The 12-month runway: what happens in which month

Plan a year, and let credentialing set the pace

Plan on roughly a year, and build the schedule around one bottleneck: payer credentialing. The fast steps — the business plan, the entity, the EIN, the EHR choice — take days to weeks and are under your control. Credentialing is not. Health plans follow a verification framework requiring primary-source checks, a National Practitioner Data Bank query, and standards under which verification is generally usable for up to 180 days, with recredentialing at least every 36 months 1Ref 1National Committee for Quality Assurance (2026).Credentialing — NCQA.That payer credentialing follows primary-source verification, an NPDB query, a 180-day verification aging window, and recredentialing at least every 36 months — the framework that sets the launch timeline's long pole..

So the timeline is not a straight line of equal steps. Build it alongside the startup budget, front-load the paperwork you can finish quickly, start credentialing as early as possible because it is the long pole, and fill the waiting months with everything else — technology, policies, a dry run — so nothing is left for the final week. The months below overlap on purpose; the point is what you start when, not a rigid sequence.

The single most useful mental shift is to stop thinking of this as a sequence you march through and start thinking of it as one long wait — credentialing — with everything else scheduled to finish before that wait ends.

Months 0–2: the fast paperwork

The first two months are for the steps that are quick, cheap, and fully in your hands, so momentum is easy and nothing here blocks you later. Start with the plan, because it sizes everything downstream: the SBA's lean or traditional template forces you to define your revenue model, volume, and market before you spend a dollar 2Ref 2U.S. Small Business Administration (2026).Write your business plan.That a lean or traditional business plan is the first month's task, sizing revenue, volume, and market before spending begins.. Then form the entity and get your identifier.

• Write the business plan — lean is fine; the point is knowing your numbers before you commit 2Ref 2U.S. Small Business Administration (2026).Write your business plan.That a lean or traditional business plan is the first month's task, sizing revenue, volume, and market before spending begins..
• Form the entity your board allows — the liability and tax framing is national; the permitted professional form is set by your state 3Ref 3U.S. Small Business Administration (2026).Choose a business structure.That entity formation is an early, fast step whose liability and tax framing is national while the permitted professional form is set by the state..
• Get the EIN — free and issued online the same day, so this is never the thing you are waiting on 4Ref 4Internal Revenue Service (2026).Apply for an Employer Identification Number (EIN) online.That the EIN is issued free and online the same day, so it never becomes a scheduling bottleneck in the launch timeline..
• Open a business bank account — with the EIN and formation documents, so practice money never mixes with personal from the first deposit.
• Track every pre-opening expense from day one — how pre-opening costs are deducted matters at tax time, and reconstructing them later is painful.

Also begin the two setups that quietly gate everything downstream, even though they finish later: get your NPI in order and start your CAQH profile. Neither takes long, but a stalled CAQH attestation is a common reason a payer application sits untouched. None of these should take more than a few weeks; if you are stuck here, you are usually waiting on a decision, not a process — so make the decision and move.

Months 1–3: screening and a credentialing-grade file

While the paperwork clears, assemble the file credentialing will demand and run the screening payers and hospitals expect — starting these early is what keeps the long middle from getting longer. Credentialing-grade screening means checking the federal exclusion lists, not just your own license status. No federal health program pays for services furnished by an excluded person, so screening yourself against the OIG's List of Excluded Individuals and Entities is a step you do before you enroll, not after 5Ref 5HHS Office of Inspector General (2026).Exclusions Program.That no federal program payment may be made for services furnished by an excluded person and that the LEIE is the public check — the self-screening and hire-screening step done before enrollment..

• Screen against the LEIE — the OIG's public exclusion check, run on yourself now and on any future hire before their first day 5Ref 5HHS Office of Inspector General (2026).Exclusions Program.That no federal program payment may be made for services furnished by an excluded person and that the LEIE is the public check — the self-screening and hire-screening step done before enrollment..
• Screen against SAM.gov — the federal debarment system that complements the LEIE; the two-database check is the credentialing-grade convention 6Ref 6U.S. General Services Administration (2026).SAM.gov.That SAM.gov is the federal exclusion/debarment check complementing the OIG LEIE — the second database in the credentialing-grade two-database screening convention..
• Assemble the file — license, diploma, DEA registration if you prescribe, malpractice face sheet, a work history with no unexplained gaps, references.
• Complete your CAQH profile — the shared attestation most commercial payers pull from, so it is ready the day you apply.

A credentialing-grade file has one quiet requirement worth stating plainly: no unexplained gaps. A month between jobs is fine; a month you cannot account for is a query that stalls the review. Write the short explanation now, while you remember it, and attach it to the file. Everything in this list is something you can finish before a single payer responds, which is exactly why it goes early.

Months 2–8: payer credentialing, the long middle

This is the stretch that makes a solo launch take a year, and almost none of it is under your control once you submit. Each health plan runs its own primary-source verification, queries the National Practitioner Data Bank, and works within the NCQA framework that allows verification to be used for up to 180 days — so a single plan commonly takes several months, and multiple plans in parallel still gate on the slowest 1Ref 1National Committee for Quality Assurance (2026).Credentialing — NCQA.That payer credentialing follows primary-source verification, an NPDB query, a 180-day verification aging window, and recredentialing at least every 36 months — the framework that sets the launch timeline's long pole.. Submit early, submit complete, and expect to wait.

Two things shorten this stretch, and neither is a trick:

• Apply to every plan at once, not one at a time. Sequential applications stack the months; parallel ones overlap them.
• Answer verification requests within a day. A missing document restarts a plan's clock, and the 180-day usability window means a stalled file can force re-verification 1Ref 1National Committee for Quality Assurance (2026).Credentialing — NCQA.That payer credentialing follows primary-source verification, an NPDB query, a 180-day verification aging window, and recredentialing at least every 36 months — the framework that sets the launch timeline's long pole..

A third habit protects the whole stretch: keep a simple tracker — one row per payer, columns for submitted date, follow-up date, and status — and call or message each payer's provider-enrollment channel on a fixed cadence rather than waiting to be contacted. Payers rarely reach out to move your file along; they respond when you do.

If you cannot afford to wait out credentialing before revenue starts, this is where a cash-pay bridge — or the part-time launch, keeping outside income while enrollment completes — keeps the lights on without pretending the credentialing calendar is faster than it is.

Months 6–10: technology, EHR, and the security setup

Use the credentialing wait to stand up your technology and satisfy the Security Rule, so go-live is a switch you flip rather than a scramble. Configure the EHR and secure communications, and complete the written risk analysis the HIPAA Security Rule requires. The free Security Risk Assessment tool from ONC and OCR is built for a practice your size, so this costs your time rather than a consultant's fee 7Ref 7Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.That ONC/OCR publish a free Security Risk Assessment tool sized for small practices, so the required risk analysis can be completed during the credentialing wait at no consultant cost..

• Configure the EHR and clearinghouse — the real EHR bill is more than the sticker once add-ons are counted, so budget for the full cost, and test a claim end to end before a real one depends on it.
• Run the risk analysis — the SRA tool walks a solo through it and produces the document an auditor would ask for 7Ref 7Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.That ONC/OCR publish a free Security Risk Assessment tool sized for small practices, so the required risk analysis can be completed during the credentialing wait at no consultant cost..
• Install what the analysis flags — device encryption, a password manager, secure backup, and a business associate agreement with every vendor that touches PHI.
• Stand up patient-facing basics — scheduling, intake forms, and a compliant telehealth platform if you will see clients remotely.

This is also the window to write the boring documents that a live practice needs and a rushed one skips: your notice of privacy practices, informed-consent and financial-policy forms, a cancellation policy, and a basic set of clinical policies. None is hard; each is far easier to write now, in the calm of the wait, than in the first busy week. Doing all of this during the wait, rather than after credentialing clears, is what lets you book the first session the week you are approved.

Months 10–12: the dress rehearsal and go-live

The final stretch is for rehearsal, not new construction, and the practices that open smoothly treat the last month as a test run. Walk a fake patient through the entire flow — booking, intake, consent, the session, the note, the claim — and fix what breaks before a real person is on the other end. Then open on a deliberately light schedule so early friction is survivable rather than overwhelming.

• Run a dress-rehearsal week — one simulated patient through every step, end to end.
• Verify your first claims actually adjudicate — submit real claims for your first sessions immediately and watch them clear, so a setup error surfaces on visit one, not visit thirty.
• Open light — a partial schedule for the first weeks leaves room to fix what the rehearsal missed.
• Keep the runway funded — deposits still lag the first session, the six-month lag between opening and steady cash, so the personal runway carries you through the opening weeks.

The rehearsal's real job is to catch the invisible failures: an intake form that does not save, a consent that never gets countersigned, a claim that rejects on a mismatched taxonomy code. These are all trivial to fix before a patient is involved and genuinely painful to fix after. Go-live is a soft event, not a launch party; the goal is a working loop you can widen, not a full calendar on day one.

What compresses the timeline, and what cannot

Some of the year is compressible and some is not, and knowing which is which keeps you from paying for speed you cannot buy. The paperwork months compress with preparation; the credentialing months mostly do not, because they run on the payers' verification clocks, not yours 1Ref 1National Committee for Quality Assurance (2026).Credentialing — NCQA.That payer credentialing follows primary-source verification, an NPDB query, a 180-day verification aging window, and recredentialing at least every 36 months — the framework that sets the launch timeline's long pole.. Spend your energy where it moves the calendar.

• Compressible: entity, EIN, EHR setup, policies, the risk analysis — all faster with a checklist and a free week.
• Barely compressible: credentialing — parallel applications and instant document turnaround help at the margin, but the verification framework sets a floor 1Ref 1National Committee for Quality Assurance (2026).Credentialing — NCQA.That payer credentialing follows primary-source verification, an NPDB query, a 180-day verification aging window, and recredentialing at least every 36 months — the framework that sets the launch timeline's long pole..
• Not a shortcut, but a bridge: opening cash-pay first lets revenue start before credentialing clears, so the long middle costs you time rather than income.

The honest planning number is a year, front-loaded with what you control and patient with what you do not. Build the schedule backward from your target open date, put credentialing first, and let the fast steps fill the gaps around it.

Where solos lose months

Most launches that run long lose the time in the same three places, and all three are avoidable once you know to watch for them. None is about working harder; each is about sequencing and completeness. Knowing the common failure modes is worth more than any single checklist item, because they are the difference between a twelve-month launch and an eighteen-month one.

• Starting credentialing late. The single biggest cause. Because the fast paperwork feels like progress, solos often submit payer applications only after everything else is done — adding months to the open date for no reason 1Ref 1National Committee for Quality Assurance (2026).Credentialing — NCQA.That payer credentialing follows primary-source verification, an NPDB query, a 180-day verification aging window, and recredentialing at least every 36 months — the framework that sets the launch timeline's long pole..
• Submitting incomplete files. A missing document does not just delay one step; it can restart a plan's verification clock, and the 180-day usability window means a stalled file may need re-verification 1Ref 1National Committee for Quality Assurance (2026).Credentialing — NCQA.That payer credentialing follows primary-source verification, an NPDB query, a 180-day verification aging window, and recredentialing at least every 36 months — the framework that sets the launch timeline's long pole..
• Leaving technology for the end. Configuring the EHR, testing a claim, and completing the risk analysis during the credentialing wait costs nothing extra; doing it after approval delays the first booked session by weeks 7Ref 7Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.That ONC/OCR publish a free Security Risk Assessment tool sized for small practices, so the required risk analysis can be completed during the credentialing wait at no consultant cost..

The fix for all three is the same: front-load what you control, start credentialing first, and use the wait productively. A launch is rarely slow because a step was hard — it is slow because a step started late. If you take one operating rule from this page, make it that: the day you commit to opening, the very next action is to start credentialing, not to admire the business plan.