This lesson is the order I would set up a new solo practice in Oregon, from a license in good standing to the day the calendar opens. It is for new LPCs, LMFTs, LCSWs, and registered associates who have finished the paperwork of getting licensed and now face the paperwork of running a practice. The business entity itself (the LLC, the EIN, the bank account) has its own course starting at Oregon LLC, step 1; this checklist covers the clinical and regulatory layer that sits on top of it.
Why the order matters
Several of these items feed each other. The NPI application asks for license details, a payer enrollment asks for the NPI, and the privacy notice names the address you chose when you formed the entity. In sequence, each form gets filled in once.
Before the first client
Confirm your license is active and in good standing. The Board of Licensed Professional Counselors and Therapists (OBLPCT) licenses LPCs, LMFTs, and registered associates. Since 2024, licenses renew every two years, due on the last day of your birth month; odd and even license numbers renew in odd and even years. Registered associates renew annually, on a different schedule from the two-year licensee cycle. Look yourself up in the Mental Health Regulatory Agency verification tool, which covers OBLPCT licensees, and save the result. LCSWs sit under a separate board, the Board of Licensed Social Workers, and its rules live in OAR chapter 877 rather than 833; look up an LCSW on that board's own license lookup instead.
Apply for an NPI. The National Provider Identifier is free, ten digits, and never expires or changes. Apply online through NPPES for an individual (Type 1) NPI. The application help page lists what you need on hand: your name, SSN or ITIN, date and place of birth, mailing and practice addresses with phone numbers, a taxonomy code for your provider type, state license details for some taxonomies, and a contact person.
Put professional liability insurance in place before intake number one. A solo clinician typically carries an individual professional liability (malpractice) policy. The two common shapes are claims-made, which covers claims made while the policy is active, and occurrence, which covers incidents that happened while it was active regardless of when the claim arrives. I am not going to recommend a carrier; the counseling associations' member pages explain the difference, and a broker can quote both.
Write your Professional Disclosure Statement. For OBLPCT licensees and temporary practitioners the rule is OAR 833-075-0050; registered associates fall under OAR 833-050-0031. The statement goes to every client before service begins. The rule, OAR 833-075-0050(1), lists nine required elements: business name, address and phone; philosophy and approach; adherence to the Board's Code of Ethics (OAR 833, division 100); a client bill of rights with every exception to confidentiality spelled out; education and degree; Oregon continuing education and supervision requirements; your fee schedule, including any sliding scale; the Board's website sentence; and the Board's contact details. The Board's PDS page has a sample and a fillable form. Since June 7, 2024 you no longer submit the statement to the Board for approval unless the Board asks for it, per the Board's PDS page. The consequence for skipping it is concrete: a licensee who fails to give the statement may not charge the client a fee.
HIPAA basics
Three documents cover most of what a solo practice needs on day one. None is filed anywhere; each is something an auditor, or a client, can ask to see.
Notice of Privacy Practices
HHS publishes model notices for health care providers in three formats: a layered version with a summary page and the full text, a full-page version, and plain text. The models were updated in February 2026 to add content on substance use disorder records under 42 CFR Part 2, enforceable since February 16, 2026. Using the model is optional; the content requirement is not. The provider guidance page explains what the notice has to say and when you hand it over.
Security Rule risk analysis
HHS's Guidance on Risk Analysis describes a documented risk analysis as the first step in meeting the Security Rule safeguards at 45 CFR 164.302 through 164.318. For a one-person practice this means writing down where electronic health information lives (laptop, phone, EMR, email, fax), what could go wrong, and what you do about it. The free Security Risk Assessment Tool from ONC and OCR was built for small practices and is a reasonable place to start. One caution: a proposed rewrite of the Security Rule was published in the Federal Register on January 6, 2025, and as of September 2026 it has not been finalized, so the current rule still governs; the HHS page on the proposed rule is where to watch for a change.
Business Associate Agreements
Every vendor that touches protected health information on your behalf needs a signed BAA: the EMR, the email host, the eFax service, the scheduling tool, the payment processor. HHS publishes sample BAA provisions that are optional template language, useful mainly as a checklist to compare a vendor's agreement against. Keep a folder of the signed agreements.
Money and records
Build a Good Faith Estimate process for self-pay clients. Under the No Surprises Act, providers must give uninsured or self-pay clients a Good Faith Estimate of expected charges when care is scheduled or when the client asks, a requirement in effect since January 1, 2022 (PHS Act section 2799B-6, 45 CFR 149.610). CMS's No Surprises Act rules page collects the rule text and fact sheets, and CMS offers a sample Good Faith Estimate form. If a final bill comes in $400 or more above the estimate, the client can open a patient-provider dispute, so the estimate is worth getting right.
Set up records that will still exist seven years after the last session. OAR 833-075-0070(1)(a) requires OBLPCT licensees to keep client records "for a minimum of seven years from the date of last service." The same clock applies to a custodian holding a departed colleague's records (OAR 833-075-0080). Records have to be written at the time of service and include progress notes. In practice this is an EMR decision: before committing to a platform, find out how you would export every chart.
| Requirement | LPC and LMFT (OBLPCT) | LCSW (Board of Licensed Social Workers) |
|---|---|---|
| Professional disclosure statement | OAR 833-075-0050; associates OAR 833-050-0031 | I found no equally specific rule; the closest is the ethics chapter at OAR 877-030-0070. Ask the board. |
| Record retention | OAR 833-075-0070: seven years from last service | OAR 877-030-0100(3): seven years from the date of the last session. |
The office layer
Choose a telehealth platform and a consent process. Oregon's telehealth practice standards come from the same licensing boards, not a separate telehealth rule I could find. The platform has to be BAA-covered, and the consent form should cover where the client is during sessions and what happens if the connection drops. The SimplePractice lesson shows how one EMR handles the video side.
Open a dedicated business bank account. Client payments and practice expenses in one place, personal money in another. It keeps the tax return honest and supports the LLC's liability protection.
Set up a business phone number and an eFax line. Payers still send faxes. An eFax number receives them as documents on a BAA-covered service, and a separate business number keeps your personal phone out of the client record.
Put practice email on a platform that will sign a BAA. A free consumer mailbox will not. The paid business tiers of Google Workspace and Microsoft 365 are two common examples; there are others. Sign the BAA before the first client email.
Then open the calendar
Marketing and booking come last on purpose. A directory profile that lands a client before the disclosure statement, the privacy notice, and the Good Faith Estimate exist means the first thing you owe that client is an apology. With the list done, the next lesson walks through the EMR itself: setting up SimplePractice step by step.
None of this is legal, tax, or accounting advice. I wrote down the steps and the pages where I checked them; an attorney or a CPA gets the final word on your situation, and your licensing board gets the final word on its rules.
Further reading
- OBLPCT: Professional Disclosure Statement. The Board's own page on what the statement must contain and the June 2024 change that ended pre-approval.
- OAR 833-075-0070, Client Records. The retention rule in full, including the contemporaneous-notes language that a bare "seven years" summary leaves out.
- NPPES NPI application help. Read it once before starting so the form takes twenty minutes, not two days.
- HHS: Guidance on Risk Analysis. HHS's explanation of why the risk analysis comes first, with the pointer to the free SRA Tool.
- HHS: Sample Business Associate Agreement Provisions. Template language to hold a vendor's BAA up against.
- CMS: No Surprises Act rules and fact sheets. The index of rule text, fact sheets, and the sample Good Faith Estimate form.
- APA Private Practice HIPAA checklist. A free checklist of what HHS looks for in a compliance program, useful as a second pass.