Checklist · Healthcare · Practice Formation

Physician Practice Formation & Compliance Checklist

A formation-to-launch checklist for Illinois medical practices: entity authority, clinical control, fees, HIPAA, vendors, workforce, patient rights, and the evidence a new practice should be able to produce.

By Lincoln Square Law · 8-minute read

🖨 Print this checklist

Entity, ownership, and authority

• Confirm the entity form before signing leases, payer applications, or vendor contracts. A medical corporation may be formed under the Medical Corporation Act, and a professional limited liability company must satisfy the physician-member and manager requirements in 805 ILCS 185/13.
• Create a current ownership and governance chart showing every shareholder or member, every manager or director, voting rights, and any entity owner. Do not rely on the cap table alone when another entity appears in the ownership chain.
• Reserve clinical decisions to licensed professionals. Management, budgeting, staffing support, and administrative services may be delegated, but agreements should not transfer diagnosis, treatment, prescribing, professional supervision, or other licensed judgment to an unlicensed manager.
• Review every management, billing, marketing, and referral compensation formula against 225 ILCS 60/22.2. Separate fair-market-value administrative services from payments tied to referrals or prohibited percentage sharing of professional fees.
• Put succession rules in the owner agreement for death, disability, license restriction, departure, divorce, and sale. The practice should know who can hold or acquire the interest if an owner becomes ineligible.

Licensure, premises, and revenue-cycle setup

• Verify every clinician’s Illinois license status and scope before scheduling care, and calendar renewal dates. Add controlled-substance and other profession-specific registrations when they are actually required for the services offered.
• Map the payer-enrollment sequence before opening. Credentialing, entity identifiers, bank information, ownership disclosures, and effective dates should be reconciled so the practice does not bill under an entity or clinician before enrollment permits it.
• Confirm that the lease and buildout documents permit the actual medical use, signage, equipment, records storage, and vendor access the practice needs. Identify who owns fixtures and patient records if the lease or management relationship ends.
• Bind professional liability and other required insurance before patient care begins. Document who pays tail coverage when a clinician leaves and how certificates are monitored.

HIPAA and information governance

• Determine covered-entity status and designate privacy and security responsibility before production systems hold PHI. The designation should name people who can make and document decisions, not merely a title.
• Complete an initial HIPAA Security Rule risk analysis based on the real EHR, email, devices, remote access, backups, imaging, online forms, and cloud services (45 C.F.R. 164.308(a)(1)(ii)(A)).
• Create a vendor inventory and execute required business associate agreements before a vendor creates, receives, maintains, or transmits PHI on the practice’s behalf (45 C.F.R. 164.504(e)).
• Adopt privacy and security policies that match the actual workflows. Include patient access, amendment, confidential communications, minimum necessary, role-based access, incident escalation, backup recovery, sanctions, and termination of access.
• Prepare and post the Notice of Privacy Practices and make the required good-faith effort to obtain acknowledgment for direct-treatment relationships (45 C.F.R. 164.520).

Workforce, technology, and launch evidence

• Train each workforce member before broad production access and retain evidence of the date, topics, and attendance. Pair training with access provisioning so permissions match job duties.
• If the practice uses fingerprint, face, voice, or other biometric identifiers covered by BIPA for timekeeping or access, publish the required retention-and-destruction policy and obtain the required written release before collection (740 ILCS 14/15).
• Test one patient-record access request and one security incident before go-live. The test should identify the owner, deadline, decision path, vendor contacts, and evidence the practice will preserve.
• Create a 12-month compliance calendar for license renewals, payer revalidation, policy review, risk-analysis updates when the environment changes, vendor reviews, training, and contract renewal dates.

Use the checklist as a closing file, not a memory aid

A formation checklist is most valuable when each checked item points to evidence. Keep the filed articles, ownership records, license verification, executed agreements, insurance binders, payer confirmations, risk-analysis work papers, BAAs, policy approvals, training records, and test results in one indexed launch file. If the only proof is that someone remembers doing the task, the practice will have difficulty reconstructing the decision when a payer, regulator, investor, or buyer asks for it.

Entity law and operating reality have to match

Illinois permits several professional-entity paths, but the entity label does not answer who actually controls the practice. Review voting rights, bank control, hiring and termination authority, clinical policies, management-service rights, lender covenants, and transfer provisions together. The question is whether the legal documents and daily operations leave licensed professionals responsible for licensed work while allowing nonclinical support to remain genuinely nonclinical.

Fee arrangements deserve a separate review

Section 22.2 is specific enough that compensation should not be buried inside a general contract review. Identify every payment based on professional revenue, collections, referrals, marketing, network participation, or management. Then identify the statutory exception or business rationale for the payment. A billing arrangement can use a percentage in circumstances the statute permits, but that does not make every percentage management fee permissible. The practice should be able to explain what service is being purchased, how the fee was set, where collections are deposited, and who controls professional charges.

HIPAA is an operating system for the first month

A new practice often has its greatest information risk before workflows settle. Employees are learning systems, vendors are being connected, data are being imported, and temporary workarounds are common. The initial risk analysis should therefore produce a short risk-management plan with owners and dates rather than a static report. Review that plan after the first month and again after material technology or staffing changes. Documentation required by the Security Rule generally must be retained for six years from creation or the date it last was in effect, whichever is later (45 C.F.R. 164.316(b)(2)(i)).

The launch file becomes diligence later

The same evidence that makes opening safer becomes valuable in a financing, sale, payer audit, privacy investigation, or partner dispute. Keep versioned governing documents, signed vendor agreements, license records, policies, workforce acknowledgments, and significant compliance decisions. When the practice changes a workflow, record why. A short contemporaneous record is usually more persuasive than an explanation written months later after a problem appears.

Payer and ownership records should tell the same story

Enrollment forms, CAQH profiles, tax records, bank accounts, ownership disclosures, and contracts should identify the same legal practice and responsible owners. When one system lists an old entity, prior address, former owner, or different billing relationship, correct the mismatch before claims are submitted. Keep copies of the filed enrollment and the effective-date notice. A startup should also decide who is authorized to change payer records and how those changes are documented, because unauthorized or poorly sequenced changes can interrupt payment and create a record that is difficult to reconcile later.

Employment and contractor documents are part of the compliance architecture

Offer letters and clinician agreements should match the role the practice actually expects. Define clinical duties, schedule, documentation expectations, supervision if applicable, compensation mechanics, professional-liability coverage, records ownership, confidentiality, technology use, and what happens at termination. For contractors, do not use the label as a substitute for analyzing the real relationship. The contract should also address return of property, system access, and cooperation with patient-record continuity. When a clinician leaves, the offboarding checklist should connect HR, payer, access, scheduling, prescribing, and patient-communication steps rather than treating them as separate projects.

A launch decision log makes later questions easier to answer

Keep a short decision log for material formation choices: why the entity form was selected, who approved the management fee, what risk-analysis findings were accepted or deferred, why a vendor was chosen, and what controls were required before go-live. The log does not need to become a board book. It should identify the issue, the evidence reviewed, the decision, the owner, and the follow-up date. That record is especially useful when the practice grows and the people who made the original decision are no longer handling daily operations.