The stack in order: what each purchase is waiting on

What sets the order

Paperwork sets the order. Most products a new practice buys ask for one of a short list at signup: a legal business name, an EIN, a bank account, a street address, an NPI. Those identifiers depend on each other unevenly: the EIN waits on the registered name, the bank account waits on the EIN, and the NPI waits on an address and a phone line you arrange yourself. The buy order falls out of those dependencies.

Two links in the chain are state law. The entity is formed at your state's filing office under its rules for professional entities, and your license file is governed by your board alone, including, where your board requires it, the practice address on file. The federal links are the same everywhere; where a step below is state-set, it says so.

The order also assumes a practice built from scratch. Buy vs build is a separate question: a purchased practice arrives with a running stack, contracts included, and the work there is renegotiation rather than sequencing.

The entity, the EIN and the bank account come first

Form the entity, take its EIN, and open the business bank account before the first software purchase. The bank account genuinely requires the number 1Ref 1U.S. Small Business Administration (2026).Launch your business — Get federal and state tax ID numbers / Open a business bank account.The launch sequence: the EIN comes right after registering the business, and the bank account, license and permit applications, and hiring all require it.; the entity comes first because the number attaches to a name. The SBA's launch guidance puts the EIN immediately after registering the business and lists what the number unlocks: paying federal taxes, hiring, opening a bank account, and applying for business licenses and permits 1Ref 1U.S. Small Business Administration (2026).Launch your business — Get federal and state tax ID numbers / Open a business bank account.The launch sequence: the EIN comes right after registering the business, and the bank account, license and permit applications, and hiring all require it..

The entity decision, and whether your state requires a professional entity at all, is its own page; what the order needs from it is the exact legal name and tax identity, because federal forms downstream check them for agreement 3Ref 3Centers for Medicare & Medicaid Services (2026).Form CMS-855I — Medicare Enrollment Application: Physicians and Non-Physician Practitioners.An NPI must already exist and be furnished on the CMS-855I before enrolling; practice locations must be specific USPS street addresses; the name and tax number must match what was used to obtain the NPI..

Online, the EIN comes back in the same session, issued immediately if the application is approved; by fax it returns generally within 4 business days; by mail, approximately 4 weeks 7Ref 7Internal Revenue Service (2025).Instructions for Form SS-4 (Rev. December 2025): Application for Employer Identification Number (EIN).EIN channel mechanics: immediate online issuance when approved, generally within 4 business days by fax, approximately 4 weeks by mail, and one EIN per responsible party per day.. The IRS also issues only one EIN per responsible party per day, across every channel, a limit that bites only if two entities need numbers on the same day 7Ref 7Internal Revenue Service (2025).Instructions for Form SS-4 (Rev. December 2025): Application for Employer Identification Number (EIN).EIN channel mechanics: immediate online issuance when approved, generally within 4 business days by fax, approximately 4 weeks by mail, and one EIN per responsible party per day..

Open the business account as soon as the number exists. The account is what the rest of the money stack points at. The payment processor deposits into it, the bookkeeping app reconciles it, and Medicare, later, pays into it. Processors publish little about their underwriting; as a matter of common practice their applications ask for the tax ID and the business account's details, so treat both as prerequisites by convention.

The phone line is a purchase, and the NPI waits on it

A working phone number and a practice street address are prerequisites for the NPI, which makes the phone line the first defensible software purchase. The NPI application form, CMS-10114, marks the business practice location's street address and its phone number as mandatory fields; until both exist, there is no application to submit 2Ref 2Centers for Medicare & Medicaid Services / NPPES (2025).National Provider Identifier (NPI) Application/Update Form (CMS-10114).The NPI application form makes a business practice-location street address and phone number mandatory fields, so both must exist before the NPI..

So the first two buys are a number and an address. A voice-over-IP line can exist by the end of the day, and the number propagates onto every form that follows, so pick one the practice will keep. The address is the slow half. It means a lease, a sublet, or a decision to practice from home, and it is worth choosing with Medicare's later standard in view: the CMS-855I accepts only a specific street address as recorded by the United States Postal Service, which a post-office box is not 3Ref 3Centers for Medicare & Medicaid Services (2026).Form CMS-855I — Medicare Enrollment Application: Physicians and Non-Physician Practitioners.An NPI must already exist and be furnished on the CMS-855I before enrolling; practice locations must be specific USPS street addresses; the name and tax number must match what was used to obtain the NPI..

Your board has a say here too. State boards keep their own rules about the address on a license file and about reporting a change, and boards differ; read yours before the lease is signed, because a lease is the one item in this section with a term attached.

Medicare's forms publish their own prerequisites

Medicare enrollment cannot start until the NPI exists: the CMS-855I is explicit that you must obtain an NPI and furnish it on the application prior to enrolling 3Ref 3Centers for Medicare & Medicaid Services (2026).Form CMS-855I — Medicare Enrollment Application: Physicians and Non-Physician Practitioners.An NPI must already exist and be furnished on the CMS-855I before enrolling; practice locations must be specific USPS street addresses; the name and tax number must match what was used to obtain the NPI.. Practice locations must be specific street addresses as the Postal Service records them, and the name and tax number on the application must be the ones used to obtain the NPI 3Ref 3Centers for Medicare & Medicaid Services (2026).Form CMS-855I — Medicare Enrollment Application: Physicians and Non-Physician Practitioners.An NPI must already exist and be furnished on the CMS-855I before enrolling; practice locations must be specific USPS street addresses; the name and tax number must match what was used to obtain the NPI..

The matching rule is why the order matters. An NPI obtained under your own name and Social Security number, before the entity existed, will not agree with an application filed under the PLLC's name and EIN, and the 855I requires the name and tax number on the application to be the ones used to obtain the NPI 3Ref 3Centers for Medicare & Medicaid Services (2026).Form CMS-855I — Medicare Enrollment Application: Physicians and Non-Physician Practitioners.An NPI must already exist and be furnished on the CMS-855I before enrolling; practice locations must be specific USPS street addresses; the name and tax number must match what was used to obtain the NPI.. Reconciling the two after the fact is work either way. Settling the entity and the EIN first is what keeps that field from needing a correction later.

Getting paid closes the loop back to the bank. The CMS-588, the electronic funds transfer authorization Medicare pays through, asks for confirmation of the account on bank letterhead or a voided check, a document only an open account can produce 4Ref 4Centers for Medicare & Medicaid Services (2023).CMS-588: Electronic Funds Transfer (EFT) Authorization Agreement.Medicare EFT enrollment requires proof of an existing bank account: a voided check or confirmation of the account on bank letterhead..

All of this assumes you are taking insurance. A cash-pay practice strikes the 855I, the EFT form, and the clearinghouse from the list in one move; the subtraction list is its own exercise, and it changes the launch budget more than any vendor discount will. A practice that starts on panels and thins them later decides the drop order out of its own remittance files, and that decision belongs months in, when the files exist.

What the EHR is waiting on

No rule sets what an EHR asks for at setup, but in practice the fields are ones made earlier: the legal name, the EIN, the NPI, the practice address, the bank account its payment module deposits into. Treat them as prerequisites by convention, and buy when those fields can be filled in one sitting.

Under HIPAA, a person or company outside your own workforce that handles patient information on your behalf is a business associate, and the relationship runs on a written agreement 5Ref 5U.S. Department of Health and Human Services, Office for Civil Rights (2013).Sample Business Associate Agreement Provisions.The HIPAA definition of a business associate and the fact that the relationship runs on a written contract.. Applied to a solo practice, that definition reaches most of the stack: the EHR and the telehealth platform, and on the same reasoning the email host, the fax service, a transcription service, any scheduler that stores intake answers.

Check each vendor against the definition, not against a list. A product that will touch patient information and comes with no agreement to sign is off the list at any price. The clearinghouse joins last for a different reason. It gets configured against the payers that have finished enrolling you, so there is nothing for it to do until the chain above resolves.

A common convention puts the domain and owned email in front of all of this, before the identifiers. Every later account gets registered to that address, and re-homing logins across a live stack is a project nobody schedules. No rule requires the sequence; it costs little and never has to be undone.

The bookkeeping app waits on the bank account for a plainer reason: until the account has transactions there is nothing to reconcile. Its setup will also ask whether the books run on a cash or an accrual basis. Bring that question to your CPA before the trial period starts, because the answer shapes the books for years and is a poor thing to guess at inside a signup flow.

Sequence is also most of what a lean launch budget asks for: software bought when its prerequisites exist gets configured the week it is paid for, and nothing sits idle.

The compliance purchase no rule names

Under the security management process standard at 45 CFR 164.308, a documented risk analysis is Required, a designation that admits no substitute 6Ref 6U.S. Department of Health and Human Services (Office for Civil Rights) (2024).Administrative safeguards.A documented risk analysis is Required under the security management process standard, while the four listed workforce security-training methods are each Addressable.. What the Security Rule flatly requires is a document, not a subscription, so buy compliance tooling on your own schedule. The four workforce security-training methods, which sit under a separate standard in the same rule, security awareness and training, are each Addressable, meaning a practice may adopt its own documented equivalent 6Ref 6U.S. Department of Health and Human Services (Office for Civil Rights) (2024).Administrative safeguards.A documented risk analysis is Required under the security management process standard, while the four listed workforce security-training methods are each Addressable..

Required and Addressable are the rule's own vocabulary, and the difference is the whole purchasing question. The analysis must exist, in writing, whoever produces it. The training methods leave the instrument to the practice: a subscription is one way to meet them, and your own documented measure is another 6Ref 6U.S. Department of Health and Human Services (Office for Civil Rights) (2024).Administrative safeguards.A documented risk analysis is Required under the security management process standard, while the four listed workforce security-training methods are each Addressable..

A risk analysis needs a stack to analyze. Buy the systems, write down the risks they create, and let that document decide whether a training product, an encryption add-on, or a policy service earns a line in the budget.

Read the renewal before the prerequisite clears

The failure this order is meant to prevent is the enthusiasm week: annual plans bought in one sitting, clocks started on software that cannot be configured until its prerequisite clears. Running each subscription monthly until patients are on the calendar keeps that exit cheap; the monthly premium is the price of it.

Read the renewal terms before signing anything. The term, the renewal date, the price after the introductory period, and the cancellation path are all in the order form and the terms of service, and the time to read them is while the purchase can still wait on its prerequisite. Where the cancellation path is concerned, some states set a floor the terms cannot lower: California requires that a subscription signed up for online be cancellable entirely online, at will 8Ref 8California State Legislature (2026).Business and Professions Code § 17602.California's automatic-renewal requirements for a subscription sold online, including that an online sign-up must be cancellable entirely online, at will..

But the chain itself is short. The entity is a state filing. The EIN can arrive the same session it is applied for, when the online application is approved 7Ref 7Internal Revenue Service (2025).Instructions for Form SS-4 (Rev. December 2025): Application for Employer Identification Number (EIN).EIN channel mechanics: immediate online issuance when approved, generally within 4 business days by fax, approximately 4 weeks by mail, and one EIN per responsible party per day.. The bank account follows the number 1Ref 1U.S. Small Business Administration (2026).Launch your business — Get federal and state tax ID numbers / Open a business bank account.The launch sequence: the EIN comes right after registering the business, and the bank account, license and permit applications, and hiring all require it., the address and the phone line unlock the NPI 2Ref 2Centers for Medicare & Medicaid Services / NPPES (2025).National Provider Identifier (NPI) Application/Update Form (CMS-10114).The NPI application form makes a business practice-location street address and phone number mandatory fields, so both must exist before the NPI., the NPI unlocks enrollment 3Ref 3Centers for Medicare & Medicaid Services (2026).Form CMS-855I — Medicare Enrollment Application: Physicians and Non-Physician Practitioners.An NPI must already exist and be furnished on the CMS-855I before enrolling; practice locations must be specific USPS street addresses; the name and tax number must match what was used to obtain the NPI., and the EFT form closes the loop at the bank where the chain began 4Ref 4Centers for Medicare & Medicaid Services (2023).CMS-588: Electronic Funds Transfer (EFT) Authorization Agreement.Medicare EFT enrollment requires proof of an existing bank account: a voided check or confirmation of the account on bank letterhead..