Medical Practice Opening Checklist Template

Open one new practice or clinic in the United States or England: set up the business and the premises, get the licences, registrations and enrolments, put the privacy work and the staff in place, then decide go or no-go before the first patient.

Last reviewed: November 2026

Printed from checkflow.io/templates/healthcare-medical/medical-practice-opening-checklist

This free checklist for opening a medical practice is for practice owners, practice managers and clinicians setting up one new independent practice or clinic in the United States or England. One run covers one practice, counted back from the opening date. It starts with the business plan and the advisers, sets up the legal entity, the funding and the insurance, and finds and fits out the premises. Then come each clinician’s licence or registration and, by country, the US identifiers and payer enrolment (NPI, Medicare, Medicaid and health plans, with DEA and CLIA where they apply) or CQC registration in England with a registered manager, the DBS checks and the ICO fee. The systems, privacy work and policies follow, then recruitment, pre-employment checks and training, a practice day with test patients and the owner’s go or no-go. Opening day, the first payments and a 90-day review close the run. It covers the administration only and gives no clinical advice. Scotland, Wales and Northern Ireland have their own regulators and are not covered.

Opening a Practice, Not Credentialing One Clinician or Preparing for Inspection

Opening a medical practice, in this template, is the administration of opening one new independent practice or clinic, from the business plan to the first 90 days, in the United States or England. One run covers one practice and one opening date: the entity, funding and insurance, the premises, each clinician’s licence or registration, payer enrolment in the US or CQC registration in England, the systems, the privacy work and policies, the staff, and the owner’s go or no-go. It gives no clinical advice.

Some strands have their own checklists and are linked, not repeated: the Healthcare Staff Credentialing Checklist for checking each clinician in full, the HIPAA Security Risk Assessment Checklist for the risk analysis, the HIPAA Compliance Audit Checklist once the practice is running, and the CQC Inspection Readiness Checklist after registration. Other kinds of opening have their own: the New Restaurant Opening Checklist and the New Store Opening Checklist.

This checklist

One practice, from plan to the first 90 days

Asks: is the practice set up, licensed, registered or enrolled, staffed and ready, and has the owner said go?

Covers: the entity, funding, insurance, premises, licences and identifiers, payer enrolment or CQC registration, systems, privacy, policies, staff, the go or no-go, opening day and the 90-day review.

One clinician

Healthcare Staff Credentialing

Asks: is this clinician’s licence, training and history checked at the source before they practise?

Covers: primary source verification, the NPDB query and re-credentialing for one clinician. Healthcare Staff Credentialing Checklist.

After registration

CQC Inspection Readiness

Asks: is a registered service in England ready for its CQC assessment?

Covers: the quality statements, evidence, notifications and the response to a draft report. CQC Inspection Readiness Checklist.

What the Medical Practice Opening Checklist Covers

Nine phases take one practice from the business plan to the 90-day review. The first task records the opening date, which sets every due date, the country and the people, from the practice manager to the practice owner who decides go or no-go. United States shows the state licence, NPI, Medicare, Medicaid and health plan tasks, with a DEA task where controlled substances are prescribed and a CLIA task where testing is done. England shows the professional registration, CQC, registered manager, DBS and ICO fee tasks. Both see their own privacy notes. The owner’s go or no-go is the gate: Go with conditions adds a task to meet them, and No-go hides Phase 9 and adds a task to set a new date.

  1. Phase 1

    Phase 1: Plan the Practice & the Opening Date

    4 tasks

    Owned by the practice manager. Enter the opening date on the first task: every due date counts back from it in working days, and the opening day and the first 90 days count forward. Choose the country, so the checklist shows the United States or England tasks, write the business plan and appoint the advisers.

    • Set up the opening: the practice, the country, the opening date and the people — the practice’s name, whether it opens in the United States or England, the opening date, the services and the patients it will see, and the practice owner, the practice manager, the lead clinician, the privacy and security lead and the systems and billing lead; for a US practice, whether anyone will prescribe controlled substances and whether any testing is done on site
    • Write the business plan and the opening budget — the services, the patients and where they will come from, the staff you need, the cost of opening and the months of running costs to cover before payments from patients and payers arrive
    • Appoint the advisers — an accountant, a lawyer who advises healthcare practices, an insurance broker and, if you use them, a practice consultant or an enrolment service, with what each one does
    • Agree the opening timetable and who does what — walk the owner and the practice manager through the opening date, the long-lead items (licences, enrolment or CQC registration, the build-out and recruitment) and the people, and set a weekly check-in until the opening
  2. Phase 2

    Phase 2: The Business, Funding & Insurance

    5 tasks

    Set up the legal entity first: the bank account, the enrolments and the registrations all ask for its name and numbers. Then arrange the money for the months before payments arrive, and the insurance for the clinicians and the practice.

    • Set up the legal entity and its tax registrations — choose the structure with your accountant and lawyer, register it, and record its legal name, number and registered address exactly as later applications will need them
    • Open the business bank account and set up the accounts — a business account in the entity’s name, the accounting software, how you will take card payments, and who can approve payments
    • Arrange the funding and a cash reserve — the loan, investment or savings that pay for the build-out, the equipment and the months before patient and payer payments arrive, and the date each sum is available
    • Arrange malpractice cover or an indemnity arrangement for each clinician — the cover each clinician needs for the work they will do at this practice, starting no later than the day they first see a patient here, with the certificates
    • Arrange the practice’s own insurance — the premises and contents, public liability, business interruption and cyber cover your broker recommends, and the cover the law requires once you employ staff
  3. Phase 3

    Phase 3: Premises, Build-Out & Equipment

    6 tasks

    Find premises you may use as a medical practice, plan the layout, get the building work signed off and order the furniture and equipment. The lead clinician agrees the clinical equipment list; this template does not list it.

    • Choose the premises — the location, the size, access for disabled patients, parking and transport, and room for the consulting rooms, reception, waiting area and secure records storage the business plan needs
    • Check the lease and the permitted use before you sign — the term, the rent, any break clause and the fit-out terms with your lawyer, and confirm with the local planning or zoning office that the premises may be used as a medical practice
    • Plan the layout and the build-out — the rooms and how patients move through them, accessible entrances and toilets, privacy at reception and in the consulting rooms, where records and devices are kept secure, and the contractor’s programme
    • Order the furniture, office equipment and the clinical equipment on the lead clinician’s list — order against the list the lead clinician agrees, with delivery before the build-out finishes, and record each item that needs servicing or calibration
    • Get the building work signed off — the permits and inspections your local authority requires, and its sign-off, such as a certificate of occupancy where one is issued or a building control completion certificate, before anyone works in the premises
    • Connect the phones, internet and utilities, and arrange the waste and cleaning contracts — the phone number patients will call, an internet connection good enough for the clinical system, the electricity and water accounts, cleaning, and a contract for clinical and confidential waste with a carrier licensed for it
  4. Phase 4

    Phase 4: Clinician Licences & Identifiers

    6 tasks

    Every clinician needs the right licence or registration before they see a patient here, and a US practice needs its identifiers before it can enrol with payers. The tasks shown depend on the country, and for a US practice on the answers about controlled substances and testing.

    • US: confirm each clinician’s state licence covers this state — check every clinician’s licence with the state medical board or other licensing board for this state, record its number and expiry date, and apply now for any licence still needed, because the later steps depend on it
    • US: get an NPI for each clinician and for the practice — a Type 1 NPI for each clinician and a Type 2 NPI for the practice if it is an organisation such as a group, corporation or LLC, through NPPES, with each number recorded
    • US: register with the DEA for controlled substances — apply online on DEA Form 224 for each clinician who will prescribe, administer or dispense controlled substances, once their state licence and any state controlled substance registration your state requires are in place, and record each registration number and expiry date
    • US: apply for a CLIA certificate before any testing — choose the certificate type for the most complex test you will do, send Form CMS-116 to your state agency (New York and Washington State have their own process), pay the fee, and start testing only once the certificate arrives
    • England: check each clinician’s professional registration — check each clinician on their regulator’s register (for a doctor, GMC registration with a licence to practise), and record the registration number and any conditions
    • England: confirm the regulated activities and the location you will register — read the CQC’s scope of registration guidance, list each regulated activity the practice will carry on (for example treatment of disease, disorder or injury) and the location, and record any exemption you rely on with the reason
  5. Phase 5

    Phase 5: Payer Enrolment or CQC Registration

    9 tasks

    A US practice enrols with Medicare, Medicaid and the health plans it will accept. A practice in England registers with the CQC as a provider, with a registered manager where one is needed, and pays the ICO’s data protection fee. Both take time and depend on the earlier phases.

    • US: enrol with Medicare through PECOS — once the lease is signed, because the application names the practice location, with each clinician’s and the practice’s NPI, through PECOS (or the paper forms if you cannot apply online), pay any application fee, answer your Medicare Administrative Contractor’s requests, and record the application date and reference
    • US: enrol with your state’s Medicaid programme, if you will accept Medicaid — apply to the state Medicaid agency, and to each Medicaid managed care plan you will join, and record the dates; the state screens every enrolled provider
    • US: apply to the commercial health plans you will accept — list the plans, apply to each for credentialing and a contract, track each application, and record the date each plan says its contract starts
    • US: record each enrolment’s effective date before opening — for Medicare, Medicaid and each health plan, the status, the effective date and what the practice will do for that plan’s patients before it, such as booking them after the date or seeing them as self-pay with their agreement
    • England: choose the registered manager and prepare their application — if the provider is an organisation or partnership, or an individual who will not run the regulated activity day to day, choose the registered manager now, so their DBS check can start, check their management experience and qualifications, and prepare the registered manager application form to send with the provider application
    • England: get the enhanced DBS checks the CQC application needs — an enhanced DBS check with the right barred list check for the main point of contact, the individual provider or each partner, and each registered manager, countersigned by the CQC unless the person is a registered healthcare professional; the CQC rejects a check over 12 months old
    • England: pay the ICO data protection fee — use the ICO’s self-assessment to check whether the practice must pay and which tier, pay it before the practice starts hiring or seeing patients (this template’s timing), and record the registration number and renewal date
    • England: send the CQC provider application when everything is in place — with the statement of purpose and supporting documents, the DBS checks and any manager forms, once the premises and the staff are ready, then answer the CQC’s requests and agree dates for any fit person interview or site visit
    • England: record the CQC’s decision and the conditions of registration — save the CQC’s decision and certificate, check the regulated activities, location and any conditions match what the practice will do, and carry on no regulated activity until the registration is confirmed
  6. Phase 6

    Phase 6: Systems, Privacy & Policies

    9 tasks

    Choose the clinical records system and set up scheduling and billing, then put the privacy and security work in place before any patient data goes in: the people responsible, the contracts with suppliers, a risk assessment, the privacy notice and the practice policies.

    • Choose the EHR or clinical records system and sign its contract — compare a shortlist on the services you offer, scheduling, billing, prescribing and data export, check where the data is held and who can reach it, and sign the contract with its data protection terms
    • Name who is responsible for privacy and security — the privacy and security lead takes the roles the law in your country sets, records them, and tells staff who to go to
    • Set up scheduling, reminders and patient communications — the appointment types and lengths, the clinicians’ diaries, reminders, the phone and online booking routes, and the templates for letters and messages
    • Set up billing, fees and payments — the price list or fee schedule, how charges are recorded, how claims or invoices are sent and paid, and who checks payments in
    • Sign the data protection contracts with every supplier that handles patient data — list every supplier that will hold or reach patient data (the clinical system, phone and messaging services, IT support, billing, shredding and storage) and sign the contract the law requires with each
    • Assess the risks to patient data before any goes in — where patient data will be held, who can reach it, what could go wrong, and what the practice will do about each risk, with an owner and a date for each action
    • Write the privacy notice patients receive — the notice of privacy practices (US) or privacy notice (England), on the website, at reception and in the booking messages, ready before the first patient
    • Write the practice policies and procedures — complaints, records and retention, confidentiality, patients’ requests for their records, incidents and data breaches, and business continuity, each with an owner and a review date; the clinical policies are the lead clinician’s and are not in this template
    • Set up system accounts, access by role and backups — an account for each person with only the access their role needs, multi-factor sign-in where the system offers it, and a tested backup or the supplier’s written description of how data is backed up
  7. Phase 7

    Phase 7: Staffing & Training

    5 tasks

    Recruit the team, check each person before they start, set up payroll and the employer registrations, and train everyone on privacy, security and the practice’s systems before the first patient.

    • Plan the roles and recruit the staff — the roles and hours for the first months (reception, nursing, billing and management), the job descriptions, the adverts and interviews, and the offers, with start dates before the opening date
    • Run the pre-employment checks before each person starts — identity and right to work, references, and for clinicians their licence or registration and the checks of their training and history
    • Set up payroll and register as an employer — the payroll provider, the pay dates, and the employer registrations the law requires before the first payday (in England, no more than 2 months before it)
    • Onboard each member of staff — contracts signed, the staff handbook, badges, system accounts, the rota for the first weeks and a walk round the premises
    • Train every member of staff on privacy, security and the practice’s systems — the privacy and security policies, how to spot and report a data breach, the clinical system, scheduling and billing, and the practice policies, with each person’s training recorded
  8. Phase 8

    Phase 8: Opening Readiness & the Go or No-Go

    5 tasks

    Open the diary, run a practice day with test patients, and check that every licence, registration and enrolment is in hand. The practice owner then decides go or no-go: nothing in Phase 9 can be completed until they do.

    • Open bookings and tell patients when you open — open the diary from the opening date, publish the website, opening hours and how to book, and tell local referrers
    • Run a practice day with test patients — with test records only, take a booking, check a patient in, record a visit, bill or invoice, take a payment and handle a complaint, and fix what goes wrong
    • Check every licence, registration and enrolment is in hand — the clinicians’ licences or registrations, the identifiers, the registrations and enrolments for your country, the insurance certificates, the policies and the training records, each with its reference
    • Decide go or no-go for the opening date — the practice owner alone reviews the readiness check, the practice day and the open items, and records Go, Go with conditions or No-go with the reasons; nothing in Phase 9 can be completed until this is done
    • No-go: fix what is missing and set a new opening date — fix each item the owner named, tell anyone booked that the opening has moved and rebook them, change the opening date on the first task (every due date moves, and the first task must be completed again), then un-complete the go or no-go, change the decision and complete it again
  9. Phase 9

    Phase 9: Opening Day & the First 90 Days

    6 tasks

    Applies only when the go or no-go is Go or Go with conditions. Open the practice, review the first week, put every renewal date in the calendar, check the first payments arrive and hold the 90-day review.

    • Meet the conditions set at the go or no-go — each condition the owner set, who meets it and by when, with the evidence; tell the owner when the last one is met
    • Open the practice and run the opening-day checks — the premises open and safe, staff in and signed in to the systems, the diary working, and a short meeting at the end of the day to log what went wrong
    • Review the first week — bookings and missed appointments, waiting at reception, system problems, complaints and what patients said, with each fix and its owner
    • Put every renewal and expiry date in the practice calendar — licences or registrations, any DEA and CLIA certificates, the insurance, the lease, the ICO fee, supplier contracts and the policy review dates, each with an owner
    • Check the first claims or invoices are paid — match the first payments to what was billed, list anything rejected or unpaid with the reason, and fix the set-up behind each
    • Hold the 90-day review — compare the first 90 days with the business plan (patients seen, income, costs, cash, staffing, complaints and incidents) and agree with the owner what changes next

What Each Country Needs Before You Open, and Where It Comes From

The first task asks where the practice opens, and the answer shows that country’s tasks and notes. These are the registrations each country’s tasks cover, who needs each one and the source the notes quote. It is a summary for planning, not legal advice: your lawyer, your state’s boards or the CQC have the final word.

United States

United States Who needs it Source, as read on 4 November 2026
State licenceEach clinician, from the licensing board of the state where they practise. Some states also license the practice itself or need a certificate of needYour state’s boards and health department: this template types no state’s rules
NPIA Type 1 NPI for each clinician and a Type 2 NPI for an organisation such as a group, corporation or LLC, through NPPES. Required for Medicare enrolmentCMS, NPI fact sheet
DEA registrationEach clinician who will prescribe, administer or dispense controlled substances, once the state allows them to. Online on Form 224, one per principal place of practice where controlled substances are dispensed21 U.S.C. 802(10) and 823(g)(1); 21 CFR 1301.12 and 1301.13
CLIA certificateThe practice, if it tests any human specimens on site, waived tests included. Form CMS-116 to the state agency (New York and Washington State have their own process); testing starts once the certificate arrives; effective for two yearsCMS, "Apply for a CLIA Certificate" (updated 2 November 2026)
Medicare enrolmentTo bill Medicare: an NPI first, then PECOS, any application fee and the Medicare Administrative Contractor’s requestsCMS, "Become a Medicare Provider or Supplier" (updated 2 June 2026)
Medicaid and health plansThe state Medicaid agency enrols and screens providers; each commercial plan has its own credentialing and contract42 CFR 455.410; each plan
HIPAAA covered entity: privacy and security officials, business associate agreements, a risk analysis, the notice of privacy practices by the first service, and staff training45 CFR 160.103, 164.308, 164.502(e), 164.504(e), 164.520 and 164.530

England

England Who needs it Source, as read on 4 November 2026
CQC registration as a providerAny individual, partnership or organisation that carries on a regulated activity, such as treatment of disease, disorder or injury. Send the application only when everything is in place; the assessment can take a few monthsHealth and Social Care Act 2008, section 10; CQC, "Register as a provider" (updated 25 August 2026)
Registered managerAn organisation or partnership, or an individual who does not run the regulated activity day to day. The manager forms go in with the provider applicationCQC, "Register as a new manager" (updated 6 January 2026)
Enhanced DBS checksThe main point of contact, an individual provider or each partner, and each registered manager, with the right barred list check, under 12 months old when the application is sentCQC, "DBS checks for CQC registration"
Professional registration and indemnityEach clinician on their regulator’s register (a doctor with a licence to practise), with an indemnity arrangement that gives appropriate coverMedical Act 1983, section 44C; the Indemnity Arrangements Order 2014
ICO data protection feeOrganisations, including sole traders, that use personal information, unless exempt. £52, £78 or £3,763 from 17 February 2025Data Protection (Charges and Information) Regulations 2018; the ICO
UK GDPRA privacy notice (Article 13), processor contracts (Article 28), an impact assessment where the risk is high (Article 35), and a data protection officer where the core activities are large-scale processing of health data, or where the practice provides NHS primary care services and so is a public authority for that work (Article 37)UK GDPR on legislation.gov.uk; Data Protection Act 2018, section 7; Freedom of Information Act 2000, Schedule 1
Employers’ liability insuranceAs soon as you employ staff, at least £5 million from an authorised insurer, with the certificate displayedGOV.UK, "Employers’ liability insurance"

Scotland, Wales and Northern Ireland have their own regulators (Healthcare Improvement Scotland, Healthcare Inspectorate Wales and the Regulation and Quality Improvement Authority) and their own rules, which this template does not cover.

Why Run Your Practice Opening in CheckFlow?

1

No opening until the owner says go

The go or no-go is assigned to the practice owner alone, and the checklist halts there: opening day and the first 90 days cannot be completed until a decision is recorded. Go with conditions adds the task to meet them. No-go hides Phase 9 and adds the task to fix what is missing and set a new date. See how approvals that halt a checklist work.

2

One answer shows the right country’s tasks

Choose the United States or England on the first task and the checklist shows only that country’s registrations and notes: the state licence, NPI, Medicare and health plans in one, the CQC, registered manager, DBS checks and ICO fee in the other. For a US practice, two more answers add the DEA and CLIA tasks only where they apply.

3

One date moves the whole opening

Due dates count back from the opening date, so when the date moves, one change on the first task moves every step, and the 90-day review moves with it. Overdue alerts go to the people assigned, and the Reports Grid lists every opening with its answers, while Analytics shows where tasks are waiting.

CheckFlow does not give clinical, legal or billing advice, and it does not apply for any licence, registration or enrolment for you. It makes sure the opening gets the same steps in the same order, with an owner and a due date for each, a go or no-go before the first patient, and a record of who did what and when. See how a checklist runs.

Check each clinician with the Healthcare Staff Credentialing Checklist, run the risk analysis with the HIPAA Security Risk Assessment Checklist, and once a practice in England is registered, stay ready with the CQC Inspection Readiness Checklist. New patients after opening follow the Patient Intake Checklist.

AI generator

Didn’t find what you need? Describe it.

Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.

Frequently Asked Questions

What do you need to open a medical practice?

In this template: a business plan and funding, a legal entity, malpractice cover or indemnity and the practice’s insurance, premises you may use as a practice, each clinician’s licence or registration, and the registrations for your country. In the US that means NPIs, Medicare and health plan enrolment, and DEA and CLIA where they apply. In England it means CQC registration as a provider and the ICO fee. Then the systems, privacy work, policies, trained staff and a go or no-go.

How long does it take to open a medical practice?

It depends on the premises, the hiring and how long licences, enrolment or registration take. This template plans about nine months: it starts 180 working days before the opening date and holds the go or no-go three working days before it. Those timings are this template’s choices. The CQC says its registration assessment can take a few months, so in England the opening date has to allow for it.

When should a new practice apply to Medicare and health plans?

Early, because each payer pays only once its enrolment is in place. This template applies to Medicare through PECOS, the state Medicaid programme and the commercial plans about 140 working days before opening, once the lease is signed and each clinician has a state licence and an NPI, which CMS requires for Medicare enrolment. It records each effective date before opening and what the practice will do for patients of a plan that is not yet effective.

Does a new practice need a DEA registration?

Only if a clinician will prescribe, administer or dispense controlled substances. Each one applies online on DEA Form 224. The DEA registers a practitioner who is authorised to dispense controlled substances under the laws of the state where they practise, so the state licence, and any state controlled substance registration, come first. A separate registration is needed for each principal place of practice where controlled substances are dispensed.

Does a new medical practice need a CLIA certificate?

Yes, if it tests any human specimens on site, even simple waived tests: CMS regulates laboratory testing on humans in the US through CLIA. Choose the certificate for the most complex test you will do, send Form CMS-116 to your state agency (New York and Washington State have their own process) and pay the fee. CMS says you can begin testing once you receive the certificate, and every certificate type is effective for two years.

Do you need to register with the CQC to open a private clinic in England?

Yes, if the clinic will carry on a regulated activity, such as treatment of disease, disorder or injury: carrying one on without being registered is an offence under section 10 of the Health and Social Care Act 2008. The CQC says to send the application only when everything is in place, including the premises and the staff, and that its assessment can take a few months. Check its scope guidance for any exemption.

Does a new practice in England need a registered manager?

The CQC requires one if the provider is an organisation or partnership, or an individual who will not run the regulated activity day to day, and the manager forms go in with the provider application. It asks for proven management experience and an enhanced DBS check, and says a registered manager shares legal responsibility with the provider for meeting the regulations. An individual provider who runs the service day to day does not need one.

Does a private practice have to pay the ICO data protection fee?

Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information must pay a fee unless they are exempt. Use the ICO’s self-assessment to check whether the practice must pay and which tier applies. From 17 February 2025 the tiers are £52, £78 and £3,763, set by turnover and staff numbers. This template pays it before the practice starts hiring.

What HIPAA documents does a new practice need before seeing patients?

If the practice is a covered entity, for example because it sends insurance claims electronically, this template puts these in place before opening: named privacy and security officials, a business associate agreement with each supplier that handles protected health information, a security risk analysis, the notice of privacy practices, which must be given no later than the first service, written policies, and a training record for every member of staff.

Is CheckFlow free for this template?

14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.

Open Your Practice One Step at a Time

Free trial — no credit card required.

14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request