For providers

The First Ninety Days of a Solo Practice: What Waits on What

Summary

A solo practice is set up in the order its applications demand: entity and federal EIN first, then the state licence and any state practice authority, then the NPI, then DEA registration, then Medicare enrollment, with commercial payers last, because each application asks for the number the one before it issued. The state step varies: some boards let a nurse practitioner start alone, others wait on a physician's filing. Read your board's advanced-practice page before setting a launch date.

By Gale Editorial · Updated 2026-09-01. Every figure cited to a dated source. How we write.

What order do the filings go in?

The order is set by what each application asks for. The EIN asks for nothing you do not already hold. The NPI record has to carry the legal business name and tax number that Medicare will later check it against. The DEA application asks for state authority and an address. Medicare asks for the NPI, the licence and the DEA number. The panels ask for all of it. So the chain runs entity, state, NPI, DEA, Medicare, then payers.

The state station is the one that moves. In some states a nurse practitioner files for the licence and prescriptive authority alone and waits only on the board. In others the board will not open the file until a physician submits it, which turns the launch date into a date two people have to hit. A therapist or psychologist who will never prescribe has a shorter chain, with the licence itself as the state step and no DEA station at all. Which version applies is on your board's advanced-practice or licensure page, and it is the first thing to read before a date goes on the calendar.

StationWhat it waits onWhere the dependency is written
Legal entity and federal EINYour choice of entity; nothing federal queuesIRS online EIN application
State licence and practice authorityThe board, and in some states a physician's own filingYour board's advanced-practice page
NPI through NPPESA settled legal business name and tax numberCMS-855I
DEA registration, Form 224State authority to prescribe controlled substances, and a practice addressDEA registration Q&A, 21 CFR 1301.12(a)
Medicare enrollment, CMS-855I in PECOSThe NPI, the licence and the DEA fields; the effective date waits on the later of filing and first serviceCMS-855I, 42 CFR 424.520
Commercial panels through CAQHA completed, attested profile the plan has been authorized to readCAQH Provider User Guide

Ninety days is this page's frame and nothing more. No document behind it says the chain fits in ninety days, and only one of them publishes a queue length at all: one state board's current average for one filing. The other durations here are rules rather than waits, like the day Medicare starts counting from and how often a credentialing profile has to be re-attested. Everything else on the calendar is a queue whose length the agency running it does not print.

Which steps can be finished today?

The EIN is the one federal step with no queue. The IRS issues it online, free, and immediately once the application is approved, and the page warns against paying a third party for one 1. The application limit is one EIN per responsible party per day 1. Everything upstream of it is a decision rather than a wait: which entity, which name, which tax number. That is the entity decision, and it belongs with a CPA before the number exists.

The reason to settle the name first sits in the Medicare application. The CMS-855I requires that the practitioner's name, Social Security number, legal business name, tax identification number and NPI match exactly in both PECOS and NPPES 2. A name or entity that changes after the NPI is issued means the NPI record has to be corrected before the Medicare application can go in. The number itself takes minutes, and requesting it under a name that later changes costs a whole station.

The NPI itself is a separate application from Medicare enrollment, and the form says so in plain terms: obtain the NPI and furnish it on the application prior to enrolling 2. None of the sources behind this page publishes how long NPPES takes to issue one, so plan the NPI for the week the entity exists and treat any faster result as found time.

Why does the state step decide the launch date?

The state step waits on the board, and in some states on a physician's own filing as well, which is why it decides the launch date more than any federal filing does. Georgia is the clearest worked example. An APRN there practices under a protocol agreement, and the board's page says the application is accessible and submittable online only by the delegating physician, through the Licensing Gateway 3. The nurse practitioner cannot file it.

As of September 1, 2026, the same page describes its turnaround as currently averaging 30 business days, depending on the complexity of the agreement 3. That is a stated average, and the board frames it as current experience, so re-check it the week you plan around it. But it is the one queue in this whole chain that any source here puts a number on, and it belongs to a filing the nurse practitioner cannot start alone.

New York draws its line by hours instead. A nurse practitioner there practices in accordance with written practice protocols and a written practice agreement with a collaborating physician, and one with more than 3,600 hours of qualifying practice experience is authorized to practice independently 4. Under the threshold the agreement is a launch prerequisite. Over it the station is gone.

Neither rule is the national rule. A board that requires one publishes it under names like protocol agreement, collaborative practice agreement, transition to practice, or prescriptive authority application, and the same page usually says who files it. Search the board's site for the term it uses, then read the filing instructions for the word physician. A filing only a physician can submit puts a second person's calendar inside the launch date, and it is better to learn that in week one than in week ten.

A behavioral-health clinician who does not prescribe has a shorter version of this station. The state step is the licence itself, plus whatever supervised hours the board counts toward it, and there is no protocol agreement waiting on anyone. The lookup is the same board page, read for the licence's own requirements rather than for a physician's name.

What does the DEA application wait on?

Two things: state authority and an address. As a condition of registration, a practitioner or mid-level practitioner must hold authority to dispense controlled substances under the laws of the state where they practice, and DEA relies on the state boards to determine that 5. A registration also attaches to a place. A separate registration is required for each principal place of business or professional practice at one general physical location, under 21 CFR 1301.12(a) 5. The address precedes the form.

A clinician who will practice from two offices is looking at two registrations, and one who has not settled on an address has nothing to put on the form. Settle where the practice lives before the form is opened, because the registration is issued to that address, and the Medicare rules below key their dates to the practice location too.

The form is DEA Form 224 for a new practitioner or mid-level practitioner registration, submitted online through the Diversion Control Division's registration page, which also carries the link to check an application's status 6. The page prints no processing time, and this article will not supply one.

The first new or renewal application filed on or after June 27, 2023 carries a one-time attestation that the applicant has completed eight hours of training on treating and managing patients with opioid or other substance use disorders 7. No certificate is sent to DEA; the practitioner keeps the record 7. An advanced-practice nurse whose graduate program covered the material has a pathway described on the same page, and training completed for a former DATA-Waiver counts 7. Finish the hours before Form 224 is opened, since the form asks for the attestation. The guidance behind this is dated August 31, 2023, so confirm it still reads the same way before relying on it.

A clinician who will not prescribe skips the station, and Medicare's form expects that: the DEA section of the CMS-855I has a Not Applicable box beside the registration number 2.

When does Medicare start paying?

Medicare starts paying on the later of two dates: the day the enrollment application was filed, if a contractor later approves it, or the day the practitioner first furnished services at the new practice location, under 42 CFR 424.520(d) 8. Filing in January and opening in March gives a March date. Opening in January and filing in March gives a March date too. So the filing and the first visit belong in the same week.

There is a short reach backward. Under 42 CFR 424.521(a), physicians and non-physician practitioners may bill for services furnished up to thirty days before their effective date if circumstances precluded enrollment in advance, or up to ninety days before where a Presidentially-declared disaster did, and only for services at the enrolled practice location 9. Thirty days covers a filing that slipped. It does not cover a practice that opened a season ahead of its paperwork, and it does not cover a visit at an address the enrollment does not name.

The form itself lists what has to exist first. The CMS-855I says the NPI must be obtained and furnished on the application prior to enrolling in Medicare, and that applying for one is a separate process 2. It collects active licence and certification information and DEA registration information, each with an effective date and the state where it was issued 2. All of it precedes the filing, and the filing date is the earliest day the effective date can fall on. That is why the chain above is arranged to reach this form as soon as the licence and the NPI exist.

How long the Medicare Administrative Contractor then takes to approve the application is not in the regulation and not in any source behind this page. What the regulation fixes is the effective date, and that one moves with the filing, so file the CMS-855I in PECOS the day the last input lands.

What do commercial payers wait on?

Commercial plans wait on a credentialing profile they have been given permission to read, and many of them read it through CAQH. The Provider Data Portal's own guide lays out the sequence: complete the application questions, authorize participating organizations to access the profile, attest to it, then upload the supporting documents 10. A finished profile no plan has been authorized to open is invisible to that plan. The authorization step is the one a solo clinician skips without noticing.

The profile comes last because it is built out of what the chain above produced, and a profile attested before one of those pieces exists is attested with a hole in it. Most plans are said to wait for the legal entity and its tax number before they will open a file. That is convention, and no source here makes it a rule, but the profile asks for both either way.

Two clocks start the day you attest. Re-attestation is required every 120 days, or 180 days for Illinois providers, and a profile more than 120 days past its attestation moves to an Expired Attestation state 10. Signed documents uploaded to the profile carry their own 120-day window measured from the signature date 10. Both clocks keep running through the plan's review, so a profile submitted in month one can expire in month five while a committee is still reading it.

How long a plan then takes to decide is the number every new practice wants, and no document behind this page supplies it. CAQH documents the profile and says nothing about the plan's review clock. Many practices describe a panel decision as a matter of months; treat that as convention, ask each plan for its stated timeline in writing, and put the date on the first-90-days dashboard instead of in the revenue forecast.

What keeps running after day ninety?

Three stations never finish. The CAQH profile lapses into Expired Attestation without a fresh attestation every 120 days, or 180 in Illinois 10. The DEA registration renews on Form 224a, and a renewal submitted in a timely manner before expiration lets the registrant continue operating under it beyond the expiration date until DEA takes final action 6. And the licence and any practice agreement renew on the board's cycle, which the board's own site publishes.

The first hire starts paying for itself the week the re-attestation calendar, the renewal calendar and the payer follow-up calls stop fitting between patients, and for a practice of one that week tends to arrive before the revenue does. Until then those dates live on one calendar, and it is the one to look at before the schedule fills.

The same chain runs in reverse at closing. The panels, the registration and the board each have their own notice rule when a practice ends, and the order that enrolled you is a fair first guess at the order that lets you go.

Put four dates on the calendar the week the doors open: the next CAQH attestation, the DEA expiration, the licence renewal, and the Medicare effective date the contractor confirms, since the thirty-day reach backward under 424.521 is measured from that day.

Common questions

No. DEA registration is conditioned on authority to dispense controlled substances under the laws of the state where you practice, and DEA relies on the state licensing board to decide whether you hold it. The state licence and any state prescriptive authority come first. Form 224 comes after, and it also wants a practice address, since a registration is issued per principal place of business.

Only if you have already started seeing patients at that location. Under 42 CFR 424.520, the effective date is the later of the filing date and the date services first began at the new practice location. Filing early and opening late gives you the opening date; opening early and filing late gives you the filing date. The retrospective window under 424.521 reaches back thirty days from the effective date in ordinary circumstances.

No. The CMS-855I collects DEA registration information for practitioners who hold it, and its DEA section carries a Not Applicable box for those who do not. A behavioral-health clinician who will never prescribe controlled substances skips the DEA station entirely. The licence, the NPI and the enrollment application are the chain, and the state licence still comes first.

Because the Medicare application says so. The CMS-855I requires that the NPI be obtained and furnished on the application before enrolling, and it describes the NPI application as a separate process. It also requires that name, Social Security number, legal business name, tax identification number and NPI match exactly in PECOS and NPPES, so the entity and its name should be settled before the NPI is requested.

No document behind this page states a turnaround, and the figure quoted around the profession is a convention rather than a published rule. What CAQH documents is the profile: complete it, authorize the plans to read it, attest, upload the documents, and re-attest every 120 days, or 180 in Illinois, while the plan reviews. Ask each plan for its own stated timeline in writing and calendar it.

It expires. Re-attestation is required every 120 days, 180 for Illinois providers, and a profile more than 120 days past attestation moves to an Expired Attestation state. Uploaded signed documents carry their own 120-day window from the signature date. Both clocks run during a plan's review, so the first re-attestation often falls due before the first panel decision arrives.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

  1. 1.Internal Revenue Service (2026). Apply for an Employer Identification Number (EIN) Online. irs.gov. linkThat the IRS issues an EIN online, free and immediately on approval, warns against paying a third party for one, and limits applications to one EIN per responsible party per day.
  2. 2.Centers for Medicare & Medicaid Services (2026). Form CMS-855I — Medicare Enrollment Application: Physicians and Non-Physician Practitioners. Centers for Medicare & Medicaid Services (CMS). linkThat the CMS-855I requires the NPI to be obtained and furnished before enrolling and describes the NPI application as a separate process; that name, SSN, legal business name, TIN and NPI must match exactly in PECOS and NPPES; and that the form collects active licence, certification and DEA registration information with effective dates and issuing state, with a Not Applicable option for DEA.
  3. 3.Georgia Composite Medical Board (2026). APRN Protocol Registration. Georgia Composite Medical Board (medicalboard.georgia.gov). linkGeorgia only: that the APRN protocol agreement application is accessible and submittable online only by the delegating physician through the board's Licensing Gateway, and the board's stated current average processing time of about 30 business days as of 2026-09-01.
  4. 4.New York State Education Department, Office of the Professions (2026). Practice Information for Nurse Practitioners. NYSED Office of the Professions (op.nysed.gov). linkNew York only: that a nurse practitioner practices under written practice protocols and a written practice agreement with a collaborating physician, and that more than 3,600 hours of qualifying practice experience authorizes independent practice.
  5. 5.U.S. Drug Enforcement Administration, Diversion Control Division (2026). Registration Q&A (Questions & Answers — Registration). DEA Diversion Control Division. linkThat DEA registration is conditioned on authority to dispense controlled substances under the laws of the state of practice, with DEA relying on state licensing boards to determine it, and that a separate registration is required for each principal place of business under 21 CFR 1301.12(a).
  6. 6.Drug Enforcement Administration, Diversion Control Division (2026). Diversion Control Division | Registration. U.S. Department of Justice, DEA Diversion Control Division. linkThat a new practitioner or mid-level practitioner registration is DEA Form 224 and a renewal is Form 224a, both submitted online with a status-check link, and that a renewal submitted timely before expiration lets the registrant continue operating past the expiration date until final action.
  7. 7.U.S. Drug Enforcement Administration, Diversion Control Division (2023). Opioid Use Disorder – MATE Act Q&A. DEA Diversion Control Division, Questions & Answers. linkThat the first new or renewal DEA application on or after June 27, 2023 carries a one-time attestation of eight hours of substance-use-disorder training, that no certificate is submitted but the practitioner should retain the record, the advanced-practice-nursing graduate pathway, and that prior DATA-Waiver training counts. Guidance dated August 31, 2023.
  8. 8.Centers for Medicare & Medicaid Services (2025). 42 CFR 424.520 — Effective date of Medicare billing privileges. Code of Federal Regulations, Title 42, Part 424, Subpart P (GovInfo, U.S. Government Publishing Office, 2025 annual edition). linkThe rule in paragraph (d) that a physician's or non-physician practitioner's Medicare billing effective date is the later of the filing date of a subsequently approved enrollment application or the date services first began at the new practice location.
  9. 9.Centers for Medicare & Medicaid Services (2025). 42 CFR 424.521 — Request for payment by certain provider and supplier types. Code of Federal Regulations, Title 42, Part 424, Subpart P (GovInfo, U.S. Government Publishing Office, 2025 annual edition). linkThe rule in paragraph (a) that these practitioner types may bill retrospectively for services furnished up to thirty days before the effective date where circumstances precluded advance enrollment, or ninety days for a Presidentially-declared disaster, only at the enrolled practice location.
  10. 10.CAQH (2023). CAQH Provider Data Portal Provider User Guide, Version #43. CAQH (last updated 08/22/2023). linkThe documented CAQH sequence (complete the application, authorize participating organizations, attest, upload documents), the 120-day re-attestation cadence (180 days in Illinois), the Expired Attestation state, and the 120-day signature window on uploaded documents. Guide version 43, 2023.

https://www.gale.care/for-providers/pq-first-ninety-days-what-waits-on-what · 10 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

Findability, by specialty

How practices like yours get found in local search and AI answers — the honest playbook, per specialty.

SEO for private practices · SEO for AI search / answer engines (all verticals)