by covered-provider count. Among the captive segment generally surveyed in the trade press — covered in our broader piece on hospital-system captive economics alongside MCIC Vermont, HCA Healthcare, Cleveland Clinic, IU Health, Jefferson Health, MedStar, Bon Secours Mercy, Hartford HealthCare, and Allegheny Health Network — CRICO is the most-studied because of the volume of peer-reviewed patient-safety research it has generated and the size of the closed-claims data set it makes available to the broader healthcare-research community.

The captive structure: Massachusetts-domiciled, multi-institution shared

CRICO was formed in 1976 in response to the mid-1970s commercial-MPL hard market that pushed many academic medical centers toward self-insured structures — the same wave that produced MCIC Vermont (the Hopkins/Yale/Columbia/NYP/Rochester shared captive) and several of the single-system captives that still operate today. RMF was incorporated as a not-for-profit Massachusetts corporation; the affiliated insurance entities, including Controlled Risk Insurance Company, Ltd., were chartered to write the Harvard system's professional-liability and general-liability coverage as a wholly-affiliated insurance group.

Three structural features distinguish CRICO from the more common Bermuda single-parent captive structure used elsewhere in the U.S. hospital captive market:

Shared-captive, not single-parent

CRICO insures a defined group of related but operationally distinct institutions — MGH and Brigham, both flagship Harvard teaching hospitals, are independently governed; Beth Israel Deaconess sits in a separate corporate structure; Boston Children's and DFCI are their own systems; Harvard Medical School and the school's faculty practice plan operate inside the university. The captive is shared across this related-but-distinct insured population, which gives it the risk-distribution diversity that single-parent captives historically struggled to achieve under the U.S. tax case-law line (Rent-A-Center, Securitas, and the related authority).

U.S.-domiciled rather than offshore

Most of the largest U.S. healthcare captives are domiciled in Bermuda, the Cayman Islands, or Vermont, primarily for tax treatment and capital efficiency. CRICO is one of the rare large-scale healthcare captive operations whose principal insurance entities are domiciled and regulated within the United States, with Massachusetts as the home regulatory environment. The trade-off (some lost capital efficiency, less favorable specific tax treatment on certain reserves) is offset by a closer regulatory relationship with the state in which all of the insured institutions actually operate, and by the legacy of having been formed at a time when the offshore captive infrastructure was less developed.

Integrated patient-safety and claims-investigation arm

RMF is not solely an insurance entity. It is also a patient-safety research organization, and the integration of claims data, clinical-risk analytics, and published research is part of the entity's founding mission rather than an afterthought added to a pure insurance operation. The output of that integration — the CBS database and the published CRICO Strategies analytics — is the part of the CRICO model that has generated the most attention outside Massachusetts.

The publicly identified senior leadership has included Mark E. Reynolds as President and CEO of CRICO and Elizabeth Cushing in a senior operational role; Reynolds has also been publicly identified as serving on the board of the MPL Association, the principal trade body for the MPL industry, where CRICO's perspective on the captive segment is represented to the broader carrier and reinsurance community.

Why CRICO is structurally different: the CBS database and the research mission

The single feature that most distinguishes CRICO from every other large MPL insurer in the United States is the Comparative Benchmarking System (CBS), operated by CRICO Strategies, the analytics arm of RMF. CBS is a closed-claims database covering medical-professional-liability claims contributed by CRICO and by a network of participating contributing organizations — insurers, hospital-system captives, large self-insured systems, and academic medical centers — that have agreed to contribute coded claim data into the shared analytic environment in exchange for access to the benchmarked output.

The size of the CBS data set is the part of the model most often cited in the patient-safety literature. CRICO Strategies has described CBS in its public materials at rmfstrategies.com as the largest closed-claims database in the United States, with the carrier and several independent commentators citing the database as covering an approximate share of approximately 30% of U.S. medical-professional-liability claims activity over its long history. Industry-cited figures for the contributing organizations include language describing approximately 400+ healthcare organizations and 165,000+ physicians whose claim data flows into the database; the precise current count varies with the carrier's published updates and should be confirmed against CRICO Strategies' own current disclosures before citation in any specific context.

CBS performs three functions inside the CRICO ecosystem:

1. Internal underwriting and risk-management feedback. The CRICO insureds receive benchmarked claim-frequency and severity reports against their peer institutions, and the CRICO risk-management programming targets the clinical-risk patterns the data identifies as drivers of severity. The feedback loop between claim experience, risk-management investment, and next-year frequency is shorter and more legible inside CRICO than in any commercial-carrier relationship.
2. External licensed access for contributing organizations. CRICO Strategies licenses access to the benchmarked output back to its contributing organizations — other large hospital systems, captives, and carriers — and the licensed access is one of CRICO Strategies' principal revenue lines.
3. Published research. The de-identified CBS data has supported a meaningful share of the peer-reviewed empirical literature on medical-malpractice claims and patient safety published in Health Affairs, JAMA family journals, the New England Journal of Medicine, the Annals of Internal Medicine, the Journal of Patient Safety, and similar venues over the last two decades. The research output is what gives CRICO its public profile outside Massachusetts.

The four CRICO clinical-risk dimensions

CRICO's published taxonomy, drawing on its CBS analytics, has consistently sorted medical-malpractice claims into a small set of high-level clinical-risk dimensions that capture the bulk of severity exposure across the U.S. system. The four dimensions CRICO has highlighted most prominently in its published materials and at industry conferences are:

1. Diagnostic process failures

CRICO Strategies' published analyses have repeatedly identified diagnostic-process failures — missed, delayed, or wrong diagnoses — as the single largest category of high-severity malpractice claims in the CBS data set, with an industry-cited figure of approximately one-third of claims by case count and a meaningfully larger share by indemnity dollars. The CRICO-published Malpractice Risks in the Diagnostic Process report series (Volume 1 through subsequent volumes) is the most widely cited industry analysis of the diagnostic-claim category, and it has shaped how patient-safety researchers and risk-management programs across the country structure diagnostic-error prevention work. The high-frequency clinical contexts identified in the CRICO diagnostic series include missed cancer (breast, colorectal, lung), missed myocardial infarction in the emergency department, missed pulmonary embolism, missed appendicitis, missed sepsis, and missed stroke — many of the same fact patterns our missed-sepsis, missed-AF-stroke, and ED failure-to-diagnose pieces cover from the plaintiff side.

2. Surgical event causes

Surgical-event claims — intra-operative injuries, retained foreign bodies, wrong-site surgery, technical complications, post-operative monitoring failures — comprise the second major CRICO dimension. CRICO's surgical-claim analytics have been cited in the National Patient Safety Foundation literature and in Joint Commission patient-safety bulletins; the carrier's analysis of the role of intraoperative communication failures, in particular, has been part of the empirical basis for surgical-safety-checklist adoption across the industry.

3. Medication management causes

Medication-error claims — ordering errors, prescribing-cascade failures, dispensing and administration errors, monitoring failures for high-risk medications, anticoagulation management, opioid management — comprise the third dimension. CRICO's medication-claim work has dovetailed with the broader Institute for Safe Medication Practices and AHRQ medication-safety work over the past two decades.

4. Obstetric and neonatal causes

Obstetric claims — shoulder dystocia and brachial-plexus injury, fetal-heart-rate-tracing interpretation failures, hypoxic-ischemic encephalopathy, neonatal resuscitation, and the related obstetric and neonatal-care fact patterns covered in our shoulder-dystocia deposition prep piece and the neonatal HIE causation timeline piece — comprise the fourth dimension. Obstetric claims are not the highest-frequency category but they are among the highest-severity, and CRICO's published obstetric-risk analyses have been particularly influential on the safety-bundle and team-training programs adopted by major academic obstetric services.

The four-dimension framing is not the only way CRICO categorizes its claim data — CRICO Strategies publishes more granular subspecialty analyses, including ambulatory care, ED care, hospital-medicine care, and procedural specialty subsets — but the four-dimension structure is the highest-level frame the carrier returns to in its public-facing risk-management materials and is a useful starting point for understanding where the carrier's loss-prevention dollars and defense-counsel attention have historically concentrated.

The CARe program: CRICO's early-resolution model and the AHRQ CANDOR genealogy

The other operational feature that distinguishes CRICO from the more litigation-defensive model that prevailed across much of the U.S. MPL market through the 1990s and 2000s is the Communication, Apology and Resolution (CARe) program, sometimes also rendered as Communication and Resolution in academic literature. CARe is a structured early-resolution protocol applied to the Harvard system's adverse events, under which the system communicates honestly with the patient and family about what happened, conducts a multidisciplinary causation analysis, and where the analysis identifies a deviation from the standard of care that caused harm, offers a resolution — including an apology and, where appropriate, financial compensation — without forcing the patient into litigation to obtain it.

The CARe model has been the subject of substantial peer-reviewed evaluation. Allen Kachalia, Michelle Mello, Tom Gallagher, and colleagues have published evaluations of CARe and analogous communication-and-resolution programs in Health Affairs, the Annals of Internal Medicine, the BMJ, and similar venues. The published findings have been directionally consistent: communication-and-resolution programs do not produce the explosion of compensation claims that early skeptics feared, they tend to compress time-to-resolution on legitimate claims, they correlate with reductions in legal-defense expense on the claims they cover, and they generate measurable improvements in patient and family satisfaction with the post-adverse-event process even when the resolution outcome does not include compensation.

The federal patient-safety community has explicitly drawn on CARe and the parallel Michigan Model (developed at the University of Michigan Health System) as influences in the development of the AHRQ CANDOR (Communication and Optimal Resolution) toolkit, available at ahrq.gov. AHRQ's CANDOR materials position the toolkit as a structured, generalizable framework for hospitals seeking to adopt the communication-and-resolution model that CARe, the Michigan Model, and analogous programs at Stanford, Kaiser Permanente, and the VA pioneered. MedStar Health's Larry Smith and the MedStar patient-safety team have been among the most-cited industry champions of the CANDOR generalization, and the lineage from CRICO's CARe work into AHRQ's national framework is one of the clearer cases of a single captive insurer's operational innovation propagating into national patient-safety policy.

The CRICO defense-counsel panel: smaller, deeper, Massachusetts-concentrated

CRICO's outside-counsel panel reflects the structural reality common to large hospital-system captives covered in our broader captive economics piece: a smaller, deeper bench than the commercial-carrier panels covered in our panel-counsel piece, with the Massachusetts venue concentration reflecting the Harvard system's geographic footprint. The Massachusetts medmal defense bar has a recognized roster of firms that have historically handled significant volumes of CRICO panel work, drawn from public bar-association directories, jury-verdict reporters, and Massachusetts trial-court appearance records. Firms with public profiles as significant participants in the Massachusetts medical-malpractice defense bar include:

• Donnelly Conroy & Gelhaar LLP (Boston)
• Adler Cohen Harvey Wakeman & Guekguezian LLP (Boston)
• Foster & Eldridge / health-care-defense practices in the Cambridge area
• Hamel Marcin Dunn Reardon & Shea PC (Boston)
• Morrison Mahoney LLP (Boston and regional offices)
• Sloane and Walsh LLP (Boston)
• Donovan Hatem LLP (Boston)
• Additional Massachusetts-bar firms with concentrated medical-professional-liability practice

These firms are publicly identified as significant medical-malpractice defense practitioners in Massachusetts; specific panel-membership status with CRICO is confidential and the carrier does not publish a panel roster. The listing above should be read as Massachusetts-medmal-defense identification, not as a CRICO-specific panel disclosure. The point for purposes of this piece is structural: CRICO's outside-counsel work is concentrated within a relatively defined Massachusetts defense bar whose senior partners have multi-decade institutional relationships with the Harvard-system in-house claims function and the RMF risk-management organization. Engagement structure runs from RMF claims and the Harvard institutions' General Counsel offices directly to the panel firms, with reporting back into the captive's claims oversight and the parent institutions' risk committees on the cadence described in our broader captive economics piece.

What the CRICO model means for AI workflow tooling in 2026

The procurement of AI-assisted defense workflow tools into the captive segment of the MPL market is at an unusual moment in 2026 — the maturing tooling, the multi-year captive investment in clinical-risk analytics that produced the infrastructure to evaluate the tooling, and the operating-margin pressure on parent health systems are converging in a way that has the captive in-house teams actively evaluating procurement. CRICO is a particularly distinctive procurement context inside that segment, for four reasons.

Pre-suit causation analysis is where the workflow value compounds

Inside a CARe-style early-resolution model, the load-bearing decision is the pre-suit causation analysis that determines whether the case is offered resolution, defended through litigation, or sent into the standard litigation track without a resolution offer. The medical-records-to-chronology compression, the standard-of-care literature retrieval, and the expert conflict-of-interest scoring that AI workflow tooling now produces in hours rather than weeks are most valuable precisely at the moment when the CARe model makes the disclosure-versus-defend decision. Carriers running litigation-defensive models gain workflow value at the deposition-prep and Daubert-workup phase; CRICO's model gains workflow value earlier in the timeline.

Panel standardization is achievable across a defined Massachusetts bar

Rolling out workflow tooling across a 50-to-100 firm commercial-carrier panel is a multi-year change-management problem. The CRICO panel is small enough — concentrated in a defined Massachusetts medmal-defense bar — that panel-wide standardization on a common workflow output is operationally achievable. The captive's in-house claims function can mandate adoption inside engagement letters and measure pre/post cycle time and DCC spend with statistical clarity that a wider commercial-carrier rollout never achieves.

Patient-safety analytics and defense-workflow data overlap

The same chart-pattern data that powers AI-assisted defense workflow — coded diagnoses, procedure codes, timeline-of-events extracts, deviation-from-standard flags — is the same data type that powers CRICO Strategies' CBS analytics. A captive operating an integrated patient-safety research program has a structural dovetail between defense-workflow data and risk-pattern detection that pure commercial-carrier procurement does not. The compounding value — defense-side cycle-time compression on one side, additional structured input into the patient-safety analytics on the other — is one of the more distinctive features of the CRICO procurement context.

Reporting integration is non-negotiable

The captive's in-house claims function reports up to the captive's board and into the parent institutions' Board Audit and Risk Committees on a quarterly cadence. Workflow tooling that does not produce structured outputs that roll up to that reporting cadence — cycle time per matter, expert spend per matter, motion outcomes, settlement-to-reserve ratios — will face friction at procurement, regardless of how well it performs at the per-matter level. PHI handling under a current BAA, SOC 2 Type II posture, and integration with the captive's claims-management platform (Origami Risk, Riskonnect ClearSight, or a system-built equivalent) are baseline procurement gates, not differentiators.

Practical guidance: what a Massachusetts medmal defense attorney should evaluate when picking AI workflow tooling

For a defense attorney whose practice handles significant volumes of work for a CARe-cadenced captive insurer in Massachusetts, the workflow-tooling evaluation criteria look different from the trial-defensive criteria a commercial-carrier panel attorney in a litigation-heavy state would prioritize. The recurring evaluation patterns:

The 2026 captive-segment procurement window

The captive segment of the MPL market — CRICO, MCIC Vermont, HCA Healthcare's captive, Cleveland Clinic's captive, IU Health, Jefferson Health, MedStar Health, Bon Secours Mercy, Hartford HealthCare, Allegheny Health Network, and the rest of the MPL Association captive-side membership — is at an unusual procurement moment in 2026. The maturing AI workflow tooling that can demonstrate measurable cycle-time and DCC-spend impact, the multi-year captive investment in clinical-risk analytics that has built the infrastructure to evaluate that tooling, and the operating-margin pressure that has driven every large U.S. health system to scrutinize cost lines on its consolidated financials are converging. CRICO is the most-studied captive in the segment, the most operationally distinctive (CARe + CBS), and one of the most attractive procurement contexts for vendors who can meet the BAA, claims-system-integration, panel-standardization, and reporting-integration bars described above. The Massachusetts defense bar that handles CRICO's outside-counsel work is similarly well-positioned to be an early-adopter beachhead for the workflow shift the captive segment is now opening.

Conclusion

CRICO is not a typical medical-malpractice carrier and the captive structure it operates is not a typical hospital-system captive. It is a 50-year-old Massachusetts-domiciled shared captive insuring approximately 125,000 providers across the Harvard medical institutions, operating the largest closed-claims database in the United States, running an early-resolution program that influenced the federal AHRQ CANDOR framework, publishing the most-cited industry analyses of the four major clinical-risk dimensions in medical-malpractice exposure, and concentrating its outside-counsel work in a defined Massachusetts defense bar with multi-decade institutional relationships with the in-house claims function. For risk-management executives at academic medical centers benchmarking captive models, for Massachusetts defense attorneys building practice strategy around the CARe-cadenced workflow, for patient-safety researchers drawing on CBS data, and for the AI workflow vendor community evaluating the captive procurement segment, CRICO is the canonical reference point. The 2026 procurement window inside the captive segment is open, and the model CRICO has built over five decades is the clearest illustration of where integrated insurance-plus-patient-safety operations can produce compounding value.

Related reading:
Hospital-System Captive Insurance for Medical Malpractice: The 2026 Economics and Defense-Counsel Implications · How Medical Malpractice Carriers Pick Defense Counsel: The 2026 Panel System Explained · Texas Medmal Defense Economics: Chapter 74, Proposition 12, and the §74.351 Expert-Report Lever · Tennessee Medical Malpractice Defense Economics: The Healthcare Liability Act and the Damage-Cap Floor · Massachusetts Medical Malpractice in 2026: The Tribunal Bond, the $500K Charitable-Hospital Cap, and Daubert in a Lanigan World · FRE 702 (2023) and Medical Malpractice Expert Reports · The Economics of Pre-Litigation Intake Chronologies · MedLegal AI vs Expert Institute · MedLegal AI Pricing