diff --git a/docs/state-healthcare-compliance-opportunities.md b/docs/state-healthcare-compliance-opportunities.md
new file mode 100644
index 0000000..9eafffd
--- /dev/null
+++ b/docs/state-healthcare-compliance-opportunities.md
@@ -0,0 +1,90 @@
+# State & adjacent healthcare compliance — new service opportunities
+
+We already sell the federal/Medicare side: PECOS revalidation, Medicare
+enrollment, NPI/NPPES updates, NPI reactivation, OIG/SAM screening. Below are
+the **state-level and adjacent** provider obligations we can add. Ranked by
+revenue potential (recurring + high-volume + painful + legitimately
+outsourceable).
+
+## TIER 1 — add these first
+
+### 1. State Medicaid enrollment & revalidation  ⭐ flagship
+- **What:** Separate from Medicare. Every state Medicaid program requires its own
+  provider enrollment, and the **ACA requires Medicaid revalidation at least
+  every 5 years** (CMS-confirmed: "The State Medicaid agency must revalidate the
+  enrollment of all providers regardless of provider type at least every 5
+  years"). The federal government is pushing *more frequent* scrutiny.
+- **Why it's huge:** It's a distinct, recurring, state-by-state deadline that
+  providers routinely miss — and missing it deactivates Medicaid billing, same
+  pain as Medicare. A provider enrolled in multiple states has multiple clocks.
+- **Outsourceable?** Yes — we prepare + submit the state Medicaid enrollment/
+  revalidation packet (provider signs). Same model as our PECOS service.
+- **Offer:** "State Medicaid Revalidation" (per state) + "Medicaid Enrollment
+  (per state)". Price similar to PECOS ($599-ish revalidation, $699 enrollment).
+- **Data hook:** like the CMS revalidation list, several states publish Medicaid
+  revalidation due dates -> same overdue-first cold-outreach play.
+
+### 2. CAQH ProView re-attestation management  ⭐ recurring SaaS-like
+- **What:** Commercial-payer credentialing runs on CAQH ProView. Providers must
+  **re-attest their CAQH profile every ~120 days (4x/year)** or payers drop them
+  from directories and stop paying claims.
+- **Why:** Highest-frequency obligation in healthcare. Almost universally
+  neglected by small practices. Pure recurring revenue.
+- **Outsourceable?** Yes (with provider authorization) — we maintain the profile
+  and re-attest on schedule.
+- **Offer:** "CAQH Attestation Management" — annual subscription (e.g. $299-499/yr
+  covering all 4 attestations + profile upkeep). Strong bundle add-on.
+
+### 3. Commercial payer credentialing & re-credentialing
+- **What:** Enroll/re-credential providers with each insurance network
+  (~every 3 years per payer). Big, well-established outsourced market.
+- **Why:** Revenue-critical (no credentialing = no in-network payment), tedious,
+  per-payer. Practices pay credentialing firms $100-300 per provider per payer.
+- **Outsourceable?** Yes — this is a mature service line; we'd compete on fixed
+  pricing + our filing tech.
+- **Offer:** "Payer Credentialing" (per provider/per payer) + re-credentialing.
+
+## TIER 2 — solid add-ons / renewals (mostly reminder + prep + file)
+
+### 4. DEA registration renewal + state Controlled Substance Registration (CSR)
+- **DEA:** federal, renew **every 3 years**. **State CSR:** ~half the states
+  require a *separate* state controlled-substance license with its own renewal.
+- **Outsourceable?** We prep/file the renewal; the registration itself is the
+  provider's. Good reminder+filing service, bundles with PDMP below.
+
+### 5. PDMP (Prescription Drug Monitoring Program) registration
+- **What:** Nearly every state requires prescribers/dispensers of controlled
+  substances to register with the state PDMP (and some mandate periodic checks).
+- **Outsourceable?** Registration assistance + setup. Lower price, high volume
+  among prescribers; natural bundle with DEA/CSR.
+
+### 6. CLIA certificate (in-office lab testing)
+- **What:** Practices doing any in-house testing need a CLIA certificate,
+  **renewed every 2 years** (CMS-administered via states).
+- **Outsourceable?** Yes — application + biennial renewal filing. Niche but sticky.
+
+### 7. State medical license renewal support (license + CME tracking)
+- **What:** State MD/DO/NP/PA licenses renew on a state cycle (often every 1-2
+  yrs) with CME requirements. The license is personal (can't file for them) but
+  **renewal reminders + paperwork prep + CME tracking** is a legitimate assist
+  service.
+- **Offer:** "License Renewal & CME Tracking" subscription. Position as assist,
+  not "we renew your license."
+
+## TIER 3 — already in our wheelhouse (cross-sell to providers)
+- **Practice entity compliance:** PLLC/PC formation, annual reports, registered
+  agent — we already do corporate; just market it to the healthcare segment.
+
+## Recommended rollout
+1. **State Medicaid revalidation/enrollment** (mirrors our PECOS product + has a
+   data-driven overdue cold-outreach angle).
+2. **CAQH attestation management** (recurring subscription revenue).
+3. **Payer credentialing** (large existing market, fixed-price differentiation).
+Then bundle DEA/CSR/PDMP + CLIA + license-renewal as a "Provider License &
+Credential Upkeep" annual subscription.
+
+## Honesty guardrails (same as Medicare)
+- We PREPARE + FILE where the provider signs; we ASSIST (reminders/prep) for
+  anything that legally must be done by the provider personally (e.g. license
+  attestations, DEA personal certifications). Never claim we hold/sign the
+  provider's personal license.