Legal & Compliance

The most important legal question in DPC is whether your state has passed a DPC enabling statute. These laws explicitly declare that DPC agreements are NOT insurance contracts, which protects you from being regulated as an insurance company by your state's Department of Insurance.

As of 2025, approximately 37 states have enacted DPC legislation. The specifics vary: - Some states define DPC broadly (any direct agreement for primary care services) - Some limit DPC to specific provider types (physicians, NPs, PAs) - Some cap the monthly fee (e.g., Missouri caps at $150/month) - Some require specific disclosures in the DPC agreement - Some explicitly allow or prohibit DPC for Medicaid/Medicare populations

States WITHOUT DPC legislation can still support DPC practices — the absence of a law doesn't make DPC illegal. It just means there's less regulatory clarity. In these states, it's especially important to structure your membership agreement carefully (with a healthcare attorney) to avoid any appearance of selling insurance.

Critical state-specific issues to research: 1. Does your state have a DPC enabling statute? 2. Does the law cover your provider type (MD, DO, NP, PA)? 3. Are there fee caps or disclosure requirements? 4. What does your state medical board say about DPC? 5. Does your state allow DPC practices to also bill insurance for some services (hybrid)? 6. Corporate practice of medicine (CPOM) laws — can non-physicians own or invest in your DPC practice?

Most DPC practices are formed as Professional Limited Liability Companies (PLLCs) or Professional Corporations (PCs), depending on state law. The "professional" designation is required in most states because you're providing licensed medical services.

Entity formation steps for a DPC practice: 1. Choose your entity type (PLLC, PC, PA, or S-Corp election on top) 2. File articles of organization/incorporation with your Secretary of State 3. Obtain your EIN (Employer Identification Number) from the IRS 4. Register for state tax accounts (sales tax exemption for medical services in most states) 5. Open a dedicated business bank account 6. Draft your operating agreement or bylaws

The S-Corp election is particularly valuable for DPC physicians. Once your net income exceeds roughly $60,000-80,000/year, an S-Corp election can save $10,000-25,000/year in self-employment tax by allowing you to pay yourself a "reasonable salary" and take the rest as distributions not subject to FICA.

Important: if you plan to bring on partners, NPs, PAs, or investors in the future, your initial entity structure matters enormously. Many physicians start as a single-member PLLC with S-Corp election and restructure later. Plan ahead with your attorney.

Corporate Practice of Medicine (CPOM): Most states prohibit non-physicians from owning or controlling medical practices. This affects DPC if you're considering outside investors, management companies, or non-physician partners. Several DPC networks and management service organizations (MSOs) have navigated this with "friendly PC" structures, but this is an area where you absolutely need legal counsel.

The DPC membership agreement is a contract between you and each patient (or their employer). It must clearly communicate:

1. What IS included: List of primary care services covered by the monthly fee (office visits, phone/text/email access, basic labs, simple procedures, etc.) 2. What is NOT included: Services not covered (hospitalizations, specialist referrals, imaging, surgery, etc.) 3. Explicit statement that the agreement is NOT insurance 4. Monthly/quarterly/annual fee amount and payment terms 5. Cancellation and refund policy (most practices offer 30-day notice) 6. HIPAA notice of privacy practices 7. Informed consent for treatment 8. Panel size disclosure (some state laws require this) 9. Recommendation that patients maintain catastrophic/wrap-around insurance 10. Scope of services and any limitations

The DPC Coalition (dpcoalition.org) provides template membership agreements that have been vetted by healthcare attorneys and updated for current state laws. This is an excellent starting point, but you should still have your own attorney review and customize it for your state.

Key legal protections in your agreement: - Arbitration clause (reduces malpractice litigation risk) - Clear scope limitations (prevents expectation mismatches) - Auto-renewal with written cancellation terms - HIPAA business associate provisions if you use third-party services

DPC practices ARE covered entities under HIPAA because they are healthcare providers who conduct electronic transactions (even if it's just electronic lab orders or e-prescribing). You must comply with the Privacy Rule, Security Rule, and Breach Notification Rule.

However, DPC practices have a compliance advantage: without insurance billing, you eliminate many of the data sharing touchpoints that create HIPAA risk in traditional practices. You don't share PHI with clearinghouses, billing companies, or insurance payers for claims purposes.

HIPAA compliance essentials for DPC: 1. Designate a Privacy Officer and Security Officer (can be the same person in a small practice) 2. Conduct an annual Security Risk Assessment (required, not optional) 3. Implement written HIPAA policies and procedures 4. Provide workforce HIPAA training at hire and annually 5. Execute Business Associate Agreements (BAAs) with all vendors who access PHI (EHR vendor, lab company, cloud storage, email provider, answering service) 6. Implement technical safeguards: encryption (data at rest and in transit), MFA on all systems, automatic logoff, audit logging 7. Have a Breach Notification Policy and incident response plan

Common HIPAA pitfalls in DPC: - Texting patients without a HIPAA-compliant messaging platform - Using personal email for patient communication - Not having a BAA with your EHR vendor - Cloud storage (Dropbox, Google Drive) without a BAA - Staff using personal phones to photograph patient documents

Medicare patients in DPC: If you want to see Medicare beneficiaries in your DPC practice, you have two main options:

Option 1 — Medicare Opt-Out: You formally opt out of Medicare (file an affidavit with your Medicare Administrative Contractor). This means: - You cannot bill Medicare for ANY services for 2 years - Medicare patients can join your DPC and pay the membership fee - You must have a private contract with each Medicare patient - The patient cannot submit claims to Medicare for your services - After 2 years, you can opt back in or renew the opt-out

Option 2 — Stay in Medicare, Don't Bill: Some DPC practices stay enrolled in Medicare but simply don't bill for the services covered by the DPC membership. This is legally gray and the OIG (Office of Inspector General) has raised concerns about potential anti-kickback and beneficiary inducement issues. Most DPC legal experts recommend formal opt-out if you plan to see Medicare patients.

The DPC Act (proposed federal legislation, reintroduced in multiple Congressional sessions) would create a specific pathway for Medicare beneficiaries to use Health Savings Account funds for DPC memberships and would allow DPC physicians to see Medicare patients without opting out. As of 2025, this legislation has bipartisan support but has not yet passed.

Medicaid: The situation varies by state. Some states explicitly allow DPC for Medicaid populations, others prohibit it, and many are silent on the issue. A few pilot programs have tested DPC for Medicaid patients with promising results (reduced ER visits, lower total cost). Check your state's current Medicaid DPC policy.

Tricare: Military beneficiaries can use DPC, but Tricare will not reimburse for DPC membership fees. The patient pays out of pocket for the DPC membership and uses Tricare for hospital, specialist, and pharmacy benefits.