Chicago Healthcare Practice Startup Lawyer: Formation and Day-One Compliance

Opening a practice puts two bodies of law on the same calendar. Illinois licensing law decides who may own the entity, who may manage it and how money may move between the practice and anyone else. HIPAA and Illinois privacy law apply from the first patient. The early choices, which entity, which owners, whether a management company is involved and which vendors hold patient data, are hard to undo once the registration, the payer enrollments and the contracts are in the entity’s name.

Where this page fits with our profession pages

The rules differ by license, and we do not repeat them here. Dentists should read the dental practice page, physicians the physician practice page, and psychologists and therapists the behavioral health page. Pharmacists, optometrists, physical therapists, advanced practice nurses and others will find their licensing acts listed on the page for IDFPR-licensed professionals. This page covers what every new practice has in common: the launch sequence, the documents and the first year of compliance.

Choosing an entity Illinois law allows for your license

An ordinary business corporation or LLC is usually the wrong vehicle for a licensed practice. Illinois provides professional entities, each with ownership limits and a registration step with the Illinois Department of Financial and Professional Regulation (IDFPR).

• Medical corporation. Physicians may incorporate under the Medical Corporation Act. Every officer, director and shareholder must be licensed under the Medical Practice Act, and the corporation may not open or operate an establishment without a certificate of registration from IDFPR (805 ILCS 15/5, 15/13).
• Professional service corporation. Licensed professionals may incorporate to render one professional service or a group of related services that the Act lists. Shares may be held only by licensed individuals, and the corporation needs a certificate of registration from its regulating authority (805 ILCS 10/3.6, 10/11, 10/12).
• Professional limited liability company. The Professional Limited Liability Company Act sets the rule profession by profession. For dentistry, all members and managers must be licensed dentists. For medicine, all managers must be physicians and each member must be a physician or one of the entities the Act names, such as a medical corporation (805 ILCS 185/13). The company must hold an IDFPR certificate of registration before it opens (805 ILCS 185/15).

The Dental Practice Act adds its own rule. No corporation may practice dentistry or furnish dentists, subject to listed exceptions that include dental professional corporations and dental limited liability companies, and a management organization may supply non-clinical business services that do not violate the Act (225 ILCS 25/44). Among the entities the law allows, the choice turns on tax treatment, how partners will be admitted later and whether a management company is planned. We set those questions out in a structure memo before anything is filed.

The corporate practice rule and when an MSO/PC structure applies

The Illinois Supreme Court has explained the corporate practice of medicine doctrine this way: a corporation cannot be licensed to practice medicine because only a human being can sustain the education, training and character screening required for a license. In Carter-Shields v. Alton Health Institute, No. 90767 (Ill. Sept. 19, 2002), the court refused to enforce a physician’s employment agreement with an unlicensed entity that was owned in part by non-physicians. The same opinion recognizes that a corporation formed under the Medical Corporation Act has been sanctioned by the legislature to employ physicians.

A management services organization (MSO) paired with a professional entity (PC) is the usual answer when someone who does not hold the license will supply capital or run the business side. The professional entity owns the practice, employs the clinicians and controls clinical decisions. The MSO supplies space, equipment, staff for non-clinical work, billing and administration under a written management agreement. A solo owner with no outside party does not need an MSO, which is why the bundle includes one only where it applies.

The management fee is where these structures most often need care. For physicians, the Medical Practice Act bars dividing professional fees except as the section allows (225 ILCS 60/22.2(a)). It permits a fair market value fee for billing and collection services, including a percentage fee, if the physician controls the amount of the fees charged and collections go to the physician or to an account under the physician’s sole control (225 ILCS 60/22.2(d)). It does not permit paying a percentage of professional fees, revenues or profits for marketing or management of the practice (225 ILCS 60/22.2(f)). Our recommendation is a management fee that is fixed or based on cost, supported in writing as fair market value.

Owner agreements signed before the doors open

Two or more owners need a shareholder or operating agreement that answers the hard questions while everyone still agrees: who decides what, how owners are paid, what a new partner pays to buy in, and what happens when an owner dies, becomes disabled, leaves or loses a license. Licensing law makes the last point unavoidable. Because only licensed individuals may hold shares in a professional corporation, the Professional Service Corporation Act requires a mechanism for purchasing the shares of a shareholder who dies or becomes disqualified, and it supplies a book value default when the documents are silent (805 ILCS 10/11). Our recommendation is to choose the valuation method and the payment terms yourselves instead of relying on that default.

Registrations and enrollments that control the opening date

Several steps depend on one another, so the order matters. The entity is formed and then registered with IDFPR. A provider that will bill electronically must obtain a National Provider Identifier and report changes to its required data within 30 days (45 C.F.R. 162.410(a)). A practice that will see Medicare patients submits an enrollment application with its licenses and identifiers and agrees to receive payment by electronic funds transfer, and CMS enrolls the practice once that process is complete (42 C.F.R. 424.510). Private payers run their own credentialing. We put these steps on a single timeline so the target opening date reflects them.

Profession-specific permits are listed in our dental startup checklist and physician practice checklist. If you are about to sign for space, read the lease red-flag checklist for healthcare practices first.

The day-one compliance package

A practice that bills electronically is a HIPAA covered entity from its first transaction (45 C.F.R. 160.103). The package puts the required pieces in place before patients arrive.

• HIPAA. A named privacy official and security official, a first risk analysis of the systems you have chosen, written privacy and security policies, and a notice of privacy practices, which must be given no later than the first service, posted at the office and placed on the practice website if there is one (45 C.F.R. 164.530, 164.308(a)(1)(ii)(A), 164.308(a)(2), 164.520(c)). Each new workforce member must be trained within a reasonable period after joining, and the documentation is kept for six years (45 C.F.R. 164.530(b), (j)).
• Vendor BAAs. An inventory of every vendor that will hold patient information, such as the records system, the billing company, the IT contractor and any management company, with a business associate agreement reviewed for each (45 C.F.R. 164.502(e), 164.504(e)). Laboratories that receive information for treatment are handled differently, as our healthcare compliance page explains.
• Workforce policies. The confidentiality and sanctions policies that HIPAA requires (45 C.F.R. 164.530(e), (i)), and, if you plan a fingerprint or face-scan timeclock, the written policy, notice and release that the Biometric Information Privacy Act requires before the first scan (740 ILCS 14/15).
• First compliance calendar. A 12-month calendar that assigns an owner and a date to each recurring duty: license and registration renewals, training, the risk analysis review, vendor agreement renewals, and the annual report to HHS of any small breaches, due within 60 days after the calendar year ends (45 C.F.R. 164.408(c)).

The 6-month check-in

A 6-month check-in is included. Six months after opening, the documents and the daily operation have usually drifted apart. At the check-in we compare the formation file and the compliance package with how the practice now runs, and we give you a short list of corrections.

How the launch engagement runs

The work is one bundle with a defined scope. It starts with a conversation about your license, the owners, any investor or manager, the payers you plan to bill and your target date. From there we deliver the structure memo, form and register the entity, prepare the owner agreements and any management agreement, and build the compliance package and calendar.

The work is led by Abdul Kadir Mohamed, the firm’s founding attorney. He has served as in-house general counsel and privacy officer for multi-site healthcare organizations operating under an MSO/PC structure, is licensed in Illinois and Missouri, and holds a J.D. with a Health Law Certificate from Saint Louis University School of Law.

Common questions about opening a healthcare practice in Illinois

Can someone without a license own part of my practice?

Not of the professional entity, for the professions discussed above. The Medical Corporation Act, the Professional Service Corporation Act and the Professional Limited Liability Company Act each limit ownership to licensed persons or to the entities the Act names. An unlicensed party takes part through a separate management company that provides non-clinical services for a fee.

Should I form a corporation or a PLLC?

Either can work if your profession’s statute allows it. The decision usually turns on tax elections, how you expect to admit partners and whether an MSO is planned. Both need an IDFPR certificate of registration before the practice opens.

Do I need an MSO to open?

Usually not. A practice owned and run only by its licensed owners can hold its own lease, equipment and staff. An MSO becomes relevant when an unlicensed person will invest or manage, or when you plan several locations under common management.

When does HIPAA start to apply to a new practice?

When the practice transmits health information electronically in connection with a standard transaction, such as an insurance claim (45 C.F.R. 160.103). The notice of privacy practices must be given no later than the first service (45 C.F.R. 164.520(c)), so the practical answer is that the program should exist before opening day.

Do you work with pharmacists and other health professions?

Yes. The bundle is offered to dentists, physicians, pharmacists and other health professionals. Each profession has its own licensing act, so we begin with yours and confirm which entity types and ownership rules apply before recommending a structure.

What does the 6-month check-in cover?

Ownership and signing authority, registrations and renewals, vendors added since opening and their agreements, training records for staff hired after launch, any incidents, and the next six months of the compliance calendar.

Related resources

General information only; not legal advice and does not create an attorney-client relationship.