How to Start a Medical Practice in 2026: A Complete Guide

Starting a practice used to mean signing a lease, buying equipment, hiring a front desk, and waiting eighteen months for payer contracts to season. That version still exists, but it is no longer the only version, and for a growing number of clinicians it is not even the default. A practice in 2026 might be entirely virtual, entirely cash-pay, operating in eleven states, and running on a technology stack that costs less per month than a single exam room used to cost per day.

What has not changed is the part underneath. The entity has to be formed correctly for the state you are in, the ownership has to be lawful, the licenses and registrations have to be in place before you see a patient, the contracts have to reflect what you are actually doing, and the money has to move in a way that matches the paperwork. That layer is where practices get into trouble, and it is almost always trouble that was cheap to prevent and expensive to fix.

This is the sequence we use with clients, in the order we use it.

Step one: decide what you are actually building

Before you form anything, you need clear answers to five questions, because every downstream decision depends on them.

What are you treating, and what is explicitly out of scope. Where are your patients physically located, both now and in the states you plan to add. Whether you are seeing patients in person, virtually, or both. Whether you are taking insurance, running cash-pay, or running a hybrid. And whether you are practicing alone, employing other clinicians, or building something that will eventually be owned by more than clinicians.

People skip this step because it feels like strategy rather than setup, and then they form the wrong entity in the wrong state and discover the problem when they try to add a partner, hire a nurse practitioner, or expand into a state with strict ownership rules. The structure follows the model. If you have not decided the model, you are not ready to file anything.

Step two: entity structure and the corporate practice of medicine

This is the decision that produces the most expensive mistakes, and it is the one most often made by a founder in a hurry with an online formation service.

In most states, a practice delivering medical services cannot be owned by a standard LLC or by a person without the right professional license. It has to be a professional entity, a professional corporation or a professional limited liability company depending on the state, and its owners generally have to be licensed in the profession the entity practices. This is the corporate practice of medicine doctrine. It exists to keep clinical judgment in clinical hands, and states enforce it with very different levels of intensity. California, New York, Texas, New Jersey, and Illinois are among the stricter states. Others barely address it. A handful permit ownership structures that would be flatly unlawful elsewhere.

Two additional wrinkles catch people constantly. First, who may own a professional entity varies by profession and by state, so a nurse practitioner, a physician associate, and a physician do not have identical options in the same state. Second, forming the entity with the secretary of state is often not the end of it. Several states require a separate registration or approval from the medical board or the state education department, and some require a fictitious name permit before you can practice under anything other than the owner's legal name.

If your business needs non-clinical ownership, outside investment, or an operating company that spans multiple states, the standard answer is a management services organization paired with one or more professional corporations, with a management services agreement between them. That structure is legitimate and widely used, and it is also frequently built badly. The management fee has to be defensible as fair market value, the professional entity has to retain genuine control over clinical decisions, and the agreements have to say what is actually happening. A management agreement that hands clinical authority to the management company recreates the exact problem the doctrine was written to prevent.

State rules vary widely — our state-by-state CPOM and ownership map walks through posture, ownership, and NP/PA rules for all 50 states.

Step three: licenses, registrations, and numbers

None of this is intellectually difficult. All of it is sequential, and each item has a lead time, which is why it needs to start early.

• State professional license in every state where your patients are physically located at the time of the encounter. Location of the patient controls, not location of the clinician.
• Compact pathways where they apply. The Interstate Medical Licensure Compact now includes forty-four states plus the District of Columbia and Guam, though a few of those have passed legislation that is not yet fully implemented, and notable states including California and New York remain outside it. Nurse practitioners have the Nurse Licensure Compact and the APRN Compact, and the PA Licensure Compact is working through implementation. Compacts speed up licensure, they do not eliminate it.
• DEA registration, plus a state controlled substance registration where the state requires its own. DEA registration is tied to a physical address in each state where you handle or prescribe controlled substances, and that requirement trips up virtual practices routinely.
• NPI numbers. A Type 1 individual NPI for each clinician and a Type 2 organizational NPI for the entity.
• EIN for each entity. In a physician-owned professional entity, the responsible party on the EIN application is the physician owner, not the management company and not the non-clinical founder. We see this filed incorrectly more often than almost anything else on this list, and it is a small error that undermines the story your structure is telling.
• Business license, state tax registration, and foreign qualification in any state where the entity is doing business but was not formed.
• CLIA certificate if you are performing any laboratory testing, including waived tests in the office.

On federal beneficial ownership reporting, the picture changed and then changed again. FinCEN's rule exempting domestic entities from Corporate Transparency Act beneficial ownership reporting was finalized with an effective date of August 14, 2026, leaving foreign-formed entities registered to do business in the United States as the entities still in scope. Several states have moved to create their own beneficial ownership filings, so this is worth confirming at the time you form rather than assuming.

Step four: the contracts

The document set depends on the structure, but a practice with any complexity beyond a true solo owner generally needs some version of the following.

Formation and ownership documents, meaning bylaws or an operating agreement, share issuance, and, in a friendly professional corporation arrangement, the succession or transfer restriction agreement that keeps the entity from being stranded if the physician owner dies, is disciplined, or leaves. Skipping that last one is one of the more consequential omissions in this entire list.

A management services agreement if there is a management company, drafted so that the fee is defensible and the clinical authority stays where it belongs. A medical director agreement where you need clinical oversight of a program, which is a different document from an employment agreement and should not be used as a substitute for one. Employment or independent contractor agreements for every clinician, with the classification actually matching the relationship. Supervision or collaboration agreements where the state requires them for physician associates or nurse practitioners, in the specific form that state requires.

Then the patient-facing and vendor-facing set: informed consent including telehealth-specific consent where applicable, notice of privacy practices, financial and refund policy, business associate agreements with every vendor that touches protected health information, and your standard vendor agreements.

Two drafting principles that save a great deal of pain. Compensation should never be structured as a share of collections tied to referrals or to the volume of services in a way that implicates the federal Anti-Kickback Statute, and cash-pay practices should not assume they are outside this analysis, because many states have their own anti-kickback and fee-splitting laws that apply regardless of payer. And every agreement should describe what you are really doing, because a document that describes an arrangement you are not following is worse than no document at all.

Step five: insurance

Professional liability first. The distinction that matters is claims-made versus occurrence. An occurrence policy covers incidents that happen during the policy period no matter when the claim is filed. A claims-made policy covers claims made while the policy is active, which means when you cancel it or switch carriers you need tail coverage to protect the gap, and tail can cost one to two times your annual premium. New practice owners coming out of employment are frequently surprised to learn that their prior employer's policy leaves them exposed for work already performed. We covered this in more depth in claims-made vs. occurrence coverage for telemedicine clinicians.

Then confirm your policy covers the entity and not only you personally, because the practice can be named separately. Add cyber liability, which is not optional for any practice holding electronic records. Add general liability and property if you have a physical location, and employment practices liability once you have employees.

Step six: money

Set up separate bank accounts before revenue starts moving. In a professional corporation and management company structure, the professional entity collects for professional services and pays the management fee, and the two entities need genuinely separate accounts, separate books, and separate records. Commingled funds are the fastest way to make a correctly designed structure indefensible.

Choose a payment processor that will support a healthcare practice and will sign a business associate agreement if it will handle protected health information. Set up bookkeeping in month one rather than month eleven, with a separate set of books for each entity. If you are cash-pay, decide your pricing based on your actual cost to deliver care and your capacity, not on what the practice down the street charges.

One requirement cash-pay practices miss constantly: under the No Surprises Act, providers must give uninsured and self-pay patients a good faith estimate of expected charges. It applies whether or not you have anything to do with insurance.

Step seven: technology

Pick the electronic health record first, because everything else connects to it. Evaluate it on whether it supports your actual workflow, whether it handles the documentation your specialty requires, whether it does e-prescribing including EPCS if you prescribe controlled substances, whether it supports the messaging and scheduling you need, what it costs to get your data out, and whether the vendor will sign a business associate agreement.

Around it you need secure messaging, a telehealth platform if you are virtual, payments, e-fax, scheduling, and a way to store documents that is not your personal drive. Every vendor touching protected health information needs a business associate agreement in place before it touches anything.

Then do the part almost nobody does at launch. The HIPAA Security Rule requires a documented risk analysis covering the systems that handle electronic protected health information, and inadequate risk analysis has been the most frequently cited deficiency in Office for Civil Rights investigations for years. Doing it at launch, when your stack is six vendors instead of thirty, takes an afternoon.

Our advice on building your own software: do not, at least not at the start. Configure well-chosen tools and spend your energy on care delivery and growth.

Step eight: payers, or the decision not to have them

If you are taking insurance, start credentialing early and plan for it to take longer than you are told. Ninety to one hundred eighty days per payer is a realistic range, and it varies by payer and state. You will need your CAQH profile current, your Type 2 NPI, your entity documents, malpractice coverage in place, and patience. Credentialing cannot begin in earnest until the entity exists and the insurance is bound, which is one reason the sequence in this article matters.

If you are cash-pay, you skip that timeline entirely, which is a large part of why so many new practices launch that way. You take on a different set of obligations instead: transparent pricing, good faith estimates, superbills if patients want to submit on their own, and a marketing function that has to actually work, because no payer network is sending you patients.

Step nine: telehealth and multi-state practice

The governing principle is that you must be licensed where the patient is located at the time of the encounter. Everything else follows from that. States differ on whether an initial visit can be conducted by video or audio only, on what your consent has to say, on modality restrictions for specific services, and on standard-of-care documentation.

For controlled substances, the DEA and HHS issued a fourth temporary extension of the COVID-era telemedicine prescribing flexibilities, effective January 1, 2026 through December 31, 2026, allowing DEA-registered practitioners to prescribe Schedule II through V controlled substances via telemedicine without a prior in-person evaluation where the other requirements are met. The agencies have said they intend to finalize permanent rules, including a special registration pathway for telemedicine, before that deadline. If your model depends on remote prescribing of controlled substances, build with the assumption that the permanent framework will be more demanding than the temporary one, and watch that rulemaking closely. See also DEA registration for telehealth prescribers.

Step ten: getting patients

You can do everything above correctly and still have an empty schedule. Plan for acquisition with the same seriousness you plan for structure.

At minimum: a website that says clearly who you treat and what it costs, a Google Business Profile if you have a physical location, and content that answers the questions your patients are actually searching. Then build the part most practices never build, which is what happens after the first visit. Telehealth companies have spent a decade learning how to keep patients engaged between appointments, and independent practices generally have appointment reminders and nothing else. A program is only as good as what you provide between visits, and retention is cheaper than acquisition in every model we have ever run the numbers on.

A realistic timeline

A cash-pay virtual practice in a single state can realistically open in sixty to ninety days. A multi-state practice, or one taking insurance, should plan on six months or more, with credentialing as the long pole.

The mistakes we see most often

Forming a standard LLC in a state that requires a professional entity, then discovering the problem when a bank, a payer, or a malpractice carrier asks a question. Using a template management services agreement that assigns clinical control to the management company. Naming the wrong responsible party on the EIN. Treating a medical director agreement as though it makes someone an owner, or treating ownership as though it makes someone a medical director. Building a multi-state model on a DEA registration tied to a single address. Skipping tail coverage when leaving a prior employer. Running practice revenue through a personal account for the first four months because the business account was not open yet. And launching without any plan for what happens to a patient after the first visit.

Every one of these is inexpensive to fix before launch and genuinely painful to fix after.

How we help

At Camino Strategy Group, this is the work we do. We build the structure and the operating layer underneath new practices and healthcare companies: entity and professional corporation formation, corporate practice of medicine analysis for the states you are operating in, management services and clinical agreements, multi-state licensing and expansion, technology selection and configuration, and the operational processes that keep the whole thing running after launch. Our background is in state regulatory work, which means we built this from the enforcement side before we built it from the founder side.

If you are somewhere in this list and not sure whether you have it right, tell us what you are building and we will walk you through it.

This article is general information based on independent research, not legal, tax, or accounting advice. Requirements change and vary by state — confirm specifics for your situation with appropriately licensed professionals.

References

• Interstate Medical Licensure Compact Commission: https://imlcc.com/
• DEA and HHS, Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, effective January 1, 2026 through December 31, 2026: https://www.federalregister.gov/documents/2025/12/31/2025-24123/fourth-temporary-extension-of-covid-19-telemedicine-flexibilities-for-prescription-of-controlled
• HHS, Prescribing controlled substances via telehealth: https://telehealth.hhs.gov/providers/telehealth-policy/prescribing-controlled-substances-via-telehealth
• FinCEN, Beneficial Ownership Information Reporting: https://www.fincen.gov/boi
• HIPAA Security Rule, risk analysis requirement, 45 C.F.R. 164.308(a)(1)(ii)(A)
• Federal Anti-Kickback Statute, 42 U.S.C. 1320a-7b(b)
• No Surprises Act good faith estimate requirements for uninsured and self-pay individuals, 45 C.F.R. 149.610
• CMS National Plan and Provider Enumeration System (NPI): https://nppes.cms.hhs.gov/
• CMS Clinical Laboratory Improvement Amendments (CLIA): https://www.cms.gov/medicare/quality/clinical-laboratory-improvement-amendments