From NHS to Private: A Timeline for Your First 12 Months
Someone asks whether you see private patients, you say yes, and the administrative setup happens around the edges of everything else. The result is a practice that works, but one built on foundations laid in the wrong order: insurer recognition applied for after the first patients have arrived, ICO registration remembered months in, PHIN fee submission discovered when a letter lands.
​
Poor sequencing has specific, predictable costs. Insurer recognition that is not in place before a patient is seen, a self-pay patient seen before fee information has been submitted to PHIN, a practice management system set up after the first patients have been seen all add extra effort down the line.
​
This guide sets out what to do in the right order. It is structured as a timeline, but the divisions are practical rather than rigid. The goal is a practice that is set up once, correctly, and then runs without the administrative friction that consumes time better spent on clinical work.
Before You See Anyone
Everything in this section must be in place before the first patient encounter. Several items take longer than consultants expect, particularly insurer recognition, which means they need to start immediately even if the first clinic is months away.
Review your NHS contract
Before anything else, read your NHS employment contract. Most consultant contracts permit private practice, but they often impose conditions that are worth understanding before you make any commitments to patients or hospitals. Schedule 10 of the standard NHS consultant contract requires that private work does not prejudice your NHS responsibilities.
Some trusts require you to notify your clinical director or medical director before starting, not for permission, but as a professional courtesy that prevents complications later. Check whether your contract contains any restrictions on using NHS facilities for private work, and whether there are any non-compete provisions, which are rare but not unknown.
​
If you are in any doubt, the BMA has a dedicated private practice advisory service and can review contract provisions on your behalf.
​
Arrange medical indemnity
Your NHS indemnity through the Clinical Negligence Scheme for Trusts does not extend to private work. You need separate cover in place before seeing any private patient, without exception.
When arranging cover, a practical decision is understanding the difference between occurrence-based and claims-made policies. An occurrence-based policy covers claims arising from incidents that occurred during the policy period, regardless of when the claim is made. A claims-made policy only covers claims made while the policy is active, which creates a tail risk if you let the policy lapse or change providers. Ask explicitly which type you are being offered, and what run-off cover looks like if you ever stop practising.
​
Disclose your expected private practice volume accurately, including all procedures you intend to perform and all locations where you plan to practise.
​
Register with the ICO
From the moment you hold patient data, you are a data controller under UK GDPR, and you are legally required to register with the Information Commissioner's Office and pay the annual data protection fee. The fee for a sole trader or micro-organisation is £52 per year (as of February 2025). Registration takes around 15 minutes online at ico.org.uk.
​
This is one of the most commonly overlooked steps in early private practice setup. The consequence of not registering is not simply a fine; it is operating as an unregistered data controller, which has implications for your professional standing and for your data security obligations. Register before you record a single patient's contact details.
​
Register with Healthcode (optional but advised)
Healthcode is the secure clearing system used by many major UK private medical insurers for the electronic submission and payment of invoices. If you plan to see any insured patients, Healthcode registration can simplify both billing and insurer recognition. The process requires your GMC number, proof of indemnity, bank details, and a practice address. Allow at least two to three weeks for registration to complete.
​
It's not mandatory but if you plan to see patients from different insurers having one central portal through which to bill multiple insurers can save significant time.
Apply for insurer recognition
This is the step that consultants start too late. Insurer recognition takes time, each insurer has its own application process.
​
As a practical benchmark, allow six to twelve weeks for recognition applications to be processed. In some cases it will be faster; in others, particularly if documentation is incomplete or if an insurer is experiencing high application volumes, it may take longer.
​
A further benefit of joining Healthcode is many insurers now process recognition through your Private Practice Register (PPR) via Healthcode. This allows multiple recognitions via 1 application.
​
Open a business bank account (optional)
Set up a separate business bank account before any money moves. This is not a legal requirement for sole traders, but it is practical. Mixing practice income with personal finances makes bookkeeping significantly harder, complicates tax returns, and gives you no clear picture of your practice's financial position. Most banks offer straightforward business current accounts, and the time spent setting this up now saves a disproportionate amount of time at year end.
​
Decide on your initial business structure
Starting as sole trader versus a limited company structure is worth discussing with an accountant from the outset, not because you need to act immediately, but because the decision about when to incorporate and how to set up a company correctly is easier to make before the practice is generating income.
​
Engaging an accountant who has experience with private medical practices at this stage, rather than waiting for your first tax return deadline, is one of the most consistently useful steps early practitioners can take.
Getting the Infrastructure Right: Months One and Two
The items in this section will not block your first patient, but each one will cause significant problems if left unaddressed past the second month.
​
Choose and set up your practice management system
The decision about how you will manage appointments, patient records, correspondence, and billing needs to be made before your patient list exists, not after. Setting up a practice management system once you already have patients in a spreadsheet or in email threads means data migration, inconsistency, and the duplication of work that should have been done once.
​
The minimum requirements for any system you use are secure patient record storage, appointment scheduling, integration with Healthcode for insurer billing, and the ability to generate compliant clinical letters and referral correspondence. For a practice seeing both insured and self-pay patients from day one, a system that handles both billing pathways without requiring separate tools substantially reduces administrative overhead.
​
Data security is not optional. As a data controller under UK GDPR, you are responsible for the security of patient data regardless of which system you use. Look for a provider with ISO 27001 certification such as TouchPoints.health, which is the internationally recognised standard for information security management, and check whether patient data is stored on servers within the UK.
​
Set up your PHIN profile and understand your data obligations
Under the Competition and Markets Authority's Private Healthcare Market Investigation Order 2014, all consultants who provide private healthcare services have a legal obligation to submit fee information to PHIN, the Private Healthcare Information Network. This covers consultation fees and procedure fees for every site where you practise privately. The submission is made via the PHIN portal at phin.org.uk.
​
Many consultants in their first year of private practice are unaware of this obligation until they receive a letter from PHIN or, in more uncomfortable circumstances, until the issue comes up during an insurer recognition review. Non-compliance is ultimately enforceable by the CMA, not just PHIN.
​
The performance data published on your PHIN profile, including procedure volumes, anticipated length of stay, and patient satisfaction scores, is submitted by the hospitals where you practise. What you control is the fee information, the validation of the data submitted about you, and the voluntary elements of your profile: your photograph, your clinical description, your sub-specialty interests, and your languages spoken. Patients with complete profiles receive more visits on PHIN than those without. Set yours up properly from the start rather than leaving it as a blank entry.
Arrange consulting rooms and apply for practising privileges
If you plan to see patients in a private hospital, you will need to apply for practising privileges. This is a formal process involving the hospital's Medical Advisory Committee. It typically requires your GMC registration and revalidation status, proof of indemnity, two or more clinical references, a Disclosure and Barring Service check, and evidence of current clinical appraisal.
​
The process varies by hospital group and can take four to eight weeks. Some hospitals, particularly the larger group operators, have centralised credentialling processes that apply across multiple sites. Others assess each consultant individually at each location.
​
​​
Decide on secretarial support
Managing a private practice without secretarial support is possible in the very early months, when patient volumes are low. The time cost of answering booking enquiries, sending appointment letters, chasing pre-authorisations, generating clinical correspondence, and following up on unpaid invoices is substantial and is not a good use of a consultant's time.
​
The options are: employing a dedicated medical secretary, using a virtual PA service specialising in private medical practice, or using a shared secretarial service through the hospital where you have rooms. Each has trade-offs. An employed secretary gives you dedicated attention and the ability to build a consistent working relationship, but adds employment obligations and payroll administration. Virtual and shared services offer flexibility and lower cost at lower volumes, but may be less responsive at peak times. Whatever route you choose, your secretary or administrative support needs to understand private billing, pre-authorisation, Healthcode, and the specific requirements of your insurer relationships. Experience in private medical practice is worth specifying explicitly when recruiting or contracting. At TouchPoints.health with have relationships with excellent medical secretary groups, just ask and we'll introduce you.
​
Establish your data security basics before you go live
Before seeing patients, put basic data handling processes in place. Specifically: decide how referral letters and patient correspondence will be received and stored securely, confirm that any email used for patient communication is encrypted, and establish that staff involved in patient administration understand that patient data cannot be transmitted or stored via consumer apps such as WhatsApp. These are not bureaucratic concerns. They are the points at which most small practices accumulate GDPR risk without intending to.
First Patients and First Invoices: Months Two to Four
The transition from setup to active practice is where the administrative processes you have built either hold or do not. The billing errors that are most common among new private practitioners almost all stem from steps skipped at booking and pre-appointment stages.
​
What to confirm before a patient arrives
For insured patients: confirm the insurer name and membership number, verify that the consultant is recognised by that insurer, and obtain pre-authorisation for the appointment before it takes place. Pre-authorisation is not a formality. Seeing a patient without it, or under an authorisation that covers a different clinical indication than the one you are treating, is the most reliable way to generate a disputed or declined invoice. If the referral letter indicates a clinical complexity that might take the consultation outside the scope of a standard pre-authorisation, contact the insurer before the appointment rather than after.
​
For self-pay patients: confirm the fee for the consultation, explain what the fee covers, and ensure the patient understands that if diagnostics or a procedure recommendation arise from the consultation, these will be costed separately and communicated before any commitment is made. Under the CMA's Private Healthcare Market Investigation Order, patients are legally entitled to written confirmation of estimated costs after their first consultation. Good Medical Practice 2024 requires openness about fees and charges. The practical approach is to make fee communication a standard step in booking, not an afterthought at the appointment.
​
Billing your first insured invoices
The most frequent errors in early private practice billing are: submitting an invoice without a valid pre-authorisation reference, using a CCSD code that does not match the authorised clinical indication, billing for items included within a standard consultation fee as if they were separate, and submitting invoices outside the six-month window that most insurers apply. Bupa, for example, requires invoices to be submitted within six months of the first treatment date.
​
A rejected invoice is not a lost invoice, but resolving rejections takes administrative time. A practice management system with Healthcode integration that validates the invoice before submission catches the most common errors before they become disputes like TouchPoints.health.
​
The shortfall conversation
A shortfall is the difference between what a consultant charges and what an insurer reimburses. For Bupa-recognised consultants, agreed fee schedules significantly reduce shortfall risk for consultation fees. For procedures, gaps can occur. For consultants not recognise by an insurer, or where no fee agreement is in place, shortfalls can be substantial.
​
The time to raise the shortfall conversation with an insured patient is before treatment, not after receiving the invoice. A patient who discovers a shortfall for the first time when they receive a bill they were not expecting will experience it as a failure of communication, regardless of the contractual position. A brief, factual explanation of any potential shortfall at the time of booking, confirmed in writing before any procedure, removes the majority of post-treatment billing disputes.
​
Following up on unpaid invoices
Most new private practitioners wait too long before following up on unpaid invoices. For self-pay patients, a clear payment terms policy communicated at booking, with payment taken or agreed before a procedure, reduces the incidence of slow payment significantly.
​
Tracking outstanding invoices is one of the administrative tasks that is hardest to do without dedicated software. A practice management system that shows the payment status of every invoice, flags overdue accounts, and makes it easy to produce a debtor report gives you visibility over your cash position that a spreadsheet cannot replicate reliably.
Building Referrals and Managing Growth: Months Four to Six
The first real inflection point in most new private practices comes around month four. The operational setup is in place, the first clinical rhythm is established, and the question shifts from whether the practice works to whether it will grow.
Your directory presence
Your PHIN profile is a good source of publicly verifiable information about your private practice for patients who are researching their options.
​
Insurer directory listings, particularly Bupa Finder, AXA Health's consultant directory, and the equivalent tools from Aviva and Vitality, are the route by which insured patients find you when their insurer offers an open referral pathway. Your information in these directories needs to be accurate and current: location, clinic days, and contact details. An insured patient who cannot reach you because your listing carries an old phone number, or who calls and cannot get through because booking is not set up to handle calls from Bupa customers, is a patient you have lost before the conversation has started.
​
Reviewing your fee structure
The fee you set when you started private practice was, necessarily, a starting estimate. By month four you have enough real data to review it: what volume of consultations and procedures you are seeing, what proportion are insured versus self-pay, what your administrative overhead is running at, and whether the fees you are charging for self-pay work reflect the time and resource involved. Most consultants review their fees annually, but a mid-year review in the first year is sensible. Fees that were set conservatively to encourage early referrals can be adjusted once your practice is established, with appropriate notice to existing patients.
Compliance and Financial Review: Months Six to Nine
This is the period where administrative problems that accumulated in the early months start to become visible. The practice is running and feels like it is working, which is exactly when the structural issues are easiest to miss.
GDPR audit
At six months, it is worth conducting a brief audit of how patient data is being handled in practice, not in policy. Common issues at this stage: patient correspondences being sent insecurely, data being stored on personal devices without encryption, retention schedules that were written down but never implemented, and subject access request processes that exist on paper but have never been tested. If your practice secretary has changed or a new team member has joined, the moment to check that data handling norms have been communicated is before a breach, not after.
​
Billing debt review
Pull a full outstanding invoices report. In most practices that have been running for six months without a systematic follow-up process, there will be invoices that should have been chased, a handful that were rejected and never resubmitted, and some self-pay balances that have sat unpaid for longer than is worth pursuing. Making a realistic assessment of what is collectable, what should be written off, and what needs escalation to a debt recovery process gives you an accurate picture of your actual revenue rather than your billed revenue. The gap between those figures is often larger than expected in the first year.
​
Even if you rely on third parties for billing it is essential to reconcile what you have invoiced versus what you have received. Identifying any discrepancies now will save you considerable time, money and effort down the line.
​
Tax planning
If you have not already engaged an accountant, the period from month six to month nine is when it matters most. Self-assessment for the first year of private practice requires declaring income and expenses accurately, and the expenses you can legitimately claim in a medical practice are broader than most consultants assume: indemnity, ICO registration, professional memberships, relevant publications, the cost of practice management software, and the proportion of a home office used for administrative work are among the categories worth discussing with an accountant who understands private practice income.
Consolidation and Year-End Review: Months Nine to Twelve
The final quarter of your first year is the time to review what you have built and establish the foundations for year two.
​
Annual fee review
Conduct a formal fee review at or before the twelve-month mark. Look at the data: your clinical volume by procedure type, your self-pay conversion rate, your average invoice value, and how your fees compare to the PHIN-published data for consultants in your specialty and geography. If you intend to change fees, communicate the change to referring clinicians and existing patients with sufficient notice. A brief letter or email explaining when the new fees take effect and what they are is both courteous and professionally straightforward.
​
Review your patient satisfaction data
If your hospital has been collecting patient feedback through PHIN's satisfaction survey, your scores will be published on your PHIN profile once you have more than 30 responses. At around the twelve-month mark you may have your first published scores. Review them. PHIN measures whether things were explained clearly, whether the patient had enough time, and whether the consultant showed understanding. A low score on any of these dimensions is a signal worth acting on, whether through changes to consultation length, communication style, or post-appointment follow-up process.
​
Audit your own public profile
Search for yourself as a patient would. Look at your PHIN profile, your insurer directory listings, and any review platform entries on Doctify or iWantGreatCare. Confirm that every entry has your correct location, clinic days, and contact details. Check that your PHIN fee information is current and validated. Read any patient reviews that have been posted. A practice that looks excellent in the consulting room but unreachable or incomplete online is losing patient contacts it does not know it is losing.
​
Assess your operational model honestly
At twelve months you have enough evidence to assess whether the way you are running the practice is sustainable. Specific questions worth asking: Is your secretary or administrative support keeping up with correspondence turnaround, or are letters going out late? Is your billing being managed systematically, or are you carrying a growing debt book? Is your appointment availability matching demand, or are patients waiting longer than they should for a practice at your stage of development?
Are you spending clinical time on administrative tasks that could be handled by better systems or more support?
​
The practices that grow sustainably into year two and beyond are almost universally those that invested in the right systems and support early, before the volume justified it, rather than those that waited until the administrative burden became unmanageable.
What Consultants Wish They Had Done Earlier
Across all the sequencing errors that affect new private practitioners, a consistent set of regrets comes up.
Starting insurer recognition too late delays your ability to see insured patients.
​
Not having a separate bank account immediately creates an accounting problem that compounds with every month you leave it. The separation of practice finances from personal finances is also what gives you a clear, accurate picture of whether the practice is financially viable as early as possible.
​
Leaving PHIN registration and fee submission until prompted is avoidable but extremely common. The obligation exists from the moment you are treating private patients. Submit your fee information through the PHIN portal as part of your initial setup, not in response to a letter asking why you have not.
​
Using insecure communication channels for patient data is the most common GDPR risk in new practices. Consumer messaging and email applications are not appropriate for transmitting identifiable patient information. Addressing this at setup, by choosing a practice management system with secure messaging and patient correspondence built in, eliminates the problem before it starts.
​
Delaying the appointment of an accountant to the first tax return deadline means making structural decisions about business structure and expense management without professional advice, at the point when the decisions are hardest to change. An accountant familiar with private medical practice income is worth engaging before your practice generates its first invoice, not after it generates its first tax problem.