DPC Credentialing and Licenses Checklist for 2027 (NPI, DEA, CLIA and More)

What Licenses and Credentials Does a New DPC Practice Need?

A new direct primary care practice in 2027 needs an active state medical license, an individual NPI, a DEA registration for the new practice address (plus a state controlled substance license in the 25 jurisdictions that require one) if you will prescribe controlled substances, and a CLIA certificate before running any in-office test. Add a dispensing registration if your state requires one and you plan to dispense, a local business license for your entity, and a malpractice policy that is in force before your first patient. Most DPC practices don't bill insurance, so payer credentialing usually drops off the list entirely.

The order matters more than most people expect, because several of these credentials depend on each other. DEA, for example, will not register you without valid state licenses, and some state forms ask for your NPI. This checklist walks through each item in the order that keeps one from blocking the next, with the fee straight from the agency that issues it, so you can plan the paperwork alongside the rest of your DPC startup plan.

This article is general information, not legal advice. State rules change and differ widely, so confirm each step with the agency that issues the credential.

The DPC Credentialing Checklist at a Glance

The rest of this guide takes each row in turn. If you are still deciding on the legal structure of the practice, read our comparison of a PLLC versus an LLC for DPC first, because the entity you form changes steps 2 and 3.

Step 1. Make Sure Your State Medical License Covers the New Practice

Everything else sits on top of your state medical license, so start by confirming it is active, unrestricted and issued by the state where the clinic will physically sit. If you trained or worked in another state, apply in the new state before anything else, since DEA and most state controlled substance agencies will not act until the medical license exists.

If you plan to see members by telehealth in neighboring states, each state where a patient is located generally expects you to hold its license. The Interstate Medical Licensure Compact offers an expedited pathway for qualified physicians, and its site lists 39 states, the District of Columbia and Guam as members that process applications and issue licenses as a state of principal license. Our guide to telehealth prescribing rules for 2027 covers the prescribing side of cross-state care.

Nurse practitioners opening their own practice have extra questions about supervision and collaboration agreements, which differ by state. Our guide on whether a nurse practitioner can open a DPC walks through those.

Step 2. Get or Update Your NPI in NPPES

The National Provider Identifier is a 10-digit number that, as the CMS NPI Standard page explains, carries no information about you beyond identifying you. Labs, pharmacies, imaging centers and your EHR will all ask for it, even if you never send an insurance claim.

You apply online through NPPES, which CMS calls the fastest route, or on the paper Form CMS-10114. If you already have an individual NPI from residency or employment, the job is updating it rather than starting over. Your practice location, mailing address and contact details probably all changed when you left your old job.

If HIPAA covers your practice, that update is required. Under 45 CFR 162.410, a covered provider has to report changes to its NPPES data within 30 days. It also helps in practice, because a pharmacy or lab that looks you up in the NPI Registry will see your new clinic address rather than your former employer's.

Do you need a Type 1 or Type 2 NPI?

Form CMS-10114 splits providers into two entity types. Type 1 is for individuals, and it includes sole proprietors and incorporated individuals. Type 2 is for organizations such as a PLLC or a professional corporation. The form also notes that a sole proprietorship is an individual and can get only one NPI, using the owner's Social Security number rather than an EIN.

If you form an entity, you can keep your Type 1 NPI and also get a Type 2 NPI for the practice. That gives the clinic its own identifier for lab accounts, wholesale pharmacy accounts and any employer contracts.

Step 3. Form the Business and Get Your EIN and Local Business License

Your entity filing with the secretary of state comes next, followed by a federal Employer Identification Number. The IRS EIN page says you can get one online in minutes for free, and it warns that you never have to pay a fee for an EIN, so skip any site that charges for one.

Local business licenses, zoning approvals and certificates of occupancy come from your city or county, and the rules vary too much to summarize nationally. Ask the city clerk or county business office what a medical office needs at your exact address, ideally before you sign a lease. Our guide to DPC office space in 2027 covers what to check on a space before you commit.

Step 4. Get a State Controlled Substance License If Your State Requires One

DEA's practitioner state license requirements page splits the country into two groups. In one group, the state medical license alone gives you the state authority DEA needs. In the other, you need a second, separate controlled substance license from the state before DEA will register you.

DEA lists these 25 jurisdictions as requiring the second license: Alabama, Connecticut, Delaware, the District of Columbia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Louisiana, Maryland, Massachusetts, Michigan, Missouri, Nevada, New Jersey, New Mexico, Oklahoma, Puerto Rico, Rhode Island, South Carolina, South Dakota, Utah and Wyoming.

If your clinic is in one of those places, apply for the state license first and wait for the number. The DEA application instructions say it is mandatory to list your state medical and controlled substance licenses, and that an application without valid, active state licenses will be withdrawn without a refund. State fees and renewal cycles differ, so check them on your state agency's own site.

Step 5. Register With the DEA at Your New Practice Address

If you will prescribe, store or dispense controlled substances, you need a DEA registration for the place you practice. The DEA registration FAQ cites 21 U.S.C. 822(e)(1), which requires a separate registration at each principal place of business or professional practice where you dispense controlled substances. A registration that still lists your old employer's address needs to be updated to the new clinic. If the clinic is in another state, get that state's license first, because DEA says not to request the address change until you have an approved state license for the new address.

Practitioners apply on Form 224 and renew on Form 224a, and DEA now takes applications online only. The fee is set in the table at 21 CFR 1301.13.

The practitioner fee is $888, and the registration lasts three years. DEA's instructions say application fees are not refundable.

A few rules from the DEA registration page are worth putting on your calendar now:

• DEA sends renewal reminders by email only, at 60, 45, 30, 15 and 5 days before expiration, so the email on your registration has to be one you actually read.
• If you submit a renewal before the registration expires, you may keep operating until DEA acts on it.
• An expired registration can be reinstated for one calendar month after the expiration date. After that, you need a brand new application.
• Federal law prohibits handling controlled substances for any period under an expired registration, even during that one-month window.

If you prescribe controlled substances, plan your e-prescribing setup at the same time, since DEA's identity proofing and two-factor rules apply. Our guide to EPCS requirements for 2027 walks through it.

Step 6. Get a CLIA Certificate Before Your First In-Office Test

CLIA is the federal lab quality law that CMS runs, and it applies the moment you test a human specimen in the office, whether that is a rapid strep, a flu swab, a urine dipstick or a fingerstick glucose. A practice that runs only FDA-waived tests generally needs a Certificate of Waiver. Practices where clinicians read microscopy need a Provider-Performed Microscopy (PPM) certificate.

According to the CMS CLIA application page, the process has three steps:

1. Fill in Form CMS-116 for the certificate that matches the most complex test you will run.
2. Send it to the state survey agency for the state where your lab sits. New York and Washington run their own separate processes.
3. Watch for a fee notice by email, which includes your ten-character CLIA identification number, and pay it.

CMS says every certificate type is effective for two years and allows waived testing. A Certificate of Waiver lab must have a laboratory director, but CMS says there are no federal education or experience requirements for that director. Non-waived certificates, including PPM, require a director who meets CLIA's qualifications.

The CMS CLIA certificate fee schedule, effective January 27, 2024, sets the fee for each certificate type, billed every two years, and higher complexity certificates cost more as test volume grows.

The Certificate of Waiver costs $248 and the PPM certificate costs $297.

Some states add their own lab licensing on top of CLIA, and CMS tells applicants to check with the state agency before filing. Our guide to dispensing medications and labs in a DPC covers how in-office tests fit into the membership and the HSA rules.

Step 7. Check Whether Your State Requires a Dispensing Registration

Permission for in-office dispensing comes from your state, not from your medical license alone, and the rules differ by state.

Florida is one example. Under Fla. Stat. 465.0276, a practitioner who dispenses medicinal drugs for a fee has to register with their licensing board as a dispensing practitioner, and the statute also bars registered dispensing practitioners from dispensing most Schedule II and III controlled substances.

The Florida statute caps that registration fee at no more than $100, charged at registration and at each license renewal. Other states set their own fees, so check your board's fee page.

If you plan to dispense controlled substances anywhere, keep in mind that your DEA registration has to cover the address where they are stored, and DEA's recordkeeping and inventory rules apply. Our direct primary care laws by state guide and the state pages at /start-a-dpc are good places to start on your state's specifics.

Step 8. Put Malpractice Coverage in Place Before the First Patient

Malpractice insurance is a policy rather than a license, but it belongs on this checklist because some states make it a condition of practicing. New Jersey is one example. Under N.J.S.A. 45:9-19.17, a physician who maintains a practice in the state and has responsibility for patient care must carry coverage from a carrier authorized in New Jersey, including tail coverage on claims-made policies, or a letter of credit if coverage is not available.

New Jersey sets that minimum at $1,000,000 per occurrence and $3,000,000 per policy year. The fallback letter of credit has to be at least $500,000.

If you are leaving employed medicine, ask your former employer's carrier how your old policy handles claims from past care, because a claims-made policy without tail coverage can leave a gap. Our guide to insurance for a new DPC practice covers malpractice, general liability, cyber and the rest of the coverage stack.

Do You Need Insurance Credentialing or Medicare Enrollment for DPC?

Insurance credentialing (enrolling with each health plan so you can bill it) is a step most DPC practices skip because they don't bill insurance. Medicare is the exception worth thinking through. In the DPC Alliance's State of DPC report (survey collected late 2024, published July 2026), 80.7% of surveyed physicians had opted out of Medicare. Opting out lets you contract privately with Medicare patients, and it is a filing with your Medicare contractor rather than a credential.

Whether to opt out, stay enrolled or order and refer only is a real decision with multi-year consequences. Our step-by-step guide on how to opt out of Medicare for DPC and the Medicare opt-out planner walk through the timing.

How to Keep Every License and Registration Renewed

Getting every credential is a one-time project. Keeping them current is a permanent one, and the renewals come from different agencies on different clocks. Your DEA registration runs on a three-year cycle, your CLIA certificate on a two-year cycle, your medical license and any state controlled substance license on whatever cycle your state sets, and malpractice usually renews every year.

A simple way to stay ahead of it:

• Keep one credential sheet with each license number, issuing agency, issue date, expiration date and the login used to renew it.
• Point every agency at an inbox someone reads. DEA sends renewal notices by email only, and CMS sends your CLIA fee notice by email.
• Set reminders 90 and 30 days out for every expiration, not just the DEA one.
• Update NPPES within 30 days whenever your address, phone or practice details change.
• Recheck before you add a clinician or a second location. A new prescriber needs their own NPI and DEA registration, and a new site may need its own DEA registration and CLIA certificate.

This is the kind of follow-up that slips not because anyone is careless, but because the reminders live in five different agency portals and a few inboxes. Tabflows is a dedicated tech team that connects the tools your clinic already uses, like your EHR, billing and messaging, and turns follow-up into tracked tasks with an owner.

Putting It All Together

The cleanest path for most new DPC practices runs in this order. Confirm your state medical license, update your NPI, form the business and get the EIN and local business license, get the state controlled substance license if your state requires one, register with DEA at the new address, file for your CLIA waiver, check your state's dispensing rules, and bind malpractice coverage before the first visit.

None of these steps is hard on its own, and most of them are an online form and a fee. The friction comes from the dependencies between agencies and from the renewals that follow, so build your credential sheet on day one and plan the paperwork costs into your budget with the DPC startup cost calculator. When you are ready to see how other practices in your area have set up, the DPC Finder lists every direct primary care practice we know of.