Sell Your Healthcare Business

Buyers conduct exhaustive regulatory diligence. Any arrangement that could be construed as a referral payment — provider compensation, lease arrangements, management fees — must comply with Stark and AKS safe harbors. Engage healthcare regulatory counsel to conduct a pre-sale compliance audit. Known violations, even technical ones, can kill deals or trigger massive indemnification demands.

Medicare provider numbers and billing privileges are assigned to entities, not individuals, but change-of-ownership (CHOW) applications require CMS approval that can take 60–120 days. Begin the CHOW analysis early. Some states require separate Medicaid enrollment applications. Provider enrollment gaps during transition can result in denied claims and revenue interruption.

Every revenue-generating provider must have a current, enforceable employment agreement with non-compete, non-solicitation, and assignment-of-patient-relationship provisions. FTC non-compete scrutiny is evolving — ensure agreements comply with current federal and state requirements. Missing or expired provider agreements are among the most common diligence deal-breakers in healthcare M&A.

Payer credentialing timelines (30–180 days) and enrollment status for each provider must be documented. Any provider practicing without current credentialing creates compliance exposure. Build a comprehensive credentialing matrix showing every provider's status with every payer — buyers will request this within the first week of diligence.

Document your clinical governance structure, peer review processes, quality metrics, and outcome data. Buyers increasingly require evidence of clinical quality beyond financial performance. CMS star ratings, patient satisfaction scores, readmission rates, and clinical outcome benchmarks by service line are standard diligence requests.

A documented HIPAA compliance program with current risk assessments, BAAs, breach notification procedures, and employee training records is expected. Any history of data breaches, OCR complaints, or HIPAA violations will surface in diligence and impact valuation. For health IT companies, SOC 2 Type II certification and penetration testing results are standard buyer requirements.