# New Healthcare Practice Launch Compliance Checklist: Everything You Should Set Up Before Opening Day Launching a new healthcare practice means setting up compliance infrastructure from scratch. Here's the comprehensive checklist covering FDA/FTC marketing compliance, HIPAA, state requirements, and platform setup. By RegenCompliance Editorial (FDA/FTC compliance desk). Published 2025-11-19. Reading time 8 minutes. Canonical page: https://regencompliance.ai/blog/new-practice-launch-compliance-checklist Launching a new healthcare practice means building compliance infrastructure from scratch - and doing it before marketing starts rather than retrofitting later. Marketing compliance decisions at launch ripple forward for the life of the practice. This checklist covers the specific compliance setup for a new launch across marketing, HIPAA, state requirements, and ongoing processes. ## Pre-launch: 60-90 days before opening ### Legal entity and licensure - Business entity formed in the state of operation. - Professional entity requirements met (PC, PLLC as state requires). - State licensure verified (medical, dental, specialty licenses as applicable). - Multi-state licensure established if serving out-of-state patients. - DEA registration if prescribing controlled substances. ### Insurance - Professional malpractice insurance. - General liability. - Cyber liability (HIPAA-relevant). - Advertising liability (for marketing). - Management liability (D&O for corporate entities). ### Healthcare regulatory counsel - Relationship established with healthcare regulatory attorney. - Specific familiarity with your specialty and state. - Available for compliance questions as they arise. ## Marketing infrastructure ### Brand and positioning - Practice name verification (state business name, trademark considerations). - Brand positioning matches actual credentialing and scope. - Specialty-claim language reviewed for accuracy. ### Website foundation - Services pages accurately describe offered services. - Provider bios accurate to credentialing. - About page compliant with healthcare advertising rules (see our [About page compliance guide](https://regencompliance.ai/blog/healthcare-about-page-compliance)). - Privacy policy and terms of service. - HIPAA Notice of Privacy Practices available. - Accessibility (ADA) considerations. For a comprehensive pre-launch website review, use our [healthcare website compliance audit framework](https://regencompliance.ai/blog/healthcare-website-compliance-audit-framework). ### Compliance program - Written style guide for marketing. - Pre-publish review process established. - Compliance software selected and set up. - Staff trained on compliance basics before publishing content. - Documentation practices established. ### Platform accounts - Google Business Profile set up with accurate information. - Google Ads account (with LegitScript certification if required for category). - Meta Business Manager established. - Healthcare-appropriate social media accounts created. - Directory listings (Healthgrades, Yelp, specialty directories) with accurate information. ## HIPAA infrastructure ### Documentation - Notice of Privacy Practices. - Patient intake forms compliant with current framework. - Marketing authorization forms separate from treatment consent. - Photo authorization forms if using patient imagery. - Communication preference forms. ### Operational HIPAA - Business Associate Agreements with all vendors handling PHI. - Email marketing platform HIPAA-compliant with BAA. - Text messaging platform HIPAA-compliant if used. - EHR/practice management HIPAA-compliant with BAA. - Website forms HIPAA-appropriate for any PHI collected. - Staff HIPAA training documented. ## State-specific requirements ### Advertising - State medical board advertising rules reviewed. - State-specific disclosures included in marketing. - Specialty-claim terminology compliant with state rules. - Telehealth advertising compliant if offering cross-state services. ### Scope of practice - Services offered within authorized scope. - Supervision arrangements documented where required. - Non-physician provider scope-of-practice compliant. ### Privacy - State privacy law compliance (California CMIA, New York SHIELD, etc.). - State-specific breach notification procedures. ## Category-specific considerations ### Med spa / aesthetic - Medical director agreement and supervision structure. - Nurse injector licensing and supervision. - Device FDA clearance documentation. - Before/after photography policies. ### Telehealth - Multi-state licensure plan. - Telehealth platform HIPAA compliance. - State-specific telehealth rules. - Controlled substance prescribing considerations. ### Regenerative medicine - HCT/P pathway analysis with counsel. - Supplier vetting and documentation. - Marketing language matched to pathway. The FDA publishes a [framework for HCT/P regulation](https://www.fda.gov/vaccines-blood-biologics/tissue-tissue-products) that is essential reading before launching any regenerative medicine service line. ### Addiction treatment - LegitScript certification. - EKRA compliance for compensation structures. - State patient brokering law compliance. ## Ongoing process setup The FTC’s [Health Products Compliance Guidance](https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance) is the primary federal reference for what substantiation standard applies to healthcare marketing claims. Review it before your first content goes live, and see our [overview of state medical board advertising rules](https://regencompliance.ai/blog/state-medical-board-advertising-rules-overview) for state-level requirements. 1. **Pre-publish review workflow.** Every piece of content passes compliance review before publishing (see our [pre-publish compliance checklist](https://regencompliance.ai/blog/pre-publish-compliance-checklist)). 2. **Quarterly compliance audit.** Review of all live marketing surfaces against current rules. 3. **Staff training refresh.** Annual baseline training, triggered updates for specific changes. 4. **Regulatory monitoring.** Someone tracks FDA/FTC/state enforcement in the practice’s specialty. 5. **Incident response plan.** Clear process if compliance issues emerge or regulatory contact occurs. ## 30/60/90 day review Even with a thorough launch setup, the first 90 days typically reveal gaps. Schedule reviews at 30, 60, and 90 days to audit: - What’s been published since launch. - Whether the compliance workflow is actually being followed. - Gaps between planned and actual operations. - Emerging issues that need attention. > Launching right is dramatically cheaper than retrofitting. Practices that set up compliance infrastructure at launch spend a fraction of what practices that tried to bolt it on later do - and they avoid the compliance issues that typically emerge from retrofitting. Key Takeaways - Launch is the cheapest time to build compliance infrastructure - retrofitting is dramatically more expensive. - Legal entity, licensure, insurance, and counsel relationships should be established 60-90 days before opening. - HIPAA infrastructure (documentation, BAAs, training, forms) needs to be operational before seeing patients. - Compliance program (style guide, review process, software, training) needs to be operational before marketing launches. - 30/60/90 day reviews catch gaps between planned and actual compliance operations. --- RegenCompliance is FDA/FTC compliance scanning software for healthcare marketing, operated by Regen Portal LLC. Educational compliance tool, not legal advice. Not affiliated with the FDA or FTC. Contact: support@regencompliance.ai. Full site index for AI agents: https://regencompliance.ai/llms.txt