Starting a medical practice takes about a year of overlapping work: licenses and enrollment, a space, systems, people, and a marketing launch. Vendor checklists usually stop at operations. This one runs on a 12-month timeline, links the official source for every registration step, and ends with the marketing a new practice needs to fill its schedule. Copy it, assign an owner to each line, and check items off.
Not legal, tax or financial advice. Requirements vary by state, province and profession; confirm each item with the agency or advisor named.
Searches for this are small but specific: "starting a medical practice" (110 a month), "how to start a medical practice" (90) and "starting a medical clinic" (40) (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
The 12-month timeline at a glance
A planning frame, counted backward from opening day. Your timeline will differ; credentialing and build-out usually set the pace.
| Months before opening | Focus |
|---|---|
| 12–10 | Business model, entity, license check, location search, financing |
| 9–7 | NPI, Medicare and Medicaid enrollment, CAQH and payer applications, lease signed |
| 6–4 | Build-out, equipment, EHR, phones, HIPAA policies, key hires |
| 3–1 | Website, Google listing, directories, staff training, risk analysis, soft launch |
| Opening to day 90 | First reviews, first ads, measure new patients by source |
Business entity, licenses and DEA registration
- Confirm your state medical license is active for the state where you'll practice. Why: everything downstream, from DEA to payers, depends on it. Find your board through the FSMB state board directory (opens in a new tab).
- Form the business entity and get a tax ID. Why: contracts, bank accounts and payer applications need the entity's legal name. Rules on who may own a medical practice vary by state; ask a healthcare attorney.
- Register with the DEA if you'll prescribe controlled substances. New practitioner applications use DEA Form 224 and are filed online through the DEA registration page (opens in a new tab). Why: registration is tied to an address and state license; DEA's own instructions say not to submit an address change until you have an approved state license for the new address.
- Check state controlled-substance and facility permits. Why: some apply in addition to DEA.
- Apply for a CLIA certificate if you'll run lab tests in the office. CMS's CLIA program (opens in a new tab) regulates laboratory testing on humans; applications use Form CMS-116 through your state agency.
NPI, Medicare and Medicaid enrollment, and credentialing
- Get or update your NPI in NPPES (opens in a new tab), and get one for the practice if you'll bill as a group. Why: payers and directories pull your address and phone from it. See updating your NPI record for what to keep current.
- Enroll in Medicare through PECOS. CMS's enrollment steps (opens in a new tab): get an NPI, apply in PECOS, pay any application fee, then work with your Medicare Administrative Contractor. Why: you can't bill Medicare until enrollment is approved.
- Enroll with your state Medicaid agency if you'll see Medicaid patients, and ask whether its managed care plans contract separately.
- Complete and attest your CAQH ProView (opens in a new tab) profile. CAQH says the first profile takes about two hours. Why: many commercial plans verify credentials from it.
- Apply to each commercial payer. Approval often takes several months; confirm each payer's timeline and follow up every few weeks.
Location, lease and equipment
- Check zoning, parking, accessibility and signage before signing. Why: fixing them after signing is costly.
- Negotiate the lease with an attorney: build-out allowance, rent-free months during construction, exclusivity.
- Plan exam rooms, lab, storage and patient flow, including private space for check-in conversations.
- Order equipment with lead times in mind.
- Buy insurance: malpractice, general liability, property, cyber, and workers' compensation once you hire.
EHR, phones and HIPAA safeguards
- Choose an EHR and practice-management system, and sign its Business Associate Agreement (BAA).
- Set up phones with enough lines and a plan for lunch and after-hours calls. Why: a new patient who reaches voicemail may simply call the next practice.
- Run a security risk analysis. HHS's Security Rule guidance (opens in a new tab) includes a paper on implementation for small providers and links the HHS Security Risk Assessment Tool.
- Sign BAAs with every vendor that touches patient information: billing, email, forms, answering service, website.
- Write privacy and security policies and a Notice of Privacy Practices. Our HIPAA compliance checklist covers the full list.
Staffing and policies
- Hire in order: practice manager first, then front desk and clinical staff.
- Verify licenses and certifications for every clinical hire.
- Train everyone on HIPAA before the first patient, and record it.
- Write front-desk scripts for new-patient calls, insurance questions and scheduling.
- Set financial policies: copays, self-pay prices, cancellations.
The marketing launch: website, Google listing and first ads
The essentials below; the week-by-week version is our 90-day launch checklist.
- Secure the name and domain before printing signs or cards.
- Launch the website about 90 days out: a page per service, provider bios, location and hours, insurance accepted, a phone number at the top, and a HIPAA-compliant appointment-request form.
- Create and verify your Google Business Profile with an opening date. Google lets you set an opening date up to a year ahead (opens in a new tab) and shows the verified profile from 90 days before it. Reviews and photos from patients start once you open.
- Match your name, address and phone across the NPI record, payer directories and Google.
- Plan first reviews: ask satisfied patients after opening; never offer incentives.
- Start a small Google Ads campaign on your main services with a monthly ceiling, once the phones are covered.
- Measure from day one: calls, forms and bookings by source, plus "how did you hear about us?" at intake.
Medfy builds or rebuilds a practice's website on its own domain with a page per service and HIPAA-compliant forms, and you see a free preview before paying. Google reporting brings Search Console, Google Analytics and Business Profile into one view, and Medfy signs a BAA with each practice. Start with the free audit and website preview.
Copy the checklist
This page is the checklist. Copy the items into a spreadsheet or task tool, add an owner and due date to each, and sort by the timeline above. Building another kind of practice? See starting a therapy practice or opening a dental practice, or go back to how to start a private practice for the overview.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
What do I need to start a medical practice?
An active state medical license, a business entity and tax ID, DEA registration if you'll prescribe controlled substances, an NPI, Medicare and Medicaid enrollment if you'll bill them, commercial payer contracts, a compliant location, malpractice and business insurance, an EHR, HIPAA policies with Business Associate Agreements, trained staff, and a website and Google listing live before you open. Requirements vary by state.
How long does it take to open a medical practice?
Plan on about a year from decision to opening day, mainly because payer credentialing and build-out run on other people's timelines. Some practices open faster, especially self-pay or direct-care models that don't wait on insurance contracts. Map your own timeline backward from the opening date, and start credentialing and the lease search first, since those usually take longest.
How do I get credentialed with insurance companies?
Get your NPI first, then enroll in Medicare through PECOS if you'll bill it. For commercial plans, complete and attest your CAQH ProView profile, which many payers use to verify credentials, then apply to each plan you want to join. Approval often takes several months, so confirm each payer's timeline, follow up regularly, and don't schedule insured patients until contracts are active.
When should a new practice launch its website?
About 90 days before opening, at the same time as your Google Business Profile. Google shows a verified profile with an opening date from 90 days before that date, and it should link to a real website. Launch with service pages, provider bios, location and hours, insurance information and a HIPAA-compliant appointment-request form, then add content as you go.