Checklist · Healthcare · Dental Practice Startup

Dental Practice Startup & Compliance Checklist

A printable checklist for opening an Illinois dental practice. It covers the professional entity, the management agreement, IDFPR licenses and permits, x-ray and controlled substance registrations, HIPAA, workforce safety, and the records that should exist before the first patient is treated.

By Lincoln Square Law · 13-minute read

🖨 Print this checklist

A new Illinois dental practice answers to several regulators before it treats anyone. IDFPR licenses the dentists and hygienists and registers the professional entity. The Illinois Emergency Management Agency must have the x-ray installation registered before the equipment is placed into operation. The Dental Practice Act also limits who may own the practice and what a management company may do for it, and that limit shapes every contract signed during the buildout.

Work through the groups in order. Ownership and the management agreement come first because license registrations, payer enrollment, the lease, and vendor contracts all follow the entity. Items that rest on a statute or regulation carry a citation. Items without one are recommended practice, and the sections after the list explain the points that most often go wrong.

1. Entity, ownership, and IDFPR registration

• Choose the professional entity before signing the lease, the management agreement, or payer applications. The Act bars a corporation from practicing dentistry or holding itself out as owning a dental office, except for the entities and arrangements it lists, which include professional service corporations and limited liability companies authorized by law (225 ILCS 25/44).
• For a professional limited liability company, confirm that every member and every manager is a dentist licensed under the Dental Practice Act, and that the name contains “professional limited liability company,” “P.L.L.C.,” or “PLLC” (805 ILCS 185/13, 805 ILCS 185/12).
• For a professional service corporation, issue shares only to individuals licensed to render the same or related professional services, and do not sign a voting trust or any agreement that gives another person a shareholder’s voting power (805 ILCS 10/11).
• Obtain the entity’s IDFPR certificate of registration before the office opens. A corporation must post its certificate on the premises, and a PLLC that operates without one faces a notice of violation, late fees, and a possible civil penalty (805 ILCS 10/12, 805 ILCS 185/20).
• Prepare an ownership chart that shows every owner, manager or director, voting right, and any entity in the ownership chain, and confirm that the Secretary of State filings, the IDFPR registration, and the governing documents describe the same structure.
• Write buy-sell and redemption terms for death, disability, retirement, license discipline, divorce, and sale, with a stated price or valuation method. A professional service corporation must provide for redemption on a shareholder’s death or disqualification in its articles, bylaws, or a separate agreement (805 ILCS 10/11).

2. The management agreement and the DSO or MSO

• Limit the management company to nonclinical business services. The Act allows a dental management service organization to provide nonclinical business services that do not violate the Act, and it does not allow a corporation to furnish dental services or dentists (225 ILCS 25/44).
• Attach a reserved-powers schedule that keeps diagnosis, treatment planning, clinical supervision, clinical hiring and discipline, record content, and referrals with the dental entity, and state who decides when the parties disagree.
• Test every fee and revenue provision against the Act’s bar on dividing or splitting fees with anyone for bringing or referring a patient (225 ILCS 25/23). Marketing and patient-acquisition charges deserve the closest reading.
• Tie the management fee to a written list of services, each with its pricing method, its pass-through expenses, and a periodic reconciliation the dental entity can audit.
• Confirm that the dental entity controls its operating account, or at least can pay for infection control, required equipment, emergency supplies, and records access without the manager’s approval.
• Keep the management company out of the practice’s public identity. Signage, websites, and patient communications should present the dental entity as the provider, because a corporation may not hold itself out as owning a dental office or furnishing dentists (225 ILCS 25/44).
• Plan the end of the relationship: notice periods, transition services, return of data, and the dental entity’s custody of patient records, which the Act makes the property of the office in which dentistry is practiced (225 ILCS 25/50).

3. Licenses, permits, and office requirements

• Verify every dentist’s and hygienist’s Illinois license with IDFPR before scheduling patients, and track renewals at the practice level rather than leaving them to each clinician.
• Display each license, or a duplicate original, in a conspicuous place in every office where the clinician practices. IDFPR issues a duplicate by affidavit to a clinician who practices at more than one location (225 ILCS 25/20).
• If a dentist will administer general anesthesia, deep sedation, or moderate sedation, confirm that the dentist holds the IDFPR permit before the first case (225 ILCS 25/8.1).
• Adopt a written emergency medical plan for each office that sets staff responsibilities and the office protocol for emergency procedures. The owner of the dental office is responsible for compliance (225 ILCS 25/44.5).
• If the office administers anesthesia or sedation, keep at least one automated external defibrillator on the premises at all times (225 ILCS 25/44.5(b)).
• Register the x-ray installation with the Illinois Emergency Management Agency before the equipment is placed into operation, and calendar the annual registration and fee payment (32 Ill. Adm. Code 320.10).
• If dentists will prescribe, administer, or keep controlled substances, obtain the Illinois controlled substance registration and the DEA registration for each location where they are dispensed. A same-state office where a registered dentist only prescribes and keeps no supply may not need its own DEA registration (720 ILCS 570/302, 21 C.F.R. 1301.12).
• Bind professional liability coverage for the entity and each clinician before clinical work begins, resolve any tail coverage owed under a prior employment, and keep certificates and renewal dates in the startup file.
• Sequence payer credentialing, electronic claims enrollment, merchant processing, and patient financing so that no claim is billed under the wrong entity, location, or provider record.

4. HIPAA and dental records

• Confirm covered-entity status. A health care provider that transmits health information electronically in connection with a covered transaction, such as an electronic dental claim, is a covered entity (45 C.F.R. 160.103).
• Designate a privacy official, a contact person for complaints, and a security official, and record each designation (45 C.F.R. 164.530(a), 45 C.F.R. 164.308(a)(2)).
• Complete an accurate and thorough risk analysis, before any charts are imported from a prior practice, covering the practice management system, imaging, intraoral scanners, email, phones, cloud storage, remote access, backups, and patient messaging (45 C.F.R. 164.308(a)(1)(ii)(A)).
• Inventory every vendor that will create, receive, maintain, or transmit PHI, including billing, IT, cloud, imaging, transcription, shredding, and AI tools, and sign a business associate agreement with the required terms before access begins (45 C.F.R. 164.504(e)).
• Provide the Notice of Privacy Practices no later than the first service, make a good-faith effort to obtain written acknowledgment, post it in a clear and prominent location in the office, and post it on the practice website (45 C.F.R. 164.520(c)).
• Test the patient-access workflow before opening: where requests go, who verifies identity, how the 30-day deadline and any single 30-day extension are tracked, and how electronic copies are produced (45 C.F.R. 164.524(b)(2)).
• Set the chart standard and retention schedule. Every dentist must record all dental work for each patient in enough detail to be used for identification, and the practice must keep dental records for 10 years and provide copies on request to the patient or guardian (225 ILCS 25/50).
• Retain HIPAA policies, risk analyses, and other required documentation for six years from creation or from the date last in effect, whichever is later (45 C.F.R. 164.530(j)(2)).
• Write a records custody and continuity plan for a departing dentist, a sale, a closure, or the end of the management agreement, consistent with the contracts and payer requirements.
• Build an incident escalation path with real names and vendor contacts so that a lost laptop, misdirected email, suspicious login, or wrong-patient disclosure is reported the day it is found.

5. Workforce safety, training, and staff agreements

• Write an Exposure Control Plan for bloodborne pathogens and review and update it at least annually (29 C.F.R. 1910.1030(c)(1)).
• Make hepatitis B vaccination available within 10 working days of initial assignment to every employee with occupational exposure (29 C.F.R. 1910.1030(f)(2)(i)).
• Provide bloodborne pathogens training at the time of initial assignment and at least annually after that, and keep evidence of completion (29 C.F.R. 1910.1030(g)(2)(ii)).
• Train the workforce on HIPAA policies and security awareness before production access, including record requests, identity verification, texting, phishing, workstation security, and incident reporting (45 C.F.R. 164.530(b)(1), 45 C.F.R. 164.308(a)(5)).
• Use written associate, hygienist, and staff agreements, and confirm that compensation, restrictive covenants, schedules, records duties, and termination terms fit Illinois law and the practice’s actual model.
• Assign each task within the person’s license or training. Aiding or abetting a person who is not licensed or registered as a dentist or dental hygienist to practice is a ground for discipline (225 ILCS 25/23).
• If a timeclock or door system scans fingerprints, hands, or faces, publish the retention and destruction policy and give written notice and obtain a written release before enrollment (740 ILCS 14/15). Our biometric timeclock guide covers the details.

6. Pre-opening walk-through and the first 90 days

• Walk the office before opening and check the emergency plan and equipment, accessibility, signage, front-desk privacy, screen positioning, prescription and drug storage, records storage, backup access, and who decides when the owner is absent.
• Run an emergency drill with the full team and document what it exposed and how each gap was corrected.
• Review membership plans, financing programs, discounts, referral promotions, and marketing copy before launch. A violation of the Act’s advertising provisions is a ground for discipline (225 ILCS 25/23).
• Calendar a 90-day review of scheduling, access permissions, billing adjustments, record requests, vendor tickets, turnover, and incidents, and compare actual operations with the written policies and the management agreement.

What the startup file should prove about ownership and control

A dental startup can look compliant on paper while the operating rights point somewhere else. Keep the articles, the operating agreement or bylaws, the management agreement, bank resolutions, the delegated-authority schedule, employment documents, and financing instruments together in one file. Then mark each provision that decides clinical staffing, clinical policy, fee setting, spending on clinical equipment, records access, and continuity if the management relationship ends. Read together, those provisions show whether the licensed dental entity holds the control the structure assumes.

Pricing management services one service at a time

A management fee should trace to real nonclinical work: billing, human resources, IT, marketing, real estate, procurement, bookkeeping, call-center, and administrative support. For each material service, record what is provided, how it is priced, and for what term. Section 23 does not turn every commercial arrangement into a prohibited split. It does make it necessary to show that the money pays for services rather than for patients sent to the practice. We recommend a schedule that prices services individually and is reconciled at least annually, because it is far easier to defend than a single percentage of collections with no explanation behind it.

Making the Section 44.5 plan work on a bad day

Section 44.5 requires a written emergency medical plan for each dental office and places the duty on the owner. A plan that sits in a binder does not help during a fainting episode or an allergic reaction. Assign roles by name, list where the emergency kit, oxygen, and any AED are kept, and set the sequence for calling 911 and handing off to responders. A drill before opening, logged with its fixes, tends to expose an empty oxygen tank or a locked cabinet.

Connecting associate contracts to clinical systems

Before an associate sees patients, confirm the agreement, license, malpractice coverage, payer enrollment, schedule, compensation inputs, system access, and any controlled substance registrations. The compensation formula in the contract should match what the payroll and production reports actually calculate, and someone should be named to correct production attribution, because compensation disputes usually begin with data rather than contract language.

Planning a sale or closing at formation

The formation documents should already say how the practice can be sold or wound down without losing control of patient records or clinical continuity. Identify transfer restrictions, buy-sell mechanics, lender consents, lease assignment terms, equipment liens, management termination rights, and what happens if a buyer is not yet eligible to own the professional entity. For a professional service corporation, leaving the redemption price blank means the shares of a deceased or disqualified shareholder are priced at book value as of the end of the preceding month (805 ILCS 10/11), which may not reflect what the practice is worth. A defined exit path keeps the manager, landlord, lender, or software vendor from holding patient care hostage when ownership changes.