Do I need a special license for DPC?

No special license is required in most states. DPC agreements are generally exempt from insurance regulation under state-specific DPC statutes. As of 2026, 35+ states have enacted DPC-enabling legislation.

DPC Compliance and Legal Requirements: What You Need to Know Before You Launch

Q: Is DPC legal in my state?

DPC is legal in all 50 states. Over 35 states have specific DPC-enabling statutes that clarify membership agreements are not insurance products, providing a clear legal framework for practice.

This Isn't Legal Advice (But It's What Your Lawyer Will Ask About)

Before we get into specifics, a disclaimer: we're DPC practice consultants, not attorneys. Everything here is informed by our experience across 155+ practice launches in dozens of states, but you need a healthcare attorney for your specific situation.

That said, we know exactly what questions your attorney will ask—because we've sat in those meetings hundreds of times. Here's what you need to understand before you walk in.

Is DPC Legal in My State?

Short answer: yes, DPC is legal everywhere in the United States. The longer answer involves nuance.

DPC enabling legislation refers to state laws that explicitly define Direct Primary Care agreements as medical service contracts rather than insurance products. Over 40 states have enacted such legislation, providing legal clarity for physicians and patients.

As of 2026, over 40 states have passed DPC-specific enabling legislation. These laws explicitly state that DPC membership agreements are not insurance, which means:

DPC practices don't need an insurance license

Membership agreements aren't regulated by state insurance commissioners

Patients aren't "insured" by their DPC membership (important for coverage stacking)

States with DPC legislation (as of early 2026) include: Alabama, Arizona, Arkansas, Colorado, Connecticut, Florida, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Michigan, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Washington, West Virginia, Wisconsin, and Wyoming.

States without specific legislation (but where DPC still operates legally): California, Hawaii, Illinois, Massachusetts, Minnesota, New York, Pennsylvania, Rhode Island, Vermont, and others.

Even without specific legislation, DPC operates legally in every state. The enabling legislation just provides extra clarity and protection. If your state doesn't have a DPC law, your attorney will structure your membership agreement as a medical services contract—which is perfectly legal.

Membership Agreement Essentials

Your membership agreement is the legal foundation of your practice. It needs to be clear, compliant, and patient-friendly. Here's what it should cover:

Required elements:

Description of services included in the membership

Monthly fee and payment terms

Duration and renewal terms

Cancellation policy and refund provisions

Clear statement that the agreement is NOT insurance

Statement that patients should maintain health insurance for services not covered

HIPAA notice of privacy practices

Scope of services (what's included, what's not)

Important language:

The agreement should explicitly state that DPC is not a substitute for health insurance

Include a recommendation that patients maintain catastrophic or wraparound coverage

Specify that the physician-patient relationship begins upon agreement execution

Define how after-hours communication works

Common mistakes:

Promising "unlimited" services without defining scope

Failing to address what happens if the physician is unavailable (vacation, illness)

Not including a clear termination process

Using insurance terminology ("coverage," "benefits," "claims") in the agreement

HIPAA in a DPC Context

HIPAA applies to DPC practices just like any other medical practice. You're a covered entity. Full stop.

What's different in DPC:

You likely communicate with patients via text, email, and phone more frequently. All of these channels need to be HIPAA-compliant.

Patient portals through your EHR are the safest communication channel

Standard SMS texting is technically not HIPAA-compliant, but many DPC physicians use it with patient consent and BAAs in place for texting platforms

Email requires encryption or patient consent to receive unencrypted communications

What you need:

HIPAA privacy policies and procedures

Notice of Privacy Practices (given to every patient)

Business Associate Agreements (BAAs) with every vendor that handles PHI: EHR, billing platform, email service, texting service, cloud storage

A designated HIPAA privacy officer (in a solo practice, that's you)

Annual risk assessment

Explore DPC Pricing Tiers

See our transparent pricing and find the right tier for your practice size and goals.

Breach notification procedures

Practical advice: Don't overcomplicate this. Use a HIPAA compliance service (they cost $200–$500/year) to generate your policies, conduct your risk assessment, and maintain documentation. This is not an area to DIY.

Corporate Practice of Medicine

Some states have "corporate practice of medicine" (CPOM) laws that restrict who can own a medical practice. In these states, only licensed physicians can own the practice entity—not corporations, investors, or non-physician partners.

States with strong CPOM restrictions include California, Texas, New York, Illinois, and Ohio (among others).

What this means for DPC:

Your practice entity should be owned by a licensed physician

If you're partnering with a management company (like Freedom Healthworks), the structure needs to comply with CPOM rules—typically through a management services agreement (MSA) that keeps clinical decision-making with the physician

If you're considering bringing on NPs or PAs as partners, the ownership structure may need specific legal attention

Scope Considerations for NPs and PAs

If you plan to hire or partner with Nurse Practitioners or Physician Assistants, scope-of-practice rules vary significantly by state.

Full practice authority states (NPs can practice independently): About 26 states plus D.C.

Reduced or restricted practice states: Require physician oversight, collaborative agreements, or supervisory relationships.

For DPC specifically:

In full practice authority states, NPs can own and operate DPC practices independently

In restricted states, you'll need a collaborative or supervisory agreement with a physician

PA scope is generally more restrictive than NP scope and almost always requires physician oversight

Practical considerations:

Check your state's specific requirements for supervision ratios (e.g., physician must be available by phone vs. must be on-site)

Ensure your malpractice insurance covers the specific practice arrangement

Document the collaborative relationship clearly

Malpractice Insurance for DPC

DPC practices generally enjoy lower malpractice premiums than traditional primary care. Why? Lower patient volume, longer visits (fewer missed diagnoses), better documentation, and stronger patient relationships (patients who know their doctor are less likely to sue).

What to know:

Get a DPC-specific quote—don't assume your current policy covers a different practice model

Occurrence-based policies are preferable to claims-made (you're covered for incidents during the policy period regardless of when the claim is filed)

Typical DPC malpractice premiums: $4,000–$12,000/year depending on state, specialty, and coverage limits

If you're leaving an employed position, you may need tail coverage for your prior employer's claims-made policy

Your Compliance Checklist

Before you launch, make sure you've addressed:

[ ] State DPC enabling legislation reviewed

[ ] Membership agreement drafted by healthcare attorney

[ ] Business entity formed (LLC/PLLC)

[ ] Medical license updated for new practice address

[ ] DEA registration (new address)

[ ] NPI for new practice

[ ] HIPAA policies and procedures in place

[ ] BAAs with all vendors

[ ] Malpractice insurance secured

[ ] General liability insurance secured

[ ] Workers' compensation (if hiring staff)

[ ] State and local business licenses

[ ] OSHA compliance (bloodborne pathogen plan, sharps disposal)

[ ] CLIA waiver (if performing in-office lab tests)

Get the Legal Foundation Right

Legal and compliance work isn't glamorous, but getting it right protects your practice and your patients. We connect physicians with healthcare attorneys who specialize in DPC—because a general business lawyer won't know the nuances.

Learn more about DPC startup support or explore our partner network for vetted legal and compliance resources.