Seven years after the introduction of the Gelli-Bianco Law, the long-awaited Implementing Decree has finally been issued, defining its most expected aspects: insurance obligations, liability systems, and mechanisms to protect both patients and healthcare professionals. It represents a decisive step toward clarifying and operationalizing the system of medical liability, strengthening patient safety and the protection of those receiving care.
We asked attorneys Massimiliano Scipioni and Giuliana De Matteis, experts in healthcare law, to explain how the new Decree integrates the previous legislation and what the main changes are for healthcare facilities and professionals.
by Roberta Imbimbo
Avv. Scipioni, how does this decree integrate or change the previous legislation?
The Implementing Decree strengthens patient safety and the liability of healthcare facilities. In addition to protecting patients, it requires healthcare organizations to adopt mandatory insurance coverage or risk self-retention systems, increasing their responsibility in managing internal processes and preventing adverse events.
What are the main innovations introduced?
The Decree finally clarifies the rules on mandatory insurance and defines the minimum requirements for policies: duration, coverage limits, covered parties, and the reciprocal responsibilities of the facility and the physician. The healthcare facility bears contractual liability toward the patient, and the policy also covers damage caused by personnel operating within it in any capacity. The physician bears non-contractual liability but is still covered by the facility’s policy for activities carried out within it, except in cases of gross negligence, for which a personal policy is mandatory.
What is self-insurance?
The regulation of self-insurance is one of the main innovations of the Decree. Facilities may choose, by 16 March 2026, whether to take out a traditional insurance policy, adopt a risk self-retention model, or combine both solutions. Facilities opting for total or partial self-retention must establish specific funds: a claims reserve fund for reported but unpaid claims, and a risk fund for potential claims that may lead to future compensation requests. They must also employ specialized figures in clinical risk management, use advanced risk management systems, and provide continuous staff training. This marks a true cultural shift: from merely covering damage to actively preventing risk.
Avv. De Matteis, what are the consequences for facilities that fail to comply?
Although the Decree does not establish direct sanctions, non-compliance may impact accreditation and may result in civil liability or liability before the Court of Auditors, with the latter applying only to public healthcare facilities. Moreover, without proper insurance coverage or compliant funds, a facility risks being held liable for potential financial insolvency.
What message would you like to convey to healthcare facilities?
The Decree is not just a regulatory obligation but a change of paradigm: managing risk in an integrated way means preventing, protecting, and improving the quality of care. Studio Scipioni supports healthcare facilities in legal compliance and legal consulting for healthcare risk management. Furthermore, through the professional network “SIS – Integrated Services for Healthcare,” of which the firm is a partner, the aim is to offer healthcare organizations an integrated, multidisciplinary service that encompasses all the competencies required by Decree 232/2023. These topics will be discussed at the upcoming conference on 3 December in Milan titled “Towards integrated management of healthcare risk between compliance, governance and sustainability.”
