How to Start a Physical Therapy Private Practice (USA)

To start a physical therapy private practice in the USA, you need an active license in every state where you will treat patients, a business entity set up under your state's rules, and a National Provider Identifier (NPI). You also need an Employer Identification Number (EIN) from the IRS if you hire staff or form an LLC, partnership or corporation. If Original Medicare patients will come to you, you enroll with Medicare as a physical therapist in private practice. Commercial insurers credential you one plan at a time. And once you send claims electronically, the HIPAA privacy and security rules apply to your practice.

This guide is for US physical therapists (PTs) and clinic owners, and everything in it is US law and US payer practice. Physiotherapists outside the USA have their own guides for the UK, Canada, Australia and New Zealand.

Read it as education. It is not legal, tax, insurance or billing advice. Laws and payer policies change, so check the current text, and see a health care attorney and an accountant before signing a lease or filing anything.

The quoted rules come from federal regulations and federal agency websites, plus two professional bodies: the Federation of State Boards of Physical Therapy (FSBPT) and the American Physical Therapy Association (APTA). Each source was checked on September 29, 2026. Its own page date is in the reference list.

What do you need to start a physical therapy private practice?

There is no single federal checklist. The order below is a suggestion, pieced together from the sources in this guide:

Confirm your license, plus a license, compact privilege or other route that state allows for any other state where patients will be, including patients you see by video.
Choose a business structure and register it with your state.
Get an EIN if your structure or your staff require one.
Apply for your individual NPI, and a second NPI for the practice if it is an organization.
Arrange professional liability insurance, and whatever other cover your premises and staff need.
Enroll in Medicare, if you will see Original Medicare patients.
Set up your credentialing profile and apply to the commercial plans you want to join.
Write your HIPAA policies and Notice of Privacy Practices, and complete a security risk analysis.
Build your documentation, plan of care and billing processes.
Post your good faith estimate notice if you will see uninsured or self-pay patients.

Some steps have to wait. APTA and CMS both put the NPI before Medicare enrollment, for example. A suggestion: anything that sits in someone else's queue, such as insurer credentialing, should start as soon as the earlier steps allow.

State licensure and your practice act

The board in the state where you practice issues your license. FSBPT is the federation of those boards. It develops, maintains and administers the National Physical Therapy Examination (NPTE), and its licensing authorities directory links to each jurisdiction's board website and practice act.

FSBPT also publishes a Jurisdiction Licensure Reference Guide, a resource that "compares some of the major similarities and differences among the jurisdictions." Start there to get your bearings. Your board enforces your own state's practice act and rules, though, so read those in full.

State rules differ and get amended, so this guide does not list them. Take these questions to your practice act before you open instead (a suggested list, not an official one):

May you see patients without a referral? If so, is there a cap in days or visits?
What supervision do physical therapist assistants (PTAs), aides and students need?
Who may own a physical therapy practice, and which business structures may a PT use?
What do the rules say about advertising and fees? Which titles may you use?
How long must you keep adult records, and how long for minors?
Must you tell the board about a new practice address or a new business name?

On that first question, the direct access guide works through three states as examples and sets out the Medicare rules for patients who come without a referral.

Treating a patient who is in another state, in person or by video, needs its own authority to practice there. FSBPT's telehealth policy paper explains why video counts: "Most jurisdictions define physical therapy care as occurring in the jurisdiction in which the patient/client is located at the time the technology is used." It names a license, a compact privilege or a registry as ways a PT may be authorized, depending on the state.

The Physical Therapy Compact describes itself as "an agreement between member states to improve access to physical therapy services for the public by increasing the mobility of eligible physical therapy providers to work in multiple states." Before the first appointment, confirm that both states are members and what a compact privilege asks of you. For running video sessions day to day, see the telehealth guide.

Choosing a business structure and registering it

The SBA sets out the trade-offs between structures. A sole proprietorship is the simplest to form, but the SBA warns: "You can be held personally liable for the debts and obligations of the business." It says an LLC protects your personal assets in most cases if the business goes bankrupt or is sued, and that corporations give owners the strongest protection from personal liability. Claims about your own clinical care are a different question from business debts, so ask your attorney how each structure handles them.

The SBA writes for every kind of business, not for licensed health professionals. Before you file, ask your state board and a health care attorney whether your state has extra rules for licensed professionals who form an entity, or limits on who may own a physical therapy practice. The SBA itself says "Consulting with business counselors, attorneys, and accountants can prove helpful."

Registration follows the structure. If your business is an LLC, corporation, partnership or nonprofit corporation, the SBA says "you'll probably need to register with any state where you conduct business activities." A sole proprietor who trades under a clinic name rather than their own may need to register that name, known as a DBA or trade name, with the state, county or city. Local permits vary too. In the SBA's words, "The licenses and permits you need from the state, county, or city will depend on your business activities and business location."

Getting an EIN

The IRS puts it in one line: "An EIN is a federal tax ID number for businesses, tax-exempt organizations and other entities." You need one if you have employees, and to operate a partnership, an LLC or a corporation, among other items on the IRS list. You apply with the IRS online tool, and the page is blunt about cost: "You never have to pay a fee for an EIN." Be wary of any website that charges for one.

A sole proprietor with no staff may not need an EIN. Ask your accountant whether to get one anyway. One reason is in the out-of-network and superbill guide: a sole proprietor may want the practice's EIN, rather than their Social Security Number, on the superbill that patients send to their plan.

Getting your NPI

CMS describes the NPI as "a 10-position, intelligence-free numeric identifier (10-digit number)." Under the HIPAA rule at 45 CFR 162.410, a covered health care provider must obtain an NPI and use it to identify itself on standard transactions such as claims. It must also report changes to its NPI details within 30 days.

There are two kinds. APTA explains that "Type 1 entities include physical therapists, physicians, chiropractors, dentists, nurses, and pharmacists," while Type 2 is for organizations such as clinics and group practices. For a solo PT who incorporates, APTA says "the corporation and the individual therapist each should have an NPI."

CMS gives three ways to apply. The fastest, CMS says, is the web-based application in the National Plan and Provider Enumeration System (NPPES). An organization can also submit an electronic file on your behalf, or you can mail the paper Form CMS-10114. A PT who never bills electronically may not strictly need an NPI. APTA notes that it is "not mandatory for health care providers who are not 'covered entities' under HIPAA to apply for an NPI, but we encourage all PTs and PTAs to have one."

The number stays with you. APTA says it "does not change or expire; however, you must update your information in NPPES if your contact or practice information changes." Opening your own practice usually changes both, so put the NPPES update on your opening checklist.

Do physical therapists have to enroll in Medicare?

Yes, if you plan to treat Original Medicare patients for covered services. APTA states that "Federal law does not allow physical therapists to opt-out of the Medicare program." It also warns that "If a non-Medicare enrolled physical therapist accepts payment directly from a Medicare patient for a service that is covered under Medicare, he or she could be subject to federal investigation and financial and other penalties." What a Medicare patient may pay you for directly is set out in the cash-based physical therapy guide.

The enrollment steps

CMS sets out four steps on its page for new providers and suppliers. Get your NPI first, then complete the Medicare enrollment application online in PECOS (the Provider Enrollment, Chain, and Ownership System), or on paper if you cannot apply online. The third step reads "Pay the Medicare Application Fee, if applicable," and CMS points to its fee matrix for who pays. Last, you work with your Medicare Administrative Contractor (MAC), which is the regional contractor handling the application.

Which form: CMS-855I or CMS-855B

CMS's form for individuals is the CMS-855I, the Medicare Enrollment Application for Physicians and Non-Physician Practitioners. APTA's enrollment FAQ explains how PTs use it: "If you are a PT working in a Physical Therapist Private Practice, or a PTPP, (including as the owner), fill out the CMS-855I." A practice that enrolls as an organization uses a different form. APTA again: "If you are an organization such as a Physical Therapist Private Practice, fill out the CMS-855B."

PTs who reassign their Medicare payments to a group used to need a separate form for that. APTA says "effective September 1, 2023, the CMS-855R form has been merged into the CMS-855I paper enrollment application." Reassignment now goes through the CMS-855I, in PECOS or on paper.

What Medicare means by private practice

The conditions are in 42 CFR 410.60(c). Each physical therapist in private practice must:

be legally authorized by the state to practice, and practice only within the scope of that license
"Engage in the private practice of physical therapy on a regular basis as an individual, in one of the following practice types: a solo practice, partnership, or group practice; or as an employee of one of these."
bill Medicare only for services in the practice's own office space or in the patient's home
treat patients of the practice, for whom the practice collects the fees

Read the office space rule before you commit to premises. The regulation says: "When services are furnished in private practice office space, that space must be owned, leased, or rented by the practice and used for the exclusive purpose of operating the practice." It adds that a patient's home "does not include any institution that is a hospital, a CAH, or a SNF." Planning to share a room with a gym, or to rent treatment time in someone else's clinic? Take that sentence to your attorney first.

Supervision in a private practice

The same paragraph sets the supervision rules for Medicare. Services the PT does not perform personally must be performed by employees of the practice, generally supervised by the PT. The eCFR text, up to date as of September 25, 2026, says: "Physical therapy services may be performed by a physical therapist assistant under the general supervision of the physical therapist in private practice; services performed by an unenrolled physical therapist must be under the direct supervision of the physical therapist." Your state practice act has supervision rules of its own. A suggestion: read both, and follow whichever asks more of you.

Timing and upkeep

Apply before your first Medicare patient if you can. APTA's FAQ explains that "a provider can bill Medicare for services rendered up to 30 days prior to the enrollment effective date." It adds that the effective date is usually the later of the date you file and the date you first began seeing patients at the new practice location. So Medicare generally cannot be billed for visits from more than 30 days before you file.

Enrollment needs upkeep. CMS and APTA both say changes of ownership, adverse legal actions and changes of practice location must be reported within 30 days, and all other changes within 90 days. APTA adds that "all providers and suppliers enrolled with Medicare must revalidate their Medicare enrollment every 5 years." Put the revalidation date in the practice calendar the day you are approved.

Enrolling in Original Medicare does not settle how each Medicare Advantage plan, or your state Medicaid program, works with PTs. Ask each one before you see its members.

Credentialing with commercial insurers

Each commercial plan credentials and contracts with providers on its own terms. One shared piece is the profile you keep with CAQH. Its site now says "CAQH is now DataSpring," and it calls the profile tool the CAQH Provider Data Portal. The sign-in page, at proview.caqh.org, still carries the older name, CAQH ProView.

DataSpring sums up the idea: "Enter information once, verify it on a predictable schedule and share it with the plans you designate." It says authorized health plans access the data only for administrative work such as credentialing, enrollment and directory management. The portal is provided "at no cost to clinicians, provider groups, and practices," and the site describes clinician profiles as maintained on a 120-day attestation cycle. A suggestion: put the next attestation date in your calendar each time you complete one.

Here is a suggested way to work through the plans. None of these steps is a payer rule.

Decide which plans you want to join. Look at who your likely patients are insured with, and read each contract's fee schedule and visit rules before you sign.
Have your documents ready before you start: license, NPI, EIN, practice address, liability insurance certificate and your curriculum vitae.
Keep your CAQH profile and NPPES record in step with your Medicare enrollment. A practice address that differs between them invites questions.
Ask each plan in writing from what date you are in network. Until that date, treat the plan as out of network when you talk to its members about cost.
Check what the contract says about charging members for services the plan won't pay for.

For plans you decide not to join, see the out-of-network guide.

HIPAA privacy and security for a small practice

Are you a covered entity?

HIPAA's rules apply to covered entities. For providers, the definition at 45 CFR 160.103 is "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." In plain terms, you are a covered entity if you send claims or other HIPAA standard transactions, such as eligibility checks, electronically. APTA adds that this holds "even if you use a business associate to do so," for example a billing service. If your practice is cash only and never does, ask an attorney before assuming HIPAA does not apply, and check your state's own privacy laws too.

Privacy: a named official and a privacy notice

Under 45 CFR 164.530, "A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity," plus a contact person or office for complaints. In a solo practice that is usually you. The same section requires training for everyone who works for you, as necessary for their role, and keeping your HIPAA documentation for six years. That six-year rule covers HIPAA policies and records of compliance. How long you keep patient records is a separate question for your state.

The Notice of Privacy Practices tells patients how you may use and disclose their health information, what their rights are and what your legal duties are. For a provider who treats patients directly, 45 CFR 164.520 requires you to give the notice by the first date of service. You must also make a good faith effort to get a written acknowledgment that the patient received it, and document why if you could not. Keep it available at the clinic and post it "in a clear and prominent location." If your practice has a website that gives information about its customer services or benefits, the regulation says a covered entity "must prominently post its notice on the web site and make the notice available electronically through the web site."

Security: the risk analysis

The Security Rule protects electronic protected health information (ePHI). The first required step under its security management standard, at 45 CFR 164.308(a)(1)(ii)(A), is risk analysis: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate." You then put in security measures that bring those risks down to a reasonable and appropriate level, and name a security official.

Nobody expects a small practice to build what a hospital builds. Under 45 CFR 164.306(b), you decide which measures to use by weighing, among other things, "The size, complexity, and capabilities" of the practice, its technical setup, the costs of each measure, and how likely and serious each risk is. HealthIT.gov offers a downloadable Security Risk Assessment Tool, made with the HHS Office for Civil Rights, and says it is aimed at "medium and small providers; thus, use of this tool may not be appropriate for larger organizations." The same page warns that using the tool "is neither required by nor guarantees compliance with federal, state or local laws," so treat it as a guide to the analysis, not proof that you did it.

Vendors that handle patient data

Your records system may hold ePHI for you, and so may a billing service or an email host. Under 45 CFR 164.308(b)(1), you may let a business associate handle ePHI on your behalf "only if the covered entity obtains satisfactory assurances" that it will safeguard the information. A suggestion: list every service that touches patient data before you open, and get a business associate agreement from each one that needs it.

Documentation and the plan of care

Every claim you send leans on your notes. They are also your record of the care itself. APTA organizes its documentation resources around the stages of an episode of care: the initial examination and evaluation, visit notes, reexamination, then the summary at the end. For Medicare patients, the plan of care is set in 42 CFR 410.61: "The plan prescribes the type, amount, frequency, and duration of the physical therapy, occupational therapy, or speech-language pathology services to be furnished to the individual, and indicates the diagnosis and anticipated goals."

Have templates ready before you see anyone, and check them against each payer you join. The detail is in these guides:

Physical therapy plan of care: required contents, and the rules for certifying and recertifying it.
SOAP notes: how to write a visit note, with a worked example.
The 8-minute rule: counting units for timed codes.
The KX modifier: the annual Medicare therapy threshold.
Remote therapeutic monitoring: billing for monitoring between visits, if you plan to offer it.

Professional liability and other insurance

Professional liability insurance covers claims about the care you give. Moving from an employer's policy to your own practice? Don't assume the old cover comes with you. Check whether your state board, your payer contracts or your lease set a minimum level of cover, and whether your state ties any practice rule to it. The direct access guide, for example, describes a state that makes liability insurance a condition of treating without a referral.

Beyond that, a suggestion. Ask an insurance broker to look at the whole business: the premises, equipment, staff, cyber risk from patient data, and what happens to claims made after a policy ends. Compare what each policy covers, not just the headline limit.

OSHA rules that can apply to a small clinic

Two OSHA rules are worth knowing from the start.

The first is injury and illness records. Under 29 CFR 1904.1, "If your company had 10 or fewer employees at all times during the last calendar year, you do not need to keep OSHA injury and illness records unless OSHA or the Bureau of Labor Statistics informs you in writing that you must keep records." Separately, appendix A to that subpart lists "Offices of Other Health Practitioners" (NAICS 6213) among the industries partially exempt from keeping those records. Check your practice's NAICS code with your accountant. Either way, 29 CFR 1904.2 says "all employers must report to OSHA any workplace incident that results in an employee's fatality, in-patient hospitalization, amputation, or loss of an eye."

The second is bloodborne pathogens. The standard at 29 CFR 1910.1030 "applies to all occupational exposure to blood or other potentially infectious materials." It defines occupational exposure as contact that is reasonably anticipated from an employee's duties. It does not list physical therapy tasks. Wound care is this guide's own example, not the standard's, of a PT duty where that contact can happen. If anyone you employ has that kind of exposure, the standard says you "shall establish a written Exposure Control Plan designed to eliminate or minimize employee exposure." Read the standard against what your staff actually do to see whether it applies to you.

Good faith estimates for self-pay patients

This matters as soon as any patient pays for their own care. The CMS page for patients puts the No Surprises Act rule like this: "Usually, if you aren't using health insurance to pay for your care, your health care provider must give you a good faith estimate of expected charges if you request one or schedule services at least 3 business days in advance." Under 45 CFR 149.610, you must also ask patients whether they have coverage and whether they want to use it, and tell uninsured and self-pay patients that estimates are available.

The cash-based physical therapy guide goes through the rest: when the estimate is due, what goes in it, estimates that cover a whole course of care, and the dispute threshold. Build your estimate template before you open, along with the notice for your website and front desk.

Policies to write before opening day

Most items below are suggestions. Each one answers a question that tends to come up in the first weeks. Two overlap with the law. For a HIPAA covered entity, 45 CFR 164.308(a)(6) requires policies and procedures to address security incidents, and 45 CFR 164.404 requires you to notify affected patients after a breach of unsecured protected health information "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." Cleaning and infection control also fall under the bloodborne pathogens standard wherever it applies to your staff.

Missed appointments and late cancellations. The cancellation policy guide has wording to adapt.
Your screening questions, and your plan (including who you call) if an answer points to a red flag. See the red flags guide for what to ask.
Your fees and when payment is due, plus how you handle insurance. Put it in writing and give it to every new patient.
A privacy breach plan: who decides, who tells the patient and what gets reported.
Cleaning and infection control between patients.
Marketing, including how you deal with reviews and testimonials. For US advertising rules, and for patient privacy when replying to a review, read the physical therapy marketing guide.

Put a date on each policy, and keep them all somewhere every clinician can find them.

Home exercise programs from the first patient

Between visits, the plan of care lives on in the home exercise program (HEP), which the patient does alone. Write it into the plan with its dose, and make sure the program the patient takes home matches it. For picking the exercises and the dose, see how to write a home exercise program.

PocketPhysio is built for that step. You put the program together from its exercise library, set a dose for each exercise (sets and reps, or how long to hold) and write a cue in the words you use with patients. Every exercise comes with a video, and a spoken voice guide talks the patient through it. Your patient receives it as a link, an SMS or an email, or inside Pocket Physio Care (the app for your patients), and WhatsApp is also possible. Plans for solo PTs and for clinics are priced in the app.

The short version

Starting a physical therapy private practice in the USA begins with your state license and a slow read of your practice act. Choose a business structure with your attorney and accountant, then register it. Get an EIN if the structure or your staff call for one. Apply for your NPI, plus a second one for the practice if it is an organization.

If you will see Original Medicare patients, enroll through PECOS with the CMS-855I, or the CMS-855B for an organization. Meet the private practice rules on office space and supervision, and revalidate every 5 years. Credential with commercial plans through your CAQH profile and each plan's own process.

Before the first patient, name a privacy official and finish a security risk analysis. Every patient gets your Notice of Privacy Practices by the first date of service. Sort out liability insurance and check which OSHA rules apply to you. If anyone will pay for their own care, have the good faith estimate process ready.

References

Federation of State Boards of Physical Therapy. About us. No date shown. Accessed September 29, 2026. https://www.fsbpt.org/About-Us
Federation of State Boards of Physical Therapy. Licensing Authorities Contact Information. No date shown. Accessed September 29, 2026. https://www.fsbpt.org/Free-Resources/Licensing-Authorities-Contact-Information
Federation of State Boards of Physical Therapy. Jurisdiction Licensure Reference Guide. No date shown. Accessed September 29, 2026. https://www.fsbpt.org/Free-Resources/Regulatory-Resources/Licensure-Reference-Guide
Federation of State Boards of Physical Therapy, Ethics and Legislation Committee. Telehealth in Physical Therapy: Policy Recommendations for Appropriate Regulation. November 12, 2014, updated September 2023. Accessed September 29, 2026. https://www.fsbpt.org/Portals/0/documents/free-resources/TelehealthInPhysicalTherapy2023.pdf
Physical Therapy Compact. About. No date shown. Accessed September 29, 2026. https://ptcompact.org/about/
US Small Business Administration. Launch your business (sections: Choose a business structure; Register your business; Apply for licenses and permits). No date shown. Accessed September 29, 2026. https://www.sba.gov/counseling/launch-your-business/
Internal Revenue Service. Employer identification number. Page last reviewed or updated July 17, 2026. Accessed September 29, 2026. https://www.irs.gov/businesses/employer-identification-number
Internal Revenue Service. Get an employer identification number. Page last reviewed or updated August 19, 2026. Accessed September 29, 2026. https://www.irs.gov/businesses/small-businesses-self-employed/get-an-employer-identification-number
Centers for Medicare and Medicaid Services. National Provider Identifier Standard (NPI). Page last modified August 14, 2026. Accessed September 29, 2026. https://www.cms.gov/regulations-and-guidance/administrative-simplification/nationalprovidentstand
Centers for Medicare and Medicaid Services. How to Apply (NPI). Page last modified August 24, 2026. Accessed September 29, 2026. https://www.cms.gov/medicare/regulations-guidance/administrative-simplification/how-apply
Code of Federal Regulations. 45 CFR 162.410, Implementation specifications: Health care providers, paragraph (a). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/162.410
American Physical Therapy Association. National Provider Identifier. No date shown. Accessed September 29, 2026. https://www.apta.org/your-practice/national-provider-identifier
Centers for Medicare and Medicaid Services. Become a Medicare Provider or Supplier. Page last modified June 2, 2026. Accessed September 29, 2026. https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers
Centers for Medicare and Medicaid Services. CMS 855I, Medicare Enrollment Application: Physicians and Non-Physician Practitioners (form page, revision date May 1, 2023). Accessed September 29, 2026. https://www.cms.gov/medicare/cms-forms/cms-forms/cms-forms-items/cms019477
American Physical Therapy Association. Medicare Enrollment: Frequently Asked Questions. Updated March 9, 2026. Accessed September 29, 2026. https://www.apta.org/your-practice/payment/medicare-payment/enrollment/medicare-enrollment-frequently-asked-questions
American Physical Therapy Association. Cash Practice Compliance Issues. No date shown. Accessed September 29, 2026. https://www.apta.org/your-practice/payment/cash-practice/cash-practice-compliance-issues
Code of Federal Regulations. 42 CFR 410.60, Outpatient physical therapy services: Conditions, paragraph (c) (as amended at 89 FR 98556, December 9, 2024). Legal Information Institute, Cornell Law School; text checked against the eCFR, up to date as of September 25, 2026. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/42/410.60
Code of Federal Regulations. 42 CFR 410.61, Plan of treatment requirements for outpatient rehabilitation services, paragraphs (a) to (c). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/42/410.61
DataSpring, powered by CAQH. For Clinicians (CAQH Provider Data Portal). No date shown. Accessed September 29, 2026. https://www.dataspring.com/clinicians
CAQH ProView. Sign-in page. No date shown. Accessed September 29, 2026. https://proview.caqh.org/
Code of Federal Regulations. 45 CFR 160.103, Definitions (covered entity; health care provider). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/160.103
Code of Federal Regulations. 45 CFR 164.520, Notice of privacy practices for protected health information, paragraphs (c)(2) and (c)(3). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/164.520
Code of Federal Regulations. 45 CFR 164.530, Administrative requirements, paragraphs (a)(1), (b)(1) and (j)(2). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/164.530
Code of Federal Regulations. 45 CFR 164.306, Security standards: General rules, paragraph (b). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/164.306
Code of Federal Regulations. 45 CFR 164.308, Administrative safeguards, paragraphs (a)(1)(ii)(A), (a)(1)(ii)(B), (a)(2), (a)(6)(i) and (b)(1). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/164.308
Code of Federal Regulations. 45 CFR 164.404, Notification to individuals, paragraphs (a)(1) and (b). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/164.404
Office of the National Coordinator for Health Information Technology (HealthIT.gov). Security Risk Assessment Tool. Last updated September 18, 2026. Accessed September 29, 2026. https://healthit.gov/privacy-security/security-risk-assessment-tool/
American Physical Therapy Association. Physical Therapy Documentation of Patient and Client Management. No date shown. Accessed September 29, 2026. https://www.apta.org/your-practice/documentation
Code of Federal Regulations. 29 CFR 1904.1, Partial exemption for employers with 10 or fewer employees, paragraph (a)(1). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/29/1904.1
Code of Federal Regulations. 29 CFR 1904.2, Partial exemption for establishments in certain industries, paragraph (a)(1). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/29/1904.2
Code of Federal Regulations. 29 CFR Appendix A to Subpart B of Part 1904, Partially Exempt Industries. Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/29/appendix-A_to_subpart_B_of_part_1904
Code of Federal Regulations. 29 CFR 1910.1030, Bloodborne pathogens, paragraphs (a) and (c)(1)(i). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/29/1910.1030
Centers for Medicare and Medicaid Services. What is a good faith health insurance estimate? Page last modified August 25, 2026. Accessed September 29, 2026. https://www.cms.gov/initiatives/your-patient-rights/medical-bill-rights/get-help/medical-bill-guides-resources/what-good-faith-health-insurance-estimate
Code of Federal Regulations. 45 CFR 149.610, Requirements for provision of good faith estimates of expected charges for uninsured (or self-pay) individuals, paragraph (b)(1). Legal Information Institute, Cornell Law School. Accessed September 29, 2026. https://www.law.cornell.edu/cfr/text/45/149.610

Written and checked by the PocketPhysio editorial team. Last updated 2026-09-29.

How to start a physical therapy private practice