Legal & Compliance

The single most important legal question when you are starting a DPC practice is whether your state has passed a DPC enabling statute, because these laws explicitly declare that DPC membership agreements are not insurance contracts, and that legal distinction protects you from being regulated as an insurance company by your state's Department of Insurance.

As of 2025 approximately 37 states have enacted some form of DPC legislation, and the specifics of these laws vary in ways that matter. Some states define DPC broadly to cover any direct agreement for primary care services while others limit DPC to specific provider types like physicians, nurse practitioners, or physician assistants. A few states put caps on the monthly membership fee, with Missouri for example capping it at $150 per month. Some states require specific disclosures in the DPC agreement, and some explicitly address whether DPC arrangements are allowed or prohibited for Medicaid or Medicare populations.

If your state has not yet passed DPC legislation that does not mean DPC is illegal where you are, because the absence of a specific law does not prohibit the practice model. What it does mean is that there is less regulatory clarity about your situation, and in those states it becomes especially important to work with a healthcare attorney to structure your membership agreement very carefully so that it cannot be interpreted as selling insurance.

There are several state-specific issues that you should research thoroughly before getting started. First, find out whether your state has a DPC enabling statute and read it carefully. Second, confirm that the law covers your specific provider type whether that is MD, DO, NP, or PA. Third, check whether there are any fee caps or specific disclosure requirements you need to follow. Fourth, look into what your state medical board has said publicly about DPC. Fifth, determine whether your state allows DPC practices to also bill insurance for certain services if you are considering a hybrid model. And sixth, research your state's Corporate Practice of Medicine laws because these affect whether non-physicians can own or invest in your DPC practice.

Most DPC practices are formed as Professional Limited Liability Companies known as PLLCs or Professional Corporations known as PCs, and which one you choose depends on what your state law requires. The "professional" designation is necessary in most states because you are providing licensed medical services.

The steps to form your entity for a DPC practice generally follow this sequence. You start by choosing your entity type, whether that is a PLLC, PC, PA, or one of those with an S-Corp election on top. Then you file your articles of organization or incorporation with your Secretary of State. After that you obtain your EIN, which stands for Employer Identification Number, from the IRS. Next you register for any required state tax accounts, keeping in mind that medical services are exempt from sales tax in most states. Then you open a dedicated business bank account that is separate from your personal accounts. And finally you draft your operating agreement or bylaws.

The S-Corp election is something you should talk to your CPA about because it can be particularly valuable for DPC physicians. Once your net income exceeds roughly $60,000 to $80,000 per year, making the S-Corp election can save you somewhere in the range of $10,000 to $25,000 per year in self-employment tax by allowing you to pay yourself a "reasonable salary" and take the remaining profits as distributions that are not subject to FICA taxes.

Something to keep in mind as you set up your entity is that if you have any plans to bring on partners, nurse practitioners, physician assistants, or outside investors in the future, your initial entity structure matters enormously and can either make that expansion straightforward or create significant complications down the road. Many physicians start as a single-member PLLC with an S-Corp election and then restructure later when they grow, but it is much better to plan ahead with your attorney so you are not caught off guard.

Corporate Practice of Medicine laws, often abbreviated as CPOM, are also something you need to be aware of because most states prohibit non-physicians from owning or controlling medical practices. This becomes relevant for DPC if you are considering outside investors, management companies, or non-physician partners, and while several DPC networks and management service organizations have found ways to navigate these rules through what are called "friendly PC" structures, this is definitely an area where you need competent legal counsel.

The DPC membership agreement is the contract between you and each individual patient or their employer if it is an employer-sponsored arrangement, and it needs to clearly communicate several important things.

First it should lay out exactly what is included in the membership, which means listing out the primary care services covered by the monthly fee such as office visits, phone and text and email access, basic lab work, simple procedures, and anything else you plan to offer. Second it needs to clearly state what is not included, such as hospitalizations, specialist referrals, advanced imaging, surgery, and other services beyond the scope of primary care. Third it must contain an explicit statement that the membership agreement is not insurance, which is a critical legal distinction. Fourth it should specify the exact monthly, quarterly, or annual fee amount along with your payment terms. Fifth you need a clear cancellation and refund policy, and most practices use a 30-day notice requirement. Sixth the agreement should include your HIPAA notice of privacy practices. Seventh it should contain informed consent for treatment. Eighth you should include panel size disclosure if your state law requires it. Ninth there should be a recommendation that patients maintain catastrophic or wraparound insurance coverage for things DPC does not cover. And tenth you need to clearly define the scope of your services and any specific limitations.

The DPC Coalition at dpcoalition.org provides template membership agreements that have been vetted by healthcare attorneys and are regularly updated to reflect current state laws, and these templates are an excellent starting point, but you should still have your own attorney review and customize the agreement for your specific state and practice.

Your agreement should also include certain key legal protections such as an arbitration clause which can help reduce malpractice litigation risk, clear scope limitations that prevent mismatched expectations, auto-renewal language with written cancellation terms, and HIPAA business associate provisions if you use any third-party services that handle patient data.

DPC practices are considered covered entities under HIPAA because they are healthcare providers who conduct electronic transactions, and even if the only electronic transactions you do are electronic lab orders or e-prescribing, that is enough to bring you under the HIPAA umbrella. This means you need to comply with the Privacy Rule, the Security Rule, and the Breach Notification Rule.

The compliance advantage that DPC practices enjoy is that without insurance billing you eliminate many of the data-sharing touchpoints that create HIPAA risk in traditional practices, because you are not sharing protected health information with clearinghouses, billing companies, or insurance payers for claims processing purposes.

There are several HIPAA compliance essentials that every DPC practice needs to address. You need to designate a Privacy Officer and a Security Officer, and in a small practice these can be the same person. You need to conduct an annual Security Risk Assessment, which is a required step and not an optional one. You need to have written HIPAA policies and procedures in place. You need to provide HIPAA training to everyone in your workforce when they are hired and then again on an annual basis. You need to execute Business Associate Agreements, commonly called BAAs, with every vendor that has access to protected health information, which includes your EHR vendor, your lab company, any cloud storage providers, your email provider, and your answering service. You need to implement technical safeguards like encryption for data at rest and in transit, multi-factor authentication on all systems, automatic logoff features, and audit logging. And you need to have a Breach Notification Policy and an incident response plan ready in case something goes wrong.

There are also several common HIPAA pitfalls that DPC practices tend to fall into, and being aware of them can help you avoid them. These include texting patients without using a HIPAA-compliant messaging platform, using personal email for patient communication, not having a signed BAA with your EHR vendor, storing patient information in cloud services like Dropbox or Google Drive without a BAA in place, and allowing staff to use their personal phones to photograph patient documents.

If you want to see Medicare beneficiaries as patients in your DPC practice, you essentially have two main options to consider.

The first option is to formally opt out of Medicare by filing an affidavit with your Medicare Administrative Contractor. What this means in practice is that you cannot bill Medicare for any services at all for a period of 2 years, but Medicare patients are free to join your DPC practice and pay the membership fee, and you must have a private contract in place with each Medicare patient that states they understand Medicare will not pay for your services. After the 2-year period ends you can either opt back in or allow the opt-out to automatically renew for another 2 years.

The second option is to stay enrolled in Medicare but simply not bill for the services that are covered by your DPC membership, and while some practices do operate this way, it occupies a legally gray area that makes many people uncomfortable. The OIG, which stands for the Office of Inspector General, has raised concerns about potential anti-kickback and beneficiary inducement issues with this approach, and the majority of DPC legal experts recommend going with the formal opt-out if you plan to see Medicare patients in any meaningful numbers.

There is also a piece of proposed federal legislation called the DPC Act that has been reintroduced in multiple Congressional sessions and would create a specific pathway for Medicare beneficiaries to use their Health Savings Account funds for DPC memberships while also allowing DPC physicians to see Medicare patients without needing to opt out. As of 2025 this legislation has bipartisan support but has not yet been passed into law.

The Medicaid situation varies significantly from state to state, with some states explicitly allowing DPC for Medicaid populations, others prohibiting it, and many remaining silent on the issue altogether. There have been a few pilot programs that tested DPC for Medicaid patients and the results were promising in terms of reduced emergency room visits and lower total costs, so it is worth checking your state's current Medicaid DPC policy to see where things stand.

For military beneficiaries on Tricare, they are able to use DPC but Tricare will not reimburse them for the DPC membership fees, which means the patient pays out of pocket for the DPC membership and then continues to use Tricare for hospital care, specialist visits, and pharmacy benefits.