Legal & Licensing

Detailed Guide

Physician Licensure & the Interstate Medical Licensure Compact

Start your license application ASAP — it's mostly paperwork you already have. The IMLC compact can cut multi-state licensing from months to just weeks!

Every state has its own medical board with distinct application processes, documentation requirements, background checks, fees, and timelines -even when the requirements sound similar on paper. Start at the Federation of State Medical Boards (fsmb.org/contact-a-state-medical-board) to find your exact state board. Identify your application type (initial, endorsement, or IMLC expedited), fingerprinting requirements, and license renewal/CME cadence. If you plan to practice in multiple states (telehealth, locums, or a multi-state group), the Interstate Medical Licensure Compact (IMLC) dramatically changes your strategy. As of early 2026, 42 states plus DC and Guam participate as full IMLC members with State of Principal License (SPL) status, meaning you can obtain expedited licenses in other compact states. Non-member states (California, New York, and a few others) require separate full applications. Check imlcc.com for current membership status and whether your state can serve as your SPL -this single factor can cut your multi-state licensure timeline from months to weeks.

Edit History & Comments

Pending Edits

Last updated by community

Controlled Substances: State Licenses, DEA Registration & PDMP

Quick check: does your state need a separate controlled substance license? A 15-minute lookup now prevents weeks of prescription delays later. Most states make this straightforward.

This is one of the cleanest, most operationally important state-by-state differences and a common launch blocker. In some states, your medical license alone provides state authority for controlled substances. In others -including Alabama, Connecticut, Delaware, Hawaii, Idaho, Illinois, Indiana, Iowa, Louisiana, Maryland, Massachusetts, Michigan, Missouri, Nevada, New Jersey, New Mexico, Oklahoma, Rhode Island, South Carolina, South Dakota, Utah, Wyoming, and DC -you must obtain a separate state controlled substance registration before or alongside your DEA application. The DEA publishes the authoritative state-by-state table at deadiversion.usdoj.gov. If your state shows "Yes" for a second CS license, build that into your timeline before you write a single controlled substance prescription. Additionally, every state operates a Prescription Drug Monitoring Program (PDMP) with varying requirements for who must register, when you must check (first Rx, every Rx, certain schedules, certain day-supply thresholds), and whether delegates can access the system. Register for your state PDMP early -find your state profile at pdmpassist.org/state and your state Board of Pharmacy at nabp.pharmacy.

Edit History & Comments

Pending Edits

Last updated by community

HIPAA Compliance: Building Your Minimum Viable Program

HIPAA boils down to: encrypt everything, get vendor agreements, train your team, and have a breach plan. Templates are widely available — you don't need to build this from scratch!

HIPAA compliance is not optional and it is not something you bolt on after launch. The Security Rule requires an "accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information" (45 CFR 164.308). Build these six components before seeing your first patient: (1) A written risk analysis identifying where ePHI lives, who accesses it, and what could go wrong. (2) A risk management plan documenting what you will do about each identified risk. (3) Business Associate Agreements (BAAs) with every vendor that touches PHI -your EHR, email provider, cloud fax, clearinghouse, billing service, cloud storage, and any IT support. HHS publishes sample BAA provisions at hhs.gov. (4) A Notice of Privacy Practices (NPP) given to every patient at first visit. (5) A breach notification process -business associates must notify you within 60 days of discovery, and you must report to HHS and affected individuals. (6) Practical safeguards: MFA everywhere, encrypted devices, password manager, written policies for access control, device use, incident response, and data disposal. Staff training -even if staff is just you. Finally, prepare your patient-facing consent forms for check-in well before opening day: at minimum, you need a HIPAA Notice of Privacy Practices acknowledgment, a consent to treat, a financial responsibility/assignment of benefits form, and any specialty-specific consents. Many practices also include a communication preferences form (how may we contact you?), a release of information authorization, and a no-show/cancellation policy acknowledgment. Have your healthcare attorney review these for state-specific requirements, then build them into your intake workflow -whether paper or digital -so they are ready to go on day one.

Edit History & Comments

Pending Edits

Last updated by community

Malpractice & Business Insurance Stack

Primary care malpractice runs $6K–15K/year — your insurance broker handles most of the legwork. Just get your declarations page quickly since credentialing applications need it.

Malpractice (professional liability) insurance is non-negotiable -most states require it for licensure, most hospitals require it for privileges, and payers require documentation during credentialing. Understand the two policy types: occurrence-based (covers incidents that occur during the policy period regardless of when claims are filed) and claims-made (covers claims filed during the policy period, requiring tail coverage if you switch carriers or retire). Premiums vary enormously by specialty and state -a family medicine physician might pay $6,000-15,000/year while an OB/GYN or surgeon could pay $30,000-100,000+. Get your malpractice declarations page (face sheet) immediately -CAQH has specific upload workflows for this document and a mismatch between your entered expiration date and the face sheet date will cause rejection. Beyond malpractice, build a complete insurance stack: general liability ($500K-1M), cyber liability (critical given ransomware targeting healthcare), property insurance (even for home office equipment), workers' compensation (required once you hire in most states), and consider business interruption coverage. Keep all policy documents in your 04-Malpractice folder with consistent naming.

Edit History & Comments

Pending Edits

Last updated by community

Contracts, Agreements & Corporate Practice of Medicine

Budget $5K–20K for a healthcare attorney to review your contracts and set up your entity. It's the best money you'll spend — catches expensive problems before they start.

Your practice will generate a stack of contracts before you see patient one: entity formation documents, commercial lease, vendor agreements (EHR, billing, clearinghouse, labs), employment agreements for staff, independent contractor agreements (if using locums or 1099 providers), and payer contracts. Every vendor that touches PHI needs a signed BAA. For payer contracts, understand that credentialing (verifying your qualifications), contracting (agreeing to rates and terms), and enrollment (activating claims/ERA/EFT) are three separate stages with separate timelines. The Corporate Practice of Medicine (CPOM) doctrine adds another layer: even for a physician-owned practice, CPOM and fee-splitting rules affect what management, billing, marketing, and MSO contracts are legally permissible in your state. States have been actively legislating in this area through 2025-2026 -sourceonhealthcare.org tracks active CPOM bills. If you plan to use a billing company, management company, or any non-physician entity for practice operations, get a CPOM/fee-splitting risk assessment from healthcare counsel before signing. The cost of legal review upfront is a fraction of the cost of unwinding a non-compliant structure later.

Edit History & Comments

Pending Edits

Last updated by community

Legal & Licensing

My Tasks

Detailed Guide

Physician Licensure & the Interstate Medical Licensure Compact

Edit History & Comments

Pending Edits

Controlled Substances: State Licenses, DEA Registration & PDMP

Edit History & Comments

Pending Edits

HIPAA Compliance: Building Your Minimum Viable Program

Edit History & Comments

Pending Edits

Malpractice & Business Insurance Stack

Edit History & Comments

Pending Edits

Contracts, Agreements & Corporate Practice of Medicine

Edit History & Comments

Pending Edits

Complete Your Profile

Apply to Be a Site Admin