DPC Compliance Before Launch: The Decisions to Confirm

Start With Your Practice, State, and Contracts

Direct Primary Care is not a single national legal template. Requirements can change with the state, ownership structure, services, payer relationships, patient population, and the physician's existing contracts.

Freedom Healthworks provides operational guidance, not legal or insurance advice. Use this framework to organize decisions with a healthcare attorney, malpractice broker or carrier, accountant, and other licensed advisers.

1. Confirm the Entity and Membership Agreement

Ask healthcare counsel to review:

Do not reuse another practice's agreement without state-specific review. The agreement should match the services and workflows patients will actually receive.

2. Decide How Medicare Fits the Practice

Medicare participation, nonparticipation, and opt-out are different paths. A physician who opts out must meet CMS requirements, submit an affidavit, and use compliant private contracts with Medicare patients. CMS also states that a physician who does not see Medicare patients does not have to enroll in or opt out.

Review the current CMS Medicare opt-out requirements with counsel and the applicable Medicare Administrative Contractor before accepting membership payments from Medicare beneficiaries.

3. Determine HIPAA Status and Privacy Duties

A medical practice is not automatically a HIPAA covered entity solely because it provides care. HHS defines a covered health care provider as one that transmits health information electronically in connection with a HIPAA-standard transaction.

Use the HHS covered-entity guidance to confirm the practice's status. If HIPAA applies, build the required privacy and security program, perform the appropriate risk analysis, and use business associate agreements when a vendor performs covered functions involving protected health information. HHS explains the scope and exceptions in its business associate guidance.

Practices outside HIPAA can still have state privacy, confidentiality, data-security, breach-notification, and professional duties. Counsel should map those obligations before patient data enters an EHR, messaging platform, website form, analytics tool, or other system.

4. Obtain Malpractice Terms for the Actual Practice

DPC does not automatically produce a lower malpractice premium. Pricing and coverage can vary by specialty, location, hours, services, procedures, claims history, policy form, limits, and carrier underwriting.

Give the broker or carrier a complete description of the planned practice, including:

Request a written quote and written confirmation that the described activities are covered. The NAIC medical malpractice overview explains the basic difference between claims-made and occurrence coverage. Neither form is universally preferable; compare the full policy terms, exclusions, limits, consent provisions, and long-term cost.

5. Resolve Prior-Acts or Tail Responsibility

When leaving employment or replacing a claims-made policy, review the employment agreement and expiring policy before the transition date. Confirm:

Do not rely on a national tail-cost estimate. The answer is contract- and policy-specific.

6. Build a Launch Compliance File

Before opening, keep written evidence of the decisions that apply to the practice:

This is a decision file, not a universal checklist. Mark an item complete only after the responsible adviser or agency confirms it for the specific practice.

Questions Worth Asking

For healthcare counsel

For the malpractice broker or carrier

For each technology vendor

What Freedom Coordinates

Freedom can help physicians organize launch work, identify unresolved decisions, and coordinate with selected legal, insurance, technology, and operational vendors. Freedom does not issue legal opinions, bind insurance, or replace the physician's licensed advisers.