The legal requirements to start a solo medical practice fall into a predictable sequence: form a professional legal entity, obtain the federal and state identifiers that let you practice and bill (NPI, EIN, state medical license, and DEA registration if you prescribe controlled substances), carry the insurance your state and payers require, build compliance programs for HIPAA, OSHA, and CLIA, follow the federal billing and anti-fraud rules that attach the moment you treat Medicare or Medicaid patients, and enroll with payers through a credentialing process that routinely takes 90 to 180 days. Each piece has its own filing, fee, and deadline, and getting any of them wrong can delay billing, expose personal assets, or trigger federal penalties.
Pick a Legal Entity That Shields Personal Assets
Your first legal decision is what kind of business you are. If you do nothing, you’re a sole proprietor by default: you and the practice are legally identical, and a creditor who wins a judgment over a lease dispute or unpaid vendor invoice can reach your home and savings. Most physicians move off that structure quickly.
The two structures built for licensed healthcare providers are the Professional Limited Liability Company (PLLC) and the Professional Corporation (PC). Both create a separate legal entity that absorbs non-clinical business debts and liabilities on its own, shielding your personal assets from things like equipment-lease defaults or a slip-and-fall claim in your waiting room. Most states prohibit licensed providers from forming a standard LLC or corporation and require the professional variant instead. One point worth stating plainly: the professional entity does not protect you from your own malpractice. A clinical error leaves you personally liable regardless of how the practice is structured. The corporate shield only covers non-clinical business obligations.
A PC generally requires bylaws, a board of directors (even if you’re the only member), and formal meeting minutes. A PLLC has fewer governance requirements and simpler tax reporting for most solo operators. Either works; the choice usually comes down to your state’s specific rules and your tax strategy.
You formally create the entity by filing Articles of Organization (LLC) or Articles of Incorporation (corporation) with the Secretary of State. Most states offer online filing, and fees generally range from $100 to $500. The certificate or letter of good standing you receive is what banks, landlords, and insurance payers will ask for. If you intend to operate under a name different from your legal name or your entity’s registered name, most states also require a “doing business as” (DBA) or fictitious name filing with the Secretary of State or county clerk. Renewal intervals vary by jurisdiction.
Federal and State Identifiers You Must Obtain
National Provider Identifier (NPI)
Every physician who bills for services needs a National Provider Identifier, a unique 10-digit number used across all insurance transactions. You apply through the National Plan and Provider Enumeration System (NPPES) website, entering your personal information, primary practice location, and at least one healthcare taxonomy code for your specialty.1Centers for Medicare & Medicaid Services. NPPES Help – NPI Application Help The NPI itself carries no embedded information about your state or specialty; HIPAA simply requires covered providers, health plans, and clearinghouses to use it.2Centers for Medicare & Medicaid Services. National Provider Identifier Standard (NPI)
Employer Identification Number (EIN)
Even as a solo practitioner, you need an EIN from the IRS for tax filings, hiring staff, and opening a business bank account. You can apply online and receive the number immediately, or submit Form SS-4 by mail or fax.3Internal Revenue Service. About Form SS-4, Application for Employer Identification Number If the responsible party or business address changes later, report it to the IRS within 60 days using Form 8822-B.
State Medical License
A valid license from the state where you intend to practice is non-negotiable. State medical boards verify your medical school graduation, postgraduate training, and passage of a national licensing examination, review your full work history, and query disciplinary databases before issuing a license. Renewal intervals and continuing education requirements vary by state, so check your board’s rules early.
DEA Registration
If you plan to prescribe controlled substances, you need a separate registration from the Drug Enforcement Administration. Form 224 asks for your state medical license number and requires disclosure of any history of controlled-substance-related convictions, surrendered registrations, or disciplinary actions.4Drug Enforcement Administration. DEA Form 224 – Application for Registration The registration lasts three years and costs $888.5Federal Register. Registration and Reregistration Fees for Controlled Substance and List I Chemical Registrants You apply online through the DEA’s Diversion Control Division.6Drug Enforcement Administration Diversion Control Division. Registration
Required and Expected Insurance
Professional Liability (Malpractice)
A handful of states legally require physicians to carry minimum malpractice coverage, while others require it only for participation in state liability reform programs or patient compensation funds. Even where it isn’t mandated, hospital privileges and insurance panel participation almost universally require proof of active coverage. Carriers ask for your full CV, claims history, and a description of the procedures you intend to perform. Premiums vary enormously, from roughly $5,000 annually for lower-risk specialties like family medicine to $50,000 or more for high-risk fields like obstetrics or neurosurgery.
Business Owner’s Policy
Malpractice insurance covers clinical errors. It does not cover a patient who trips on a loose floor tile in your lobby, a fire that destroys your equipment, or a data event affecting your electronic records. A business owner’s policy (BOP) bundles property coverage, general liability, and business income protection into a single package. Some policies also cover equipment breakdown and the cost of recovering damaged patient records.
Workers’ Compensation
If you hire even one employee, a medical assistant, receptionist, or billing clerk, most states require you to carry workers’ compensation insurance. The threshold in the majority of states is a single employee, though a few set the trigger at three to five. Failing to carry required coverage can result in fines, personal liability for employee injuries, and in some states criminal penalties.
HIPAA Compliance Obligations
The Health Insurance Portability and Accountability Act applies to every solo practice that transmits health information electronically, which in practical terms means every practice that bills insurance. You must implement three categories of safeguards for protected health information: administrative (workforce training, access policies, risk assessments), physical (locked file rooms, workstation security), and technical (access controls, audit logs, transmission security).7U.S. Department of Health and Human Services. The HIPAA Privacy Rule and Electronic Health Information Exchange in a Networked Environment – Safeguards The Privacy Rule is flexible about how you achieve those safeguards; there is no single checklist. You do need documented policies and evidence that you follow them.
One common misunderstanding: HIPAA does not specifically require encryption for all electronic communications. It requires you to assess risks and implement reasonable protections, and in most practical scenarios encryption is the easiest way to meet that standard. Sending an unencrypted email to a patient isn’t automatically a violation if other safeguards are in place.
Penalty exposure is real. The regulation establishes four tiers of civil penalties.8eCFR. 45 CFR 160.404 After annual inflation adjustments, the current ranges are:
- Did not know (and couldn’t reasonably have known): $145 to $73,011 per violation, up to $2,190,294 per calendar year for identical violations.
- Reasonable cause (not willful neglect): $1,461 to $73,011 per violation, same annual cap.
- Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation.
- Willful neglect, not corrected: $73,011 to $2,190,294 per violation.
Those inflation-adjusted figures are effective as of 2025.9Federal Register. Annual Civil Monetary Penalties Inflation Adjustment A single careless data handling incident can land in the second tier if regulators find it resulted from a failure to follow reasonable precautions.
OSHA and CLIA Rules for the Clinical Space
Bloodborne Pathogens Standard
OSHA holds you responsible for managing clinical exposure risks whether you have two employees or twenty. The most immediately relevant standard is the Bloodborne Pathogens Standard (29 CFR 1910.1030), which requires a written exposure control plan. The plan must detail how you’ll minimize employee exposure through engineering controls (such as needleless devices), provide personal protective equipment at no cost to staff, dispose of biohazardous waste properly, and offer hepatitis B vaccinations.10Occupational Safety and Health Administration. Bloodborne Pathogens and Needlestick Prevention It has to be reviewed and updated annually, and you need to document that review. An OSHA inspector who finds a stale, undated plan will treat it the same as no plan at all. Current penalties for a serious violation run up to $16,550, and willful or repeated violations can reach $165,514.11Occupational Safety and Health Administration. OSHA Penalties
CLIA Certification for In-Office Testing
If you perform any test on a human specimen in your office, even a single rapid strep test, urine dipstick, or blood glucose check, your practice is considered a laboratory under the Clinical Laboratory Improvement Amendments (CLIA), and you need a certificate.12Centers for Medicare & Medicaid Services. How to Apply for a CLIA Certificate, Including International Laboratories The certificate type depends on test complexity:
- Certificate of Waiver covers simple, low-risk tests (rapid strep, urine dipsticks, basic blood glucose). Most solo primary care offices fall here.
- Certificate for Provider-Performed Microscopy allows a physician to perform certain moderate-complexity microscopy procedures, such as wet mounts or KOH preps, during a patient visit.
- Certificate of Compliance or Accreditation is required for moderate- or high-complexity testing and involves periodic inspections.
You apply using Form CMS-116, submitted to your state’s designated CLIA agency.13Centers for Medicare & Medicaid Services. CLIA Application for Certification – Form CMS-116 The certificate you need corresponds to the most complex test category you perform.14Centers for Medicare & Medicaid Services. How to Obtain a CLIA Certificate of Waiver
Federal Billing and Fraud Laws You’re Now Subject To
Good Faith Estimates Under the No Surprises Act
You must provide a written good faith estimate of expected charges to any patient who is uninsured or plans to self-pay. When the patient schedules a service at least three business days out, you have one business day to deliver the estimate. If scheduled at least 10 business days out, you have three business days.15Centers for Medicare & Medicaid Services. No Surprises – Whats a Good Faith Estimate The estimate must include itemized expected charges for the primary service and any related services reasonably anticipated as part of that episode of care.16eCFR. 45 CFR 149.610 – Requirements for Provision of Good Faith Estimates If the final bill exceeds the estimate by $400 or more, the patient can initiate a dispute resolution process.
Anti-Kickback Statute
The federal Anti-Kickback Statute makes it a felony to knowingly offer, pay, solicit, or receive anything of value in exchange for referrals of patients covered by Medicare, Medicaid, or other federal healthcare programs. Penalties include fines up to $100,000 and up to 10 years in prison per violation.17Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
Solo practitioners don’t typically see themselves as kickback risks, but the law catches arrangements that look ordinary on the surface. Renting space in a building owned by a referring physician at below-market rates, or paying a marketing company a percentage of revenue it generates, can trigger liability. Federal regulations carve out specific “safe harbors,” arrangements automatically protected if they meet precise requirements. The most relevant for solo practices involve leasing space or equipment, hiring independent contractors, and participating in referral services. The common thread: every arrangement must be in writing, at fair market value, and compensation cannot be tied to the volume of referrals.18eCFR. 42 CFR 1001.952 – Exceptions
Stark Law
The Physician Self-Referral Law (commonly called the Stark Law) prohibits physicians from referring Medicare patients for certain designated health services to entities where the physician has a financial relationship, unless an exception applies. For solo practitioners, the most important exception is the in-office ancillary services exception, which allows you to order and perform services like lab work, imaging, and physical therapy within your own office. To qualify, the services must be furnished by you or someone you directly supervise, provided at your practice location where you regularly see patients, and billed by you or your practice.19eCFR. 42 CFR 411.355 – General Exceptions to the Referral Prohibition Related to Both Ownership/Investment and Compensation Your practice location must generally be open at least 35 hours per week, with at least 30 hours of regular physician services provided there. Getting the details wrong can result in denied claims and repayment obligations.
Tax Registrations and Payments
Self-Employment Tax
As a solo practitioner, you owe self-employment tax on your net practice income, the combined employer and employee portions of Social Security and Medicare taxes. The total rate is 15.3%: 12.4% for Social Security on the first $184,500 of net earnings in 2026, and 2.9% for Medicare on all net earnings with no cap.20Internal Revenue Service. Self-Employment Tax (Social Security and Medicare Taxes)21Social Security Administration. Contribution and Benefit Base An additional 0.9% Medicare surtax kicks in on self-employment income above $200,000 for single filers ($250,000 for married filing jointly).
S-Corporation Election
If your practice is a PLLC, you can elect to be taxed as an S-corporation by filing IRS Form 2553. Only the salary you pay yourself is then subject to Social Security and Medicare taxes. Profits distributed above that salary are subject to income tax but not the 15.3% self-employment tax. You must pay yourself a reasonable salary for your specialty and workload; the IRS scrutinizes artificially low salaries. The decision depends on your income level, expenses, and state tax rules, so run the numbers with a CPA before electing.
Quarterly Estimated Tax Payments
You have no employer withholding taxes from your paychecks. If you expect to owe $1,000 or more in federal tax when you file, you must make quarterly estimated tax payments or face underpayment penalties.22Internal Revenue Service. Estimated Taxes To avoid the penalty, pay at least 90% of your current year’s tax liability or 100% of the prior year’s tax (110% if your adjusted gross income exceeded $150,000). Missing a single quarterly payment can trigger a penalty, even if you’re owed a refund at year-end.
Enrolling With Medicare, Medicaid, and Private Payers
Medicare and Medicaid
Medicare enrollment uses Form CMS-855I, the standard application for physicians and non-physician practitioners.23Centers for Medicare & Medicaid Services. CMS-855I – Medicare Enrollment Application – Physicians and Non-Physician Practitioners It requires your practice’s legal information, NPI, tax identification, and details about ownership and managing control. Medicaid enrollment follows a separate process through your state’s Medicaid agency. Build significant lead time into your launch plan: you cannot bill for services rendered before your effective enrollment date.
Private Insurance Credentialing
Most private insurers pull credentialing data from the CAQH ProView database rather than processing standalone applications. You’ll create a profile containing your education, training, board certifications, malpractice history, practice locations, and insurance information. After initial setup, you must re-attest your CAQH profile every 120 days. If you miss the deadline, your profile status changes to “expired,” which can delay or block credentialing with any insurer that relies on the database. The full private-payer credentialing process, from application through panel acceptance, typically takes 90 to 180 days.
Medicare Revalidation
Medicare enrollment isn’t a one-time event. Physicians must revalidate every five years. CMS posts revalidation due dates seven months in advance and sends notices three to four months before the deadline, but the responsibility for tracking the date falls on you.24Centers for Medicare & Medicaid Services. Revalidations (Renewing Your Enrollment) Miss it and CMS can place a hold on your Medicare reimbursements or deactivate your billing privileges entirely. Reactivation requires a brand-new enrollment application, and Medicare will not pay for services provided during the gap. CMS does not grant extensions.
Ongoing Legal Duties After You Open
Medical Record Retention
HIPAA does not require you to keep medical records for any specific length of time; retention requirements come from state law.25U.S. Department of Health and Human Services. Does the HIPAA Privacy Rule Require Covered Entities to Keep Medical Records for Any Period Across states, mandatory retention periods for adult records generally range from five to 11 years, with seven or 10 years being most common. Pediatric records often carry longer requirements, sometimes extending several years past the age of majority. If you participate in Medicare managed care plans, federal rules require retaining records for 10 years. The safest approach is to identify your state’s minimum, compare it against any federal program requirements, and retain for whichever period is longer.
When you destroy records, use HIPAA-compliant methods: shredding for paper, certified data wiping or physical destruction for electronic media. Document what was destroyed and when. A sloppy destruction process can create the same liability exposure as a data breach.
Ending Patient Relationships and Closing the Practice
You can’t simply stop seeing a patient. Once you accept someone for treatment, withdrawing without proper notice can expose you to a patient abandonment claim. The standard across medical ethics and most state laws requires enough advance written notice for the patient to find another provider, with continued necessary care during the transition. Thirty days is the most commonly cited minimum, though the appropriate timeframe depends on the patient’s condition and the availability of other providers in your area.
If you’re closing the practice entirely, the stakes multiply. Sending closure notices at least 60 days in advance is widely considered the baseline. Those notices should explain where records will be stored, how patients can request transfers, and when the last day of operations will be. Posting a notice in your office, publishing an announcement in a local newspaper (where required), and contacting patients with upcoming appointments directly are all standard steps. Practices that close abruptly leave behind licensing board complaints and malpractice exposure that can follow a physician for years.