This is Part 1 of "The Compliance-First Fintech Playbook" series. Part 2 covers ML fraud detection. Part 3 examines the full cost of compliance programs.
Standard KYC asks for name, date of birth, address, and SSN. Healthcare KYC adds DEA license verification, NPI validation, state board monitoring, and beneficial ownership tracing through complex practice structures.
The difference is economic. Consumer KYC costs $2-3 per customer through vendors like Alloy or Persona. Healthcare KYC costs $8-12 per practice due to specialized data sources, manual verification steps, and ongoing monitoring requirements.
After onboarding 777 dental practices through the fall, we learned that compliance is an ongoing operational expense that determines whether healthcare fintech unit economics work at scale.
These requirements build competitive advantages through compliance infrastructure that competitors can't replicate without similar investment.
The Healthcare Identity Stack
Healthcare providers operate under multiple identity frameworks that standard banking KYC doesn't address:
Individual Provider Identity:
- NPI (National Provider Identifier) - CMS-issued 10-digit identifier
- DEA number - DEA-issued alphanumeric identifier for controlled substances
- State medical/dental license - State board-issued professional license
- Specialty board certifications - Additional credentialing for specialties
Practice Entity Identity:
- NPI for organizational providers (different from individual NPI)
- FEIN/EIN for tax purposes
- State professional corporation registration
- Group practice agreements and ownership structures
Beneficial Ownership Complexity: Medical practices often have ownership structures that consumer KYC can't handle:
- Multiple physician partners with less than 25% individual stakes but greater than 75% collective ownership
- Equipment financing companies with security interests
- Management service organizations (MSOs) with operational control but no equity
- Spouse ownership for asset protection purposes
Standard banking KYC identifies beneficial owners with ≥25% ownership stake. Healthcare KYC must also identify control persons who may have operational authority without equity ownership.
DEA License Verification: Beyond Basic Document Checks
DEA number verification involves multiple validation steps that most fintech platforms don't understand:
DEA Number Format Validation:
- 2 letters + 7 digits (e.g., BC1234567)
- First letter: Registrant type (B=hospital, M=mid-level practitioner, etc.)
- Second letter: First letter of practitioner's last name
- Check digit algorithm validation
Active Status Verification:
- DEA maintains a public database of active registrations
- Status can be: Active, Expired, Surrendered, Revoked
- Expiration dates require ongoing monitoring (typically 3-year renewals)
Schedule Authority Validation:
- DEA registrations specify controlled substance schedules (I-V)
- Dental practices typically need Schedules II-V for pain management
- Anesthesia practices require additional Schedule I authority
Geographic Limitations:
- DEA registrations are location-specific
- Practices with multiple locations need separate registrations
- Cross-state practice requires validation in each jurisdiction
Our implementation through Alloy:
// Simplified example - actual implementation more complex
const deaValidation = await alloy.validate({
type: 'dea_license',
number: 'BC1234567',
lastName: 'Smith',
practiceAddress: '123 Main St, Austin TX',
expectedSchedules: ['II', 'III', 'IV', 'V']
})
if (deaValidation.status === 'ACTIVE' &&
deaValidation.schedules.includes('II')) {
// Proceed with onboarding
} else {
// Flag for manual review
}Cost implications:
- DEA verification: $3-5 per check through specialized vendors
- State medical board verification: $2-4 per license per state
- Ongoing monitoring: $1-2 per month per provider
- Manual review for exceptions: $15-25 per case
This explains why healthcare KYC costs 3-4x consumer KYC—specialized data sources command premium pricing.
NPI Validation and Cross-Referencing
National Provider Identifier validation involves cross-referencing multiple databases to ensure provider legitimacy:
NPPES (National Plan and Provider Enumeration System) Validation:
- Confirms NPI is active and properly formatted
- Validates taxonomy codes match claimed specialties
- Checks provider demographics (name, address, phone)
- Identifies individual vs. organizational NPIs
Taxonomy Code Verification:
- 207Q00000X: Pediatric Dentist
- 1223G0001X: General Dental Practice
- 122400000X: Oral and Maxillofacial Surgery
- Mismatched taxonomy codes flag potential fraud
Cross-Database Validation:
- NPPES data against state licensing boards
- NPI against DEA registration addresses
- Organizational NPIs against FEIN/EIN records
- Individual NPIs against Social Security Death Master File
Practice Affiliation Verification: Many providers have multiple NPI registrations:
- Individual NPI for personal practice
- Organizational NPI for group practice employment
- Locum tenens arrangements for temporary coverage
Our KYB process must identify all relevant NPIs and understand the relationships between individual and organizational providers.
Example validation failure: Dr. Sarah Johnson applies for business banking claiming solo practice ownership. NPI validation shows she's employed by Dental Corp LLC with no ownership stake. This triggers enhanced due diligence to understand actual practice ownership structure.
State Board Monitoring and Sanctions Screening
Healthcare providers face discipline from state licensing boards that standard KYC sanctions screening doesn't catch:
State Medical/Dental Board Actions:
- License suspension or revocation
- Probationary supervision
- Continuing education requirements
- Practice restrictions or limitations
Specialty Board Sanctions:
- American Board of Oral Surgery disciplinary actions
- State dental society sanctions
- Hospital credentialing issues
OIG Exclusion List Screening:
- Office of Inspector General maintains list of sanctioned providers
- Exclusions prevent participation in federal healthcare programs
- Automatic trigger for account closure or enhanced monitoring
Cross-State Monitoring: Providers licensed in multiple states require monitoring across all jurisdictions. A dentist licensed in Texas and Oklahoma needs monitoring from both state boards plus federal exclusion lists.
Ongoing Monitoring Implementation:
# Monthly state board monitoring
def monitor_state_licenses():
for provider in active_providers:
for license in provider.state_licenses:
board_status = check_state_board(license.state, license.number)
if board_status.disciplinary_action:
flag_for_review(provider, board_status)
oig_status = check_oig_exclusion(provider.npi)
if oig_status.excluded:
initiate_account_closure(provider)This monitoring generates ongoing compliance costs but prevents regulatory violations that could shut down the entire program.
Corporate Practice of Medicine Compliance
Many states restrict corporate ownership of medical practices, creating KYB complexities that standard business banking doesn't address:
Prohibited Corporate Structures:
- Direct corporate employment of licensed practitioners
- Non-physician ownership of medical practices
- Management companies with excessive control
Permitted Structures:
- Professional corporations owned by licensed practitioners
- Management service agreements with appropriate limitations
- Equipment leasing arrangements with proper documentation
Due Diligence Requirements: When onboarding a dental practice, we must verify:
- All equity owners are licensed dentists (where required by state law)
- Management agreements don't violate corporate practice restrictions
- Fee-splitting arrangements comply with state regulations
- Referral relationships don't create Stark Law violations
Example compliance issue: Dental practice applies for business banking. Ownership structure shows:
- Dr. Smith (dentist): 60% ownership
- Smith Holdings LLC: 40% ownership
Enhanced due diligence reveals Smith Holdings LLC is owned by Dr. Smith's spouse, a non-dentist. In states prohibiting non-dentist ownership, this structure violates corporate practice of medicine laws.
Resolution requires restructuring ownership or declining the customer relationship.
The Alloy/Persona Integration That Actually Works
Healthcare KYC requires specialized vendors that understand medical provider verification:
Our vendor stack:
- Alloy: Primary KYC/KYB orchestration with healthcare-specific workflows
- Persona: Document verification and identity proofing
- ProPublica: State medical board scraping and monitoring
- NPPES API: Direct NPI validation and taxonomy verification
Alloy healthcare workflow configuration:
healthcare_kyc_workflow:
steps:
- identity_verification:
vendor: persona
document_types: [drivers_license, passport]
selfie_required: true
- professional_verification:
npi_validation: required
dea_verification: required_if_controlled_substances
state_license_check: required
- sanctions_screening:
ofac_check: required
oig_exclusion_check: required
state_board_check: required
- beneficial_ownership:
threshold: 25_percent
corporate_practice_check: required
control_person_identification: required
decision_logic:
auto_approve:
- all_checks_pass: true
- risk_score: < 30
manual_review:
- any_check_pending: true
- risk_score: 30-70
auto_decline:
- oig_excluded: true
- license_revoked: true
- risk_score: > 70Cost breakdown per practice:
- Alloy platform fee: $0.50 per workflow
- Identity verification: $1.50 per individual
- NPI validation: $2.00 per provider
- DEA verification: $3.50 per registration
- State board monitoring setup: $2.50 per license
- Total onboarding cost: $8-12 per practice
This is 3-4x consumer KYC costs but necessary for healthcare compliance.
Ongoing Monitoring That Scales
Healthcare KYC requires ongoing monitoring as provider status changes:
Monthly Monitoring Tasks:
- DEA registration renewals (every 3 years, but dates vary)
- State license renewals (annual or biennial by state)
- OIG exclusion list updates (monthly additions)
- State board disciplinary actions (weekly updates)
- NPI status changes (practice affiliations, addresses)
Event-Driven Monitoring:
- News alerts for provider arrests or malpractice suits
- Court records for bankruptcy or civil judgments
- Professional society sanctions or suspensions
- Hospital credentialing issues or terminations
Automated Workflow Example:
class HealthcareMonitoring:
def __init__(self):
self.alloy_client = AlloyClient()
self.monitoring_schedule = {
'daily': [self.check_oig_updates],
'weekly': [self.check_state_boards],
'monthly': [self.validate_renewals],
'quarterly': [self.full_risk_reassessment]
}
def check_provider_status(self, provider_id):
provider = self.get_provider(provider_id)
# Check each license/registration
for license in provider.licenses:
if license.expires_within_days(90):
self.notify_renewal_required(provider, license)
board_status = self.check_state_board(license)
if board_status.has_disciplinary_action():
self.escalate_for_review(provider, board_status)Monitoring costs:
- Automated monitoring: $1-2 per provider per month
- Manual review of flagged cases: $15-25 per incident
- License renewal tracking: $0.50 per license per month
- Emergency sanctions screening: $5-10 per urgent check
These ongoing costs must be factored into healthcare fintech unit economics.
The Corporate Transparency Act (CTA) Layer
Starting January 2024, the Corporate Transparency Act requires reporting beneficial ownership information to FinCEN for most business entities:
BOI (Beneficial Ownership Information) Reporting:
- Required for corporations and LLCs created after 1/1/2024
- Existing entities must file by 1/1/2025
- Updates required within 30 days of ownership changes
- Penalties up to $500/day for non-compliance
Healthcare-Specific Considerations:
- Professional corporations may qualify for exemptions
- Medical practices with complex ownership need careful analysis
- Beneficial ownership rules interact with corporate practice of medicine laws
Our CTA Compliance Process:
- Entity Analysis: Determine if practice entity requires BOI reporting
- Ownership Mapping: Identify beneficial owners and control persons
- Documentation: Collect required identification documents
- Filing Coordination: Submit BOI reports or coordinate with practice counsel
- Ongoing Monitoring: Track ownership changes requiring updates
Cost implications:
- Initial CTA analysis: $2-5 per entity
- BOI report preparation: $10-15 per filing
- Ongoing change monitoring: $1-2 per entity per month
- Legal consultation for complex cases: $150-300 per case
Healthcare fintechs must either build CTA compliance capabilities or partner with legal/accounting firms that handle these filings.
Building Compliance Infrastructure That Scales
Healthcare KYC complexity requires purpose-built compliance infrastructure:
Workflow Management:
- Multi-step verification processes with manual review queues
- Automated retry logic for temporary verification failures
- Exception handling for edge cases and missing data
- Integration with compliance case management systems
Data Management:
- Secure storage of sensitive healthcare provider information
- Audit trails for all verification decisions and data updates
- Version control for changing regulations and requirements
- APIs for third-party compliance tools and legal reviews
Risk Scoring:
- Healthcare-specific risk factors (malpractice history, board actions)
- Geographic risk weighting (state regulatory environments)
- Practice type risk assessment (controlled substance prescribing)
- Ongoing risk score updates based on monitoring alerts
Reporting and Analytics:
- Compliance dashboard for internal teams and regulators
- KYC completion rates and processing times
- False positive/negative analysis for continuous improvement
- Cost tracking for compliance operations and vendor expenses
From Compliance Cost to Competitive Advantage
Healthcare KYC costs $8-12 per practice vs. $2-3 for consumer customers, but this investment creates sustainable competitive advantages:
Regulatory Moat: Competitors can't serve healthcare customers without similar compliance infrastructure investment.
Data Advantage: Healthcare KYC generates valuable data about provider credentials, practice ownership, and regulatory standing that enables better underwriting and risk management.
Customer Trust: Practices value working with fintechs that understand healthcare regulatory requirements and can navigate compliance complexity.
Partner Relationships: Healthcare KYC compliance enables partnerships with medical suppliers, equipment vendors, and professional organizations that require verified provider relationships.
The key is building compliance infrastructure that scales efficiently while maintaining regulatory effectiveness. This requires significant upfront investment but creates long-term competitive positioning in healthcare financial services.
Next: Part 2 explores how machine learning detects healthcare-specific fraud patterns that traditional banking systems miss.
Data sources: FinCEN CTA guidance, CMS NPI documentation, DEA registration requirements, internal compliance cost analysis from 777-practice onboarding experience