Opening a direct primary care practice: what has to be running before the first patient

Most opening-a-practice checklists are ordered by importance. That is the wrong axis. Everything on the list is important, or it would not be on the list — what actually determines whether you open on time is lead time, and the items that sink an opening date are almost always the ones that could not be hurried and were started too late.

So this list is ordered roughly by how long things take, and the software you will spend the most time agonizing over sits well down it.

Start the long poles now

These have external clocks you do not control. Start them before you have signed a lease, and certainly before you have named a date.

• State medical license, if you need one you do not already hold. Nothing else on this list comes close for lead time. Months, sometimes many.
• DEA registration. Tied to a physical practice address, which means you cannot complete it until you know where you are, and you cannot prescribe controlled substances until it is done. If your state also requires its own controlled-substance registration, that is a second queue.
• Malpractice coverage. Quotes are quick; binding coverage and getting the certificate you will be asked for is not. Decide early between occurrence and claims-made, and if you are leaving an employer on a claims-made policy, find out who is paying for tail coverage before you resign rather than after.
• Business bank account and merchant processing. Underwriting for recurring card payments is slower than people expect, and healthcare gets extra scrutiny. A practice that cannot charge a card on day one has no revenue model.
• Identity proofing for electronic prescribing of controlled substances. The DEA framework requires prescribers to be identity-proofed and to use two-factor authentication at the point of signing each prescription. This is a process with its own timeline, and it is not something you complete on the morning you open.

The entity and identifier layer

Faster, but strictly sequenced — several of these depend on the one before.

1. Business entity and EIN. Formed in your state, with the EIN from the IRS. Nearly everything downstream asks for both.
2. NPI, both types. A Type 1 individual NPI for you as a clinician and a Type 2 organizational NPI for the practice entity. They are free, they come from NPPES, and they are quick — but labs, pharmacies, and software will all ask, so getting them early removes friction later.
3. Your Medicare status. This is the decision most commonly got wrong, and it is worth real advice. Physicians default into participating status, and a participating physician generally cannot charge a Medicare beneficiary privately for a service Medicare covers. If you intend to see Medicare patients under a membership agreement, the mechanism that permits it is opting out: filing an affidavit with your Medicare Administrative Contractor and executing a private contract with each Medicare patient. The details — filing deadlines, how long an opt-out runs, whether and how it renews — have changed over the years, and the penalties for getting it wrong are not small. Direct Primary Care Frontier's write-up is a good orientation; a healthcare attorney and your MAC are the actual answer.
4. State business licensure and any local permits. Unglamorous, occasionally slow.

The membership agreement, and why your state cares

Your membership agreement is not a formality. It is the document that determines whether you are running a medical practice or, in the eyes of a state insurance regulator, an unlicensed insurance company.

Most states now have statutes that define a direct primary care agreement as something other than insurance, which is what makes the model workable. The count keeps changing and the terms differ meaningfully between states, so the only safe move is to read your own state's statute rather than a national summary. Where those laws exist they commonly require the agreement to state plainly that it is not insurance, to describe the scope of services covered by the fee, and to let a patient cancel without penalty — that last one has direct consequences for how you build billing.

Have a lawyer who knows your state draft or review it. This is the single worst place on the list to save money.

The clinical infrastructure

• The EHR. Which is the thing you have probably been thinking about most and which, honestly, you can stand up faster than almost anything above. Choose it deliberately anyway, because it is expensive to change your mind — see what an EHR for a cash-pay or direct primary care practice has to do differently for what to weigh, and read the contract before you sign it.
• Electronic prescribing, with the controlled-substance path above sorted separately and earlier.
• A lab relationship. Direct-bill or wholesale pricing is a core part of the value you are offering. Set up the account, get the pricing in writing, and confirm how results come back to you.
• Imaging and specialist referral paths, ideally with cash prices you can quote to a patient in the room. This is legwork, not paperwork, and it is what patients actually notice.
• PDMP registration in your state, which is generally required before you prescribe controlled substances and is a separate registration from the DEA.
• A CLIA certificate of waiver, if you plan any in-office testing at all. Even waived tests require the practice to hold a certificate, obtained by filing form CMS-116 with your state agency. Practices routinely discover this the week they wanted to start doing strep tests.
• In-office dispensing, if you plan it. Physician dispensing is governed by state law and the rules vary considerably.

The money layer

The financial event in a direct practice is a recurring subscription, not a claim, and it needs to work before the first patient joins rather than after.

That means card-on-file storage, a monthly or annual billing cycle, tiers if you offer them, proration for mid-month joins, a plan for failed cards, and cancellation you can execute quickly — which, as above, several state statutes effectively require. Add bookkeeping and a way to track membership revenue separately from anything else you collect.

Most EHRs cannot do this, so most direct practices run a dedicated membership billing or payments system alongside the clinical record. Assume you are buying two things, and check early how they will talk to each other.

The privacy layer

Worth understanding properly, because the answer is less obvious than it looks.

Under the HIPAA rules, a health care provider is a covered entity only if it transmits health information in electronic form in connection with a covered transaction — claims, eligibility checks, remittance advice, and the rest of the enumerated list. A practice that genuinely never conducts any of those transactions may not meet that definition at all.

That is a technically interesting result and a poor foundation for a privacy program. State medical-record and privacy law applies to you regardless. Retention obligations sit with the practice. Patients assume confidentiality and are not going to read a regulation. And vendors will ask you to sign agreements written on the assumption that HIPAA applies. The practical answer for essentially every practice is to build to the standard: a security risk analysis, business associate agreements with anyone touching patient data, access controls, an audit trail, workforce training, and written policies you can actually produce when asked.

Do it before the first patient, not after the first incident.

A rough sequence

1. Licensure, if needed. Everything waits on it.
2. Entity, EIN, NPIs.
3. DEA and state controlled-substance registration, once you have an address.
4. Malpractice bound.
5. Medicare status decided, with advice.
6. Membership agreement drafted and reviewed by a lawyer in your state.
7. Bank account and recurring payment processing, in underwriting early.
8. EHR selected and configured; e-prescribing and EPCS identity proofing completed.
9. Lab, imaging, PDMP, CLIA if applicable.
10. Privacy program documented.
11. See a patient.

Where Zenthea fits

Zenthea is an AI-native EHR — documentation, orders and prescribing, charting, scheduling, and a patient portal, with a clinical AI assistant, Thea, that drafts and prepares while a human clinician reviews and signs every clinical action. On the list above, it is item eight.

To be plain about the boundary, because this post has just spent a section on it: Zenthea's billing is built around claims and coding. Recurring membership billing is not part of it, so a direct practice would run its membership payments elsewhere.

The wider point is the one worth taking from this post regardless of what you buy. The software decision feels like the biggest one because it is the one with demos and salespeople attached. The items that actually determine whether you open on schedule are sitting in a queue at a licensing board, an insurer, or a payment processor, and they started moving the day you applied.