How to Start a Home Health Care Agency: Medicare Certification (42 CFR Part 484), State License, HIPAA, Anti-Kickback & Startup Costs (2026 Guide)

Not legal advice. Requirements may change — always verify with your local government authority before applying. Last verified: April 13, 2026.

The quick answer

1State home health agency license — required first, before Medicare certification can begin. Issued by the state department of health. Fees $300–$3,000.
2Medicare certification (42 CFR Part 484) — federal Conditions of Participation survey required to bill Medicare Part A. Submit Form CMS-855A via PECOS. Typically 6–12 months total from state license to active Medicare billing.
3HIPAA compliance (45 CFR Parts 160/164) — home health agencies are covered entities. Required privacy and security programs, Business Associate Agreements with all PHI-handling vendors.
4Anti-Kickback Statute (42 USC §1320a-7b) — prohibits paying for referrals. All marketing and physician relationships must be structured to avoid per-referral compensation.
5Surety bond — $50,000 minimum required for Medicare enrollment. Insurance: professional liability $1M–$3M; workers’ comp mandatory for all employees. Startup costs: $50,000–$250,000.

1. State home health agency license

The state home health agency license is the foundational credential. Without it, you cannot legally operate or pursue Medicare certification. State agencies in each state have their own application, inspection, and approval process.

State licensing by major state

Issued by: State department of health Typical fee: $300–$3,000 Timeline: 30–120 days (varies widely)

California (CDPH): Home Health Agency license issued by the California Department of Public Health. Application includes financial statements, organizational chart, administrator and Director of Nursing qualifications, policies and procedures, and office site inspection. Fee: $2,050. CON not required.
Texas (HHSC): Home and Community Support Services Agency (HCSSA) license issued by Texas Health and Human Services Commission. Separate license categories: Type A (skilled nursing + other licensed professional services), Type B (personal assistance services). License fee: $2,534 for Type A. No CON requirement.
Florida (AHCA): Home Health Agency license issued by Agency for Health Care Administration. CON required for Medicare-certified agencies. Standard license fee: $1,900–$2,900 depending on employee count. Initial licensure survey required.
New York (DOH): Certified Home Health Agency (CHHA) or Licensed Home Care Services Agency (LHCSA) license via NYSDOH. CON required for CHHAs. LHCSA (personal care only) has lower regulatory burden. CHHA application fee: $1,000.

Business entity, EIN, and NPI registration

Entity: LLC or corporation via state secretary of state EIN: IRS Form SS-4 or IRS.gov (free) NPI: NPPES at nppes.cms.hhs.gov (free, 1–5 days)

Form the legal entity and obtain the EIN before applying for the state license — the license application requires a business entity name, EIN, and owner/officer information. Obtain the NPI Type 2 (organizational) early — it is required on the CMS-855A Medicare enrollment application. Individual clinical staff (RNs, PTs, etc.) each need NPI Type 1. NPI registration is free and processes in 1–5 business days via NPPES.

Certificate of Need (CON) states

Required in: FL, GA, IL, MD, NY (CHHA), VA and several others Review timeline: 6–18 months Not required in: CA, TX, AZ, CO, PA, OH, and most other states

CON laws require state approval demonstrating an unmet community need before a new home health agency can be licensed. In Florida, AHCA administers CON reviews for Medicare-certified HHAs — existing agencies routinely challenge new CON applications, extending the process. If you are considering a CON state, add 12–24 months to your regulatory timeline and budget $15,000–$50,000 for CON application preparation, including health planning data, financial projections, and legal representation.

2. Medicare certification and Conditions of Participation (42 CFR Part 484)

Medicare certification is governed by CMS and enforced by your state survey agency. It is a separate, more demanding process than state licensure and is required to bill Medicare Part A for skilled home health services.

Form CMS-855A enrollment via PECOS

Form: CMS-855A Submit via: PECOS (pecos.cms.hhs.gov) MAC: Your Medicare Administrative Contractor processes the application

After obtaining your state license, submit the CMS-855A through PECOS. PECOS routes the application to your Medicare Administrative Contractor (MAC) — the regional CMS contractor that processes Medicare enrollment for your geographic area (e.g., Palmetto GBA for the Southeast, CGS Administrators for the Midwest, Noridian for the West). Required information: NPI Type 2, EIN, state license number, physical office address, owner/officer information (all of whom undergo OIG exclusion and background checks), and Medicare surety bond documentation. CMS enrollment processing: 45–90 days.

Conditions of Participation — key operational requirements

Regulatory citation: 42 CFR Part 484 Enforced through: State survey agency under CMS contract

Patient rights (§484.10): Written notice of rights before or at start of care, including right to participate in care planning, right to privacy, right to voice grievances without fear of discrimination or reprisal.
Governance (§484.105): Active governing body with full legal authority over operations. Must include at least one professional member with expertise in home health services. Governing body appoints the administrator and establishes written policies.
Comprehensive assessment / OASIS (§484.55): RN-conducted OASIS (Outcome and Assessment Information Set) assessment within 5 calendar days of start of care. OASIS data transmitted electronically to CMS via iQIES. OASIS drives payment under the Patient-Driven Groupings Model (PDGM) and generates public quality scores on Care Compare.
Care planning (§484.60): Written plan of care signed by physician or allowed practitioner, reviewed and updated at minimum every 60 days or with any change in patient condition.
Home health aide supervision (§484.36): RN supervisory visit to patient’s home to observe aide performance at least every 14 days when patient is also receiving skilled care.
QAPI (§484.65): Written Quality Assessment and Performance Improvement program with ongoing data collection, outcome analysis, and documented corrective action for identified problems. Must include tracking of adverse events and hospitalizations.
Infection control (§484.70): Written infection control program, PPE availability and training, documented flu and Hep B vaccination programs for staff with occupational exposure.
Emergency preparedness (§484.102): Written emergency preparedness plan updated annually, tested with drills, coordinated with local emergency management agencies.

Accreditation in lieu of state survey (deemed status)

Accreditors: ACHC, CHAP, The Joint Commission (TJC) Initial cost: $3,000–$10,000 Renewal: Every 3 years

CMS grants “deemed status” to HHAs accredited by CMS-approved accrediting organizations. Accreditation in lieu of state survey is available in most states. Accreditors (ACHC, CHAP, TJC) tend to be more consultative than state surveyors and often schedule faster than state survey queues in backlogged states. Accreditation also signals quality to hospital discharge planners and physician referral sources. Many hospital systems “preferred provider” lists require accreditation. Factor the 3-year accreditation fee into your operating budget as an ongoing cost.

Form your business entity

Before applying for permits, you need a registered business. LegalZoom makes LLC formation fast and simple.

Form your LLC with LegalZoom →

Affiliate disclosure · no extra cost to you

3. HIPAA compliance — Privacy Rule, Security Rule, and Breach Notification

Home health agencies are covered entities under HIPAA (45 CFR Parts 160 and 164). Every caregiver who enters a patient’s home handles protected health information (PHI) — diagnoses, medication lists, care plans, clinical notes. HIPAA compliance is not optional and is a CoP compliance element.

HIPAA Privacy Rule (45 CFR Part 164, Subpart E)

Requires: (1) Notice of Privacy Practices delivered to each patient at start of care and posted at your office; (2) written policies governing use and disclosure of PHI; (3) minimum necessary standard — staff may only access the PHI they need to perform their job; (4) patient right to access their own records within 30 days of request; (5) Business Associate Agreements (BAAs) with every vendor who receives, creates, or transmits PHI on your behalf — including your EHR vendor, billing service, cloud storage provider, and IT support firm.

HIPAA Security Rule (45 CFR Part 164, Subpart C)

Governs electronic PHI (ePHI). Requires: (1) written Security Risk Analysis identifying all ePHI you create, receive, maintain, or transmit and the risks to its confidentiality, integrity, and availability; (2) risk management plan addressing identified risks; (3) access controls so only authorized users can access ePHI systems; (4) audit logs on EHR and email systems; (5) encryption of ePHI in transit and at rest; (6) device and media disposal policies (wiping phones and laptops before disposal or reuse). The Security Risk Analysis is the most commonly cited HIPAA deficiency in OCR enforcement actions — do this before going live.

Breach Notification Rule (45 CFR Part 164, Subpart D)

If a breach of unsecured PHI occurs, the agency must notify: (1) affected individuals within 60 days of discovery; (2) HHS Office for Civil Rights via the HHS breach reporting portal; (3) if the breach affects 500 or more individuals in a state or jurisdiction, prominent media outlets in that state must also be notified. Establish a written breach response procedure before operations begin — including who is responsible for investigating suspected breaches, how notifications are sent, and how the incident is documented.

4. OSHA bloodborne pathogens, TB screening, and worker safety

Home health workers face occupational exposure to blood and other potentially infectious materials in patient homes. OSHA’s Bloodborne Pathogens Standard (29 CFR 1910.1030) is a mandatory federal requirement for all home health agencies.

OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030)

Applies to: All employees with occupational exposure to blood or OPIM Annual penalty for violations: Up to $16,131 per serious violation

Written Exposure Control Plan: Documents all job classifications with occupational exposure, engineering controls, work practices, PPE, housekeeping procedures, and post-exposure evaluation protocol. Must be updated annually and whenever job tasks change.
Hepatitis B vaccination: Must be offered at no cost to all employees with occupational exposure within 10 working days of initial assignment. Employees who decline must sign a declination form (OSHA-prescribed language).
PPE: Gloves, gowns, face protection as appropriate for tasks involving blood or OPIM. Must be provided at no cost to employees.
Annual training: All employees with potential occupational exposure must receive annual bloodborne pathogen training. Training must include how the disease is transmitted, what PPE to use, and post-exposure protocol. Document training dates and content.
Post-exposure follow-up: If a needlestick or other exposure occurs, the agency must provide confidential medical evaluation and follow-up at no cost to the employee, including source patient testing (with consent) and appropriate prophylaxis.

TB screening requirements

Medicare Conditions of Participation and most state home health agency licensing requirements mandate TB screening for all clinical staff. Standard requirements: two-step TB test (TST) or IGRA blood test at hire, annual TB symptom screening thereafter. Staff with positive TB test results must have chest X-ray clearance and evidence of non-infectious status before beginning patient contact. Document TB test results in every employee personnel file — surveyors review these during both state and federal surveys.

5. Anti-Kickback Statute, Stark Law, and OIG compliance program

Federal fraud and abuse laws create the most significant legal liability exposure for home health agencies beyond the licensing requirements. Violations can result in exclusion from Medicare and Medicaid — effectively ending the business.

Anti-Kickback Statute (42 USC §1320a-7b(b))

Prohibits offering, paying, soliciting, or receiving anything of value to induce or reward referrals of items or services covered by federal healthcare programs. Violations are felonies with criminal penalties up to $100,000 per violation and program exclusion. High-risk arrangements for home health agencies:

— Paying marketers or patient recruiters a per-admission or per-referral commission.
— Providing free discharge planning staffing, office supplies, or other in-kind benefits to hospitals or physician offices as a quid pro quo for referrals.
— Paying physicians, nurse practitioners, or other practitioners for referring or influencing referrals.
— Gifts or meals to referral sources exceeding $15 per item or $75 per year per individual.

Safe harbors exist for employment arrangements, personal services agreements at fair market value, and small entity investment, but must be carefully structured with healthcare attorney guidance.

Stark Law (42 USC §1395nn)

Prohibits physicians from referring Medicare patients for designated health services — including home health services — to entities with which the physician or an immediate family member has a financial relationship, unless a specific statutory exception applies. Stark is a strict liability statute: intent is irrelevant, and violations result in denial of Medicare claims, civil monetary penalties of $15,000–$26,000 per claim, and potential exclusion. Any physician investor or ownership arrangement must be reviewed by a healthcare attorney and structured under a specific Stark exception before finalizing the ownership structure.

OIG compliance program

The HHS OIG published specific Compliance Program Guidance for Home Health Agencies (1998, updated guidance available at oig.hhs.gov). While voluntary for small agencies, an OIG compliance program is essentially required as a practical matter for Medicare certification and referral source contracting. A basic compliance program includes: (1) written compliance policies and standards of conduct; (2) designated compliance officer or contact; (3) annual compliance training for all staff; (4) confidential reporting mechanism for suspected violations; (5) monthly OIG LEIE exclusion screening for all employees and contractors; (6) annual internal auditing of billing practices and documentation. The OIG LEIE database is searchable at exclusions.oig.hhs.gov — check every employee at hire and monthly thereafter.

6. Background checks and caregiver credentialing

Background screening for home health workers is among the most regulated in any industry. Multiple overlapping federal and state requirements apply.

Required background check components

Cost per employee: $30–$100 Timing: Before client-facing work begins in most states

State criminal history check: Through state criminal justice information system. Scope and lookback period vary by state.
FBI fingerprint-based federal criminal history check: Required in most states for disqualifying offense categories. Must use a state-approved Channeler (e.g., Fieldprint, IdentoGO).
State abuse/neglect registry check: Also called the Health Care Worker Registry or Nurse Aide Registry. Workers with substantiated abuse or neglect findings are listed and cannot be employed in home health.
Sex offender registry check: Required in most states. Some states require checks across multiple state registries if the employee has lived in multiple states.
OIG LEIE exclusion check: Required at hire and monthly thereafter. Employing a Medicare-excluded individual triggers civil monetary penalties against the agency.

Clinical staff credentialing

Verify and document for all clinical staff: current state license in good standing (RN, LPN, PT, OT, SLP, MSW, HHA certification), current CPR/BLS certification, TB test results, professional liability insurance (if independent contractors), malpractice claims history, and DEA registration for any providers prescribing controlled substances. Primary source verification (direct verification with state licensing board) is required — photocopies of licenses are not sufficient. Many home health EHR systems include credential tracking modules that alert you to upcoming license expirations.

7. Home health aide (HHA) training and certification requirements

Federal Medicare regulations set a floor for home health aide training. Many states impose significantly higher requirements. Meeting the federal minimums does not guarantee state compliance.

Federal minimum training requirements (42 CFR 484.36)

75 hours minimum training: At least 16 hours of classroom and laboratory instruction before any supervised practical training begins.
16 hours minimum supervised practical training: Under the direct supervision of an RN or other qualified health professional during which the aide practices the required skill competencies.
13 competency skill areas: Must be demonstrated in each area: patient rights, infection control, basic body functioning, safe/clean home environment, emergency recognition, physical/emotional/developmental needs of patients (including dementia), basic nutrition, temperature/pulse/respiration measurement, basic safety, personal hygiene, safe transfer techniques, and skin care.
RN supervisory visits every 14 days: For patients receiving skilled services, an RN must make an in-home visit to observe and evaluate aide performance at least every 14 days.
12 hours continuing education annually: Required for all Medicare-certified HHAs on an ongoing basis.

State HHA certification requirements

Most states have their own HHA certification program, typically requiring completion of a state-approved training program (often 120–150 hours in California and New York, versus the 75-hour federal floor), passage of a state competency examination (written and manual skills), and registration on the state Nurse Aide or Home Health Aide Registry. In California, home health aides must be certified HHAs (HHA certification issued by CDPH) or hold a higher clinical credential. In New York, aides working for CHHAs must complete a 75-hour HHA training program approved by NYSDOH. Verify your specific state’s current requirements with the state department of health before hiring aides.

8. Medicaid enrollment and dual-eligible patient services

Many home health patients are “dual eligible” — they qualify for both Medicare and Medicaid. Serving dual-eligible patients requires state Medicaid enrollment, which is a separate process from Medicare certification.

State Medicaid home health enrollment

Each state administers its own Medicaid program and requires home health agencies to enroll separately to bill state Medicaid. Enrollment typically requires: active state HHA license, Medicare certification (most but not all states), NPI Type 2, completed state Medicaid provider enrollment application, background checks on owners/officers, and in some states a Medicaid-specific survey. Medicaid enrollment processing: 60–180 days depending on state. Some states have provider enrollment moratoria in certain geographic areas — meaning they are not accepting new Medicaid home health provider applications due to perceived program saturation.

Electronic Visit Verification (EVV)

Required for: Medicaid-funded personal care and home health visits Federal mandate: 21st Century Cures Act (2016) Enforcement: States risk federal Medicaid match reduction for non-compliance

EVV systems electronically record the type of service, individual providing the service, patient receiving the service, location of service delivery, date and time the service begins and ends. Required for all Medicaid-funded personal care services (since Jan 2020) and home health care services (since Jan 2023). Most home health EHR systems have integrated EVV modules. States either operate a state EVV system (provider uses the state system) or allow open systems (provider uses a state-approved third-party EVV). Confirm with your state Medicaid agency which EVV model applies in your state before selecting technology.

9. Insurance requirements and Medicare surety bond

Medicare enrollment surety bond

Minimum bond amount: $50,000 Required by: CMS as condition of Medicare enrollment Annual premium: $500–$2,500 (0.5%–2.5% of bond amount)

CMS requires all home health agencies enrolling in Medicare to post a surety bond as a condition of enrollment. The minimum bond amount is $50,000 for new agencies with annual Medicare billings under $500,000; the required bond amount increases with billing volume. The bond protects CMS against overpayments that the agency fails to repay. The bond must be obtained from a surety company listed on the Treasury Department’s list of certified companies (circular 570). Include bond premium in your annual insurance budget.

Insurance type	Minimum coverage	Annual premium (new agency)
Professional liability (malpractice)	$1M/$3M (state minimum); $2M/$4M (hospital referral requirement)	$4,000–$10,000/year
General liability (CGL)	$1M/$2M (most states)	$2,000–$5,000/year
Workers’ compensation	Statutory limits (varies by state)	$6,000–$18,000/year (10–20 staff)
Cyber liability	$1M (recommended)	$2,000–$6,000/year
Commercial auto (non-owned)	$1M CSL	$1,500–$4,000/year
Medicare surety bond	$50,000 minimum	$500–$2,500/year

10. Full startup cost breakdown

Realistic startup costs for a Medicare-certified home health agency range from $120,000 to $350,000 in the first year. Here is the full breakdown:

Item	Typical cost	Notes
State home health agency license	$300–$3,000	Varies by state; CON states add $15K–$50K in legal/application costs
Business entity formation + EIN	$100–$800	LLC or corporation; attorney review recommended for healthcare entities
Medicare certification (accreditation path)	$3,000–$10,000	ACHC, CHAP, or TJC; no application fee for state survey path
Background checks (initial hires)	$3,000–$10,000	$30–$100 per employee; plan for 30–100 initial hires
All insurance (year 1)	$16,000–$45,000	Professional liability + CGL + workers’ comp + cyber + auto + surety bond
Home health EHR + EVV + billing software	$12,000–$50,000/year	Required for OASIS submission and Medicaid EVV compliance
Office space + equipment + supplies	$15,000–$40,000/year	Physical office required for licensing; clinical supply inventory
Healthcare attorney (Stark, AKS, entity structure)	$5,000–$15,000	Essential for physician ownership review and AKS-compliant marketing agreements
Policy manual + compliance program development	$5,000–$15,000	Must be customized to your state and operations; cannot use template binders
Working capital (3–6 months pre-Medicare billing)	$75,000–$200,000	PDGM pays in arrears; budget payroll before first Medicare check arrives

Total realistic first-year investment for a Medicare-certified HHA with 15–30 patients: $120,000–$350,000. Non-medical personal care agencies (no Medicare certification) can launch for significantly less: $20,000–$60,000 in most states.

11. Medicare-certified HHA vs. non-medical home care — which do you need?

This is the most important definitional choice before you start. It determines your entire licensing burden, staffing model, and revenue potential.

Medicare-certified Home Health Agency

✓ Skilled nursing, PT, OT, speech therapy, MSW
✓ Wound care, IV therapy, medication management
✓ Bills Medicare Part A, Medicaid, commercial insurance
✓ Highest revenue potential ($3,000–$7,000 per 30-day episode)
✓ Physician order required; RN-supervised care
⚠ Heavy regulation: CoPs, OASIS, QAPI, full HIPAA
⚠ $120K–$350K startup; 9–15 months to first Medicare bill

Non-Medical Home Care Agency

✓ ADL assistance: bathing, dressing, grooming, meals
✓ Companionship, housekeeping, transportation, med reminders
✓ Private pay, long-term care insurance, VA, some Medicaid waivers
✓ Lower regulatory burden; no Medicare certification needed
✓ $20K–$60K startup in most states
⚠ Medicare does not cover custodial/non-skilled care
⚠ Lower reimbursement rates ($18–$35/hour private pay)

Some owners operate both models under separate legal entities — a state-licensed, Medicare-certified home health agency for skilled services, and a separate non-medical personal care agency for custodial services. This structure allows full-spectrum service delivery but requires separate licenses, separate billing systems, and careful segregation of staff and records between the entities.

12. Critical mistakes that kill new home health agencies

Underestimating the Medicare certification timeline

Most new HHA owners budget 90 days from state licensure to first Medicare bill. The real timeline is 9–15 months. State survey agencies in many states are running 3–5 months behind on initial certification surveys. You need active patient episodes before a survey can occur. Add potential deficiencies and plans of correction. Then PDGM payment is in arrears. Financial models assuming Medicare revenue within 60 days are almost universally wrong and are the leading cause of new HHA cash flow failures.

AKS violations in marketing agreements

Paying a community liaison, hospital marketer, or patient recruiter a per-admission fee or percentage of billings from patients they refer is an Anti-Kickback Statute violation — even if the payments are small and both parties had good intentions. All marketing staff must be compensated at fair market value on a flat salary or time-based basis, with compensation not contingent on referral volume. This is one of the most common enforcement actions against home health agencies.

Template policy manuals not customized to your agency

Surveyors see template policy manuals constantly. An agency that submits a template without customizing it to reflect actual operations — your specific staffing patterns, your geographic service area, your clinical capabilities — will fail the survey. Policies must be living documents that staff reference and use, not a compliance exercise for the initial survey. Budget $5,000–$15,000 for custom policy development.

Missing monthly OIG exclusion screening

Employing a Medicare-excluded individual — even unknowingly — triggers civil monetary penalties against the agency and potentially the agency’s own exclusion from Medicare. The OIG LEIE check at hire is well-known. The monthly re-screening of all current employees is frequently missed. Use an automated monthly screening service ($20–$100/month) — a single penalty avoidance easily justifies the annual cost.

Inadequate OASIS documentation before the survey

The initial certification survey reviews the OASIS assessments and clinical records of your active patients. Incomplete, late, or clinically inaccurate OASIS documentation is a condition-level deficiency risk. OASIS must be completed by a qualified RN within 5 calendar days of start of care — not 6 days, not 10 days. Clinical notes must accurately reflect patient status at assessment. Train your clinical staff on OASIS accuracy before serving your first patient.

Frequently asked questions

What licenses does a home health care agency need?

Home health care agencies face one of the most demanding licensing stacks of any small business. Here is the complete list: 1. State home health agency license: Required in virtually all states to operate as a home health agency providing skilled or personal care services. Issued by the state department of health (or equivalent — CDPH in California, HHSC in Texas, AHCA in Florida, DOH in New York). The application requires proof of financial solvency, a governing board, written policies and procedures, qualified clinical staff, and in many states an initial on-site inspection before licensure is granted. Fees range from $300 to $3,000 depending on state. 2. Medicare certification (Form CMS-855A): Required to bill Medicare Part A for skilled home health services (skilled nursing, PT, OT, speech therapy, home health aide services, MSW). Certification requires passing a state survey verifying compliance with 42 CFR Part 484 Conditions of Participation. Cannot bill Medicare until certification is granted. 3. State Medicaid enrollment: Separate from Medicare certification. Required to bill Medicaid for dual-eligible patients and for state waiver programs covering home and community-based services. Some states require a separate Medicaid survey in addition to the Medicare survey. 4. Business entity registration: LLC, corporation, or partnership with the state secretary of state. Some states require home health agencies to be organized as specific entity types. $100–$800. 5. Federal Employer Identification Number (EIN): Required for payroll, tax filing, and all federal program enrollment. Free via IRS.gov Form SS-4. 6. NPI Type 1 (individual clinical staff) and NPI Type 2 (agency organization): Both required for Medicare/Medicaid billing. Free via NPPES (nppes.cms.hhs.gov). 7. General business license: City or county license required by most municipalities. 8. Workers’ compensation insurance: Required by law for all employees in all states. 9. Professional/general liability insurance: $1M–$3M per occurrence required by most referral sources and state regulators. 10. OSHA bloodborne pathogen compliance program: Written Exposure Control Plan, Hep B vaccination program, PPE, annual training — required under 29 CFR 1910.1030. 11. HIPAA compliance program: Home health agencies are covered entities under HIPAA (45 CFR Parts 160/164). Requires Notice of Privacy Practices, Business Associate Agreements with EHR/billing vendors, breach notification protocol, and security safeguards for electronic PHI. 12. OIG compliance program: While voluntary for small agencies, the OIG strongly recommends a written compliance program. Required as a practical matter to pass Medicare surveys and maintain referral relationships.

State home health agency license vs. Medicare certification — what is the difference?

These are two entirely separate regulatory processes run by different agencies. Both are required if you plan to bill Medicare. State home health agency license: — Issued by: State department of health (CDPH in CA, HHSC in TX, AHCA in FL, DOH in NY, etc.). — Authorizes you to: Operate as a home health agency in that state and provide services to any patients — private pay, commercial insurance, Medicaid, and ultimately Medicare. — Survey: Many states require an initial on-site survey of your office, policies, and clinical records before issuing the initial license. — Sequence: Get this first. Medicare certification cannot proceed without an active state license. Medicare certification: — Issued by: CMS through the state survey agency (which operates under a CMS contract). — Authorizes you to: Bill Medicare Part A for covered home health services. — Survey: The state survey agency conducts an initial certification survey reviewing patient records, policies, clinical staff credentials, OASIS documentation, and sometimes observing care delivery in a patient’s home. This is a thorough clinical compliance inspection. — Sequence: Comes after state licensure and after you have served at least 2–3 active patients whose records can be reviewed. Key practical point: You can legally operate and serve private-pay clients with just the state license. Medicare certification is required specifically to bill Medicare Part A. The federal Conditions of Participation framework is more demanding than most state licensing requirements and requires ongoing operational compliance, not just initial setup.

How long does Medicare certification take for a new home health agency?

Medicare certification for a new home health agency typically takes 3–6 months after state licensure, but real-world timelines in 2026 are often 9–12 months total from starting the state license application to receiving first Medicare payment. Here is the process step by step: 1. Obtain state home health agency license: 30–90 days depending on state. Some states (CA, FL, NY) have multi-month backlogs for initial license applications. 2. Begin serving patients (private pay): CMS requires active patient episodes before the initial certification survey can occur. Build a census of 2–5 active patients with complete OASIS documentation and physician-signed plans of care. 3. Submit CMS-855A enrollment application via PECOS: CMS processes the enrollment application and issues a preliminary certification identification number. CMS enrollment processing: 45–60 days. 4. State survey agency schedules initial certification survey: Survey scheduling timelines vary by state — many state survey offices are running 2–4 months behind on initial certification surveys due to staffing constraints. You cannot control this timeline. 5. Survey outcome and certification: If no condition-level deficiencies, CMS processes certification and assigns your Medicare Provider Number within 2–4 weeks. If deficiencies exist, you submit a Plan of Correction; resurvey may add 30–60 days. 6. First Medicare bill submitted: After provider number is active, you can begin billing. Medicare pays for completed 30-day periods under the Patient-Driven Groupings Model (PDGM), so first payment typically arrives 60–90 days after certification. Total realistic timeline: 9–15 months from beginning the process to receiving first Medicare payment. Plan your working capital accordingly.

What are the Anti-Kickback Statute and Stark Law requirements for home health agencies?

These two federal fraud and abuse laws are among the most significant compliance obligations for home health agencies and create real legal exposure if violated. Anti-Kickback Statute (AKS) — 42 USC §1320a-7b(b): The AKS makes it a federal crime to knowingly offer, pay, solicit, or receive anything of value to induce or reward referrals of items or services covered by federal healthcare programs (Medicare, Medicaid). Violations are felonies with penalties of up to $100,000 per violation and exclusion from Medicare/Medicaid. Home health-specific AKS risks: — Paying physicians for referrals (any form of compensation contingent on referral volume is prohibited). — Free services to referral sources: providing discharge planning staff, free supplies, or other benefits to hospitals or physician offices in exchange for referrals. — Paying marketers a per-referral commission: marketers must be paid fixed salary or flat fee, not per-admission commissions. — Providing gifts or meals to patients or physicians: strict limits apply ($15 per gift, $75 per year per individual). Safe harbors exist for certain arrangements (employment, personal services, discounts, small entity investment) but must be structured carefully and documented. Stark Law (Physician Self-Referral Law) — 42 USC §1395nn: The Stark Law prohibits physicians from referring Medicare patients for designated health services — including home health services — to entities with which the physician (or immediate family member) has a financial relationship, unless an exception applies. Unlike the AKS, Stark is a strict liability statute — intent is irrelevant. Home health agencies that have physician investors must structure those relationships under a specific Stark exception (typically the in-office ancillary services exception does not apply to home health). This requires healthcare attorney review before bringing any physician on as an owner or investor. OIG compliance program recommendation: The HHS OIG published specific Compliance Program Guidance for Home Health Agencies that addresses both AKS and Stark risks. Every home health agency should have a written compliance program with designated compliance officer, AKS/Stark training for all staff who have referral relationships, and a written policy prohibiting improper inducements.

Does my state require a Certificate of Need (CON) for a home health agency?

Certificate of Need laws require healthcare providers to obtain state government approval before establishing a new facility or service, demonstrating that there is an unmet community need and that the new provider will not create excess capacity. CON laws vary significantly by state. States with CON requirements for home health agencies (as of 2026, verify current status with your state health planning agency): — Florida: CON required for Medicare-certified home health agencies (reviewed by AHCA). Florida has maintained its home health CON program and it creates a significant barrier to entry — you must demonstrate unmet need in your proposed service area. — Georgia: CON required for home health agencies. — Illinois: CON required for some home health services. — Maryland: CON required through the Maryland Health Care Commission. — New York: CON required for Article 36 certified home health agencies (reviewed by NYSDOH). — Virginia: CON required for home health agencies. States without CON requirements for home health: California, Texas, Arizona, Colorado, Pennsylvania, Ohio, Michigan, and most other states do not require CON for home health agencies. The regulatory burden in non-CON states is still substantial (state licensure + Medicare certification) but does not require demonstrating community need. CON process: In CON states, you must file a detailed application with the state health planning agency demonstrating: the population in your proposed service area, existing HHA capacity and utilization rates, your financial and operational capacity to serve the need, and a detailed service plan. CON review can take 6–18 months and may involve public hearings. Existing HHAs in the area often file competing applications or formal objections. Practical implication: If you are considering launching in a CON state, factor 12–24 months of CON review into your timeline before you can even begin state licensure. The total regulatory timeline from idea to first patient can exceed 3 years in some CON states.

What are the Medicare home health aide (HHA) training and certification requirements?

Federal Medicare regulations establish minimum training standards for home health aides working in Medicare-certified agencies. These are floor requirements — states can and often do impose higher standards. Federal minimum under 42 CFR 484.36: — 75 hours of training minimum: At least 16 hours of classroom/lab training before supervised practical training begins. — Supervised practical training: At minimum 16 hours of hands-on training under the supervision of a registered nurse. — Competency evaluation: Must demonstrate competence in 13 specified skill areas before working unsupervised with patients: patient rights, infection control, basic elements of body functioning, maintaining a clean, safe, and healthy environment, recognizing emergencies, physical, emotional, and developmental needs of patients, care of patients with dementia, basic nutrition/hydration, reading/recording temperature/pulse/respiration, basic safety, personal hygiene/grooming, safe transfer techniques, and care of skin. — Competency evaluation conducted by: An RN or other qualified health professional. RN supervisory visits: Under 42 CFR 484.36(d), the agency must ensure an RN makes an on-site visit to a patient’s home to observe and assess each home health aide’s performance of aide duties at least once every 14 days if the patient is receiving skilled services. State HHA certification requirements: Many states have their own HHA certification programs that require completion of a state-approved training program (often 120 hours or more), passing a state competency exam, and registration on the state Home Health Aide or Nurse Aide Registry. Check your state’s nursing board or department of health for the specific state HHA certification requirements — the federal 75-hour minimum is often significantly below what states require. Background check before training: In most states, aides must pass background checks before beginning training programs that involve contact with patients. Verify your state’s specific timing requirements.

What insurance does a home health care agency need and how much does it cost?

Home health agencies need a comprehensive insurance portfolio covering clinical liability, employer liability, commercial operations, and increasingly cyber risk. 1. Professional liability (medical malpractice / errors and omissions): Covers claims arising from professional clinical services — a nurse’s medication error, a physical therapist’s treatment causing injury, failure to detect and escalate a deteriorating patient condition. Most state licensing requirements specify minimum coverage of $1,000,000 per occurrence / $3,000,000 aggregate. Hospital and skilled nursing facility referral sources frequently require $2,000,000/$4,000,000. Annual premium for a new agency: $4,000–$10,000/year. 2. General liability (commercial general liability / premises and operations): Covers third-party bodily injury and property damage not arising from professional services — a caregiver slipping and falling in a client’s home, damaging the client’s property. Often bundled with professional liability in a healthcare package policy. Annual premium: $2,000–$5,000/year. 3. Workers’ compensation: Required by law for all employees in all 50 states. Workers’ comp rates for home health workers are among the highest of any industry — NCCI workers’ comp classification codes for home health workers reflect elevated injury rates from patient handling, in-home hazards, and workplace violence. Typical rate: $8–$22 per $100 of payroll. Annual cost for a 15-person agency: $6,000–$18,000. 4. Commercial auto (employer non-owned auto liability): If employees use personal vehicles to travel between client homes, your general liability policy does not cover accidents in those vehicles. Employer non-owned auto coverage fills this gap. Annual premium: $1,500–$4,000. 5. Cyber liability: Home health agencies handle large volumes of electronic PHI. A data breach triggers HIPAA breach notification obligations and potential OCR enforcement. Cyber liability coverage pays for breach investigation, notification costs, credit monitoring for affected patients, and regulatory defense. Annual premium for a small HHA: $2,000–$6,000. 6. Surety bond (for Medicare certification): CMS requires home health agencies to post a surety bond as a condition of Medicare enrollment. The federal minimum is $50,000 for agencies with annual Medicare billings under $500,000. The bond amount scales with Medicare billing volume for larger agencies. Annual bond premium: $500–$2,500 depending on agency credit profile. Total annual insurance cost for a new agency (10–20 staff): $16,000–$45,000/year.

What does it cost to start a home health care agency?

Home health agency startup costs vary significantly based on whether you pursue Medicare certification from the outset, your state’s regulatory environment, and planned initial scale. Here is a realistic breakdown: Licensing and regulatory costs: — State home health agency license: $300–$3,000 application fee. — Background checks for initial caregiving staff (30–100 hires): $3,000–$10,000. — Business entity formation + EIN: $100–$800. — NPI registration (Type 1 and Type 2): Free. — Medicare enrollment (CMS-855A via PECOS): No application fee, but requires 40–80 hours of administrative time or consultant support ($2,000–$8,000 if using a consultant). — Total regulatory: $5,000–$22,000. Insurance (first year): — Professional + general liability: $6,000–$15,000. — Workers’ compensation: $6,000–$18,000. — Commercial auto + cyber: $3,500–$10,000. — Surety bond: $500–$2,500. — Total insurance: $16,000–$45,000. Technology: — Home health EHR software (Homecare Homebase, MatrixCare, WellSky, Axxess): $500–$2,000/month. Required for OASIS data submission to CMS. — Electronic Visit Verification (EVV) system: Required for Medicaid-funded personal care and home health visits in most states (21st Century Cures Act requirement). Often integrated into EHR. Separate EVV system cost: $0–$500/month. — Billing software or billing service: 4%–8% of collections or $500–$2,000/month. — Total technology: $12,000–$50,000/year. Working capital: — The Medicare PDGM payment model pays for 30-day periods in arrears. You will pay caregivers for 30–60 days of care before receiving Medicare payment for those episodes. Budget 3–6 months of payroll and operating expenses: $75,000–$200,000 depending on planned census size. Consulting, legal, and policy development: — Healthcare attorney for entity structuring, Anti-Kickback/Stark review, and Medicaid enrollment: $5,000–$15,000. — Policy manual development (customized for your agency and state): $3,000–$10,000. — Medicare certification consultant or survey preparation: $5,000–$15,000. Total first-year startup cost: $120,000–$350,000 for an agency actively pursuing Medicare certification and building toward a sustainable census of 15–30 patients.

Home health agency licensing by state

California (CDPH) — no CON Texas (HHSC) — no CON Florida (AHCA) — CON required New York (DOH) — CON for CHHA Georgia — CON required Illinois — CON (some services) Pennsylvania — no CON Ohio — no CON Virginia — CON required Maryland — CON required Arizona — no CON Colorado — no CON

CON status may change; verify current requirements with your state health planning agency before starting the licensing process.

How to Start a Home Health Care Agency: Medicare Certification (42 CFR Part 484), State License, HIPAA, Anti-Kickback &amp; Startup Costs (2026 Guide)