Compliance Checklist for New Optometry Practices: What You Cannot Skip

2026-08-21

A practical compliance checklist for new optometry practices covering licensing, HIPAA, OSHA, billing, and more. Avoid fines and legal issues.

Starting an optometry practice involves more than buying equipment and hiring staff. You must meet federal and state compliance requirements from day one. Missing these steps can lead to fines, audits, or even loss of your license. This checklist covers the non-negotiable items every new practice must address, with realistic costs and concrete actions you can take this week.

1. Business and Professional Licensing

Your first priority is legal authorization to operate. This includes both your professional license and your business registration.

State optometry license: Verify your license is active and current in the state where you practice. Fees range from $100 to $500 per year.
Business entity registration: Register your practice as an LLC, PC, or other structure with your state’s Secretary of State. Costs are typically $50 to $200.
Tax ID numbers: Obtain an Employer Identification Number (EIN) from the IRS. It’s free and takes about 10 minutes online.
State tax registration: Register for state sales tax and employer taxes. This is often done through your state’s revenue department.

Action this week: Check your state’s optometry board website for license renewal dates and any new requirements. File your business entity registration if you haven’t already.

2. HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) applies to all practices that handle protected health information (PHI). Noncompliance can result in fines from $100 to $50,000 per violation.

Privacy Officer: Designate someone responsible for HIPAA compliance. This can be you or a staff member.
Privacy and Security Policies: Write and implement policies for patient privacy, data security, and breach notification. Templates are available from professional associations.
Business Associate Agreements (BAAs): Sign BAAs with any vendor that handles PHI, such as billing services, EHR providers, or cloud storage. This includes your practice management software.
Staff Training: Train all employees on HIPAA basics, including how to handle patient information and what to do in a breach. Training should occur at hire and annually.
Risk Assessment: Conduct a security risk assessment to identify vulnerabilities in your systems. This is required by HIPAA and should be updated regularly.

Action this week: Download a HIPAA policy template from the HHS website or your state association. Schedule a staff training session for next week.

3. OSHA and Workplace Safety

The Occupational Safety and Health Administration (OSHA) sets standards for workplace safety, including bloodborne pathogens and hazard communication.

Bloodborne Pathogen Plan: If you perform any procedures that could expose staff to blood (e.g., minor surgeries), you need a written plan. This includes training, hepatitis B vaccination offers, and personal protective equipment.
Hazard Communication: Maintain a list of hazardous chemicals in your office (e.g., cleaning agents, disinfectants). Provide Safety Data Sheets (SDS) and train staff on proper handling.
Emergency Action Plan: Have a written plan for fires, medical emergencies, and natural disasters. Conduct regular drills.
OSHA Training: Train staff on relevant OSHA standards. This can be done in-house or through online courses.

Action this week: Review your office for potential hazards. Create a simple hazard communication binder with SDS sheets for all chemicals.

4. Medicare and Payer Enrollment

If you plan to bill Medicare or private insurers, you must enroll and meet their requirements.

Medicare Enrollment: Apply through the Medicare Administrative Contractor (MAC) for your state. This can take 60 to 90 days, so start early. You’ll need your NPI, license, and practice address.
NPI Number: Obtain a National Provider Identifier (NPI) if you haven’t already. It’s free and required for all billing.
Credentialing with Private Insurers: Each insurance company has its own application process. Expect fees of $0 to $500 per payer. Start with the major insurers in your area.
Compliance with Billing Rules: Understand coding and documentation requirements for optometry services. Incorrect billing can lead to audits and recoupment.

Action this week: Apply for your NPI if you don’t have it. Begin the Medicare enrollment process immediately, as it’s the longest lead time.

5. State-Specific Requirements

Each state has unique rules for optometry practices. These may include:

Prescription requirements: Some states require specific formats for eyeglass and contact lens prescriptions.
Scope of practice: Know what procedures you’re allowed to perform (e.g., laser surgery, minor procedures).
Continuing education: Track CE credits required for license renewal. Most states require 10 to 30 hours per year.
Patient record retention: State laws dictate how long you must keep patient records, typically 5 to 7 years.

Action this week: Visit your state optometry board’s website. Print out the scope of practice and CE requirements. Post them in your office for reference.

6. Data Security and Cybersecurity

With EHR systems, you’re responsible for protecting patient data from cyber threats.

EHR Security: Use a certified EHR with encryption and access controls. Conduct regular backups.
Firewall and Antivirus: Install and update security software on all devices.
Password Policies: Require strong passwords and two-factor authentication for all systems.
Breach Response Plan: Have a written plan for responding to a data breach, including notifying patients and the HHS as required.

Action this week: Change all default passwords. Enable two-factor authentication on your email and EHR. Set up automatic backups.

7. Employment and HR Compliance

If you have staff, you must comply with employment laws.

I-9 Forms: Verify eligibility to work in the U.S. for every employee.
Payroll Taxes: Register with the IRS and state for payroll tax withholding.
Workers’ Compensation: Carry workers’ comp insurance if required by your state. Costs vary by state and staff size.
Poster Requirements: Display required labor law posters (e.g., minimum wage, OSHA, FMLA) in a visible area.

Action this week: Create an employee handbook with basic policies. Purchase workers’ comp insurance if you haven’t yet.

8. Insurance and Liability Coverage

Professional liability insurance is not just a good idea; it’s often required by state law or hospital privileges.

Malpractice Insurance: Covers patient lawsuits. Premiums range from $2,000 to $10,000 per year for optometrists, depending on location and coverage limits.
General Liability: Covers slip-and-fall accidents in your office. Expect $500 to $1,500 per year.
Property Insurance: Protects your equipment and office space. Costs depend on your location and coverage.
Cyber Liability: Optional but recommended. Costs $500 to $2,000 per year.

Action this week: Get quotes from at least three insurance brokers. Compare coverage and prices before choosing.

FAQ

Q: How much does it cost to become HIPAA compliant? A: Costs vary. You can do it yourself for under $500 using templates and free training. Hiring a consultant can cost $2,000 to $5,000.

Q: Do I need a compliance officer? A: For a small practice, you can assign this role to yourself or a trusted staff member. Larger practices may need a dedicated officer.

Q: What happens if I don’t comply? A: Penalties include fines, loss of payer contracts, and legal action. In severe cases, you could lose your license.

Q: How often should I update my compliance policies? A: Review policies at least annually or when regulations change. Also update after any incident.

The Bottom Line

Compliance is not optional. Start with the essentials: licenses, HIPAA, OSHA, payer enrollment, and insurance. Use this checklist to create a compliance calendar. Set reminders for renewals and training. If you’re overwhelmed, consider hiring a compliance consultant for a one-time review. The cost is far less than the penalties for noncompliance. Take one action this week, and build from there.