HIPAA compliance for medium healthcare practices: the gaps multi-location growth creates
Julian ThorneApril 29, 2026
Key takeaways
Multi-location expansion is the most common trigger for HIPAA compliance gaps in medium practices. Access controls, risk analyses, and Business Associate Agreements configured for a single site do not automatically scale when a practice adds locations — and the gap between the original controls and the expanded environment is where breaches originate.
The HIPAA addressable designation for encryption does not mean optional. It means the practice must document the assessment. Any practice that documents a decision not to encrypt ePHI and then experiences a breach will face OCR scrutiny of that decision under a post-breach evidentiary standard.
OCR settlement investigations cite three primary violations in medium practice breaches: no current risk analysis, no workforce training documentation, and impermissible ePHI disclosure without a Business Associate Agreement. All three are administrative failures, not technical ones.
Business Associate Agreements must be executed before data sharing begins and must cover the actual scope of data the vendor handles. An agreement executed after a vendor relationship started, or that covers a narrower scope than the current data flow, does not satisfy 45 CFR 164.308(b)(1).
BYOD policies that allow staff to access ePHI on personal devices without mobile device management create physical safeguard violations under 45 CFR 164.310. The Security Rule's physical safeguard requirements apply to the device accessing ePHI, not just the facility housing the data.
The minimum necessary standard under 45 CFR 164.502(b) is a Privacy Rule requirement that applies to internal access as well as external disclosure. Staff with EHR access beyond their clinical role are carrying an active HIPAA violation regardless of whether they ever access records impermissibly.
TL;DR
Medium healthcare practices have a HIPAA exposure pattern that neither small-practice templates nor enterprise frameworks address: controls built for one location that were never re-examined when the practice grew. The risk analysis covers the original site. The BAAs cover the original vendors. The access controls were scoped to the original staff population. Every expansion since then has created gaps that accumulate quietly until a breach or an OCR investigation makes them visible all at once.
The practice that complied at one location and violated at three
A physical therapy group with 28 staff across four locations had implemented HIPAA controls when they opened their first site in 2019. They had a signed BAA with their EHR vendor, a risk analysis, and annual security awareness training tracked by HR. By 2024, they had opened three additional locations, added a billing clearinghouse, onboarded a patient portal, and transitioned to a new scheduling platform. None of those changes triggered a review of the 2019 risk analysis. The BAA with the patient portal vendor had been executed by the operations manager, who used the EHR vendor's BAA template without legal review. The EHR access controls granted all clinical staff access to records across all four locations.
When a staff member at location three accessed records for patients she had never treated — a pattern that only became visible after a complaint — the OCR investigation that followed requested the current risk analysis, the patient portal BAA, and audit logs showing ePHI access events by location. The risk analysis was five years old. The patient portal BAA did not specify encryption requirements. The EHR audit logs showed cross-location access for 14 staff members with no documented clinical basis. Three separate violation categories. One practice that had believed it was compliant since 2019.
Why multi-location growth is a compliance event, not just an operational one
HIPAA's Security Rule requires a risk analysis that is accurate and thorough for the organization's current environment. When a medium practice opens a new location, the environment changes in ways that affect multiple control domains simultaneously. The network now includes new segments that were not in scope in the prior risk analysis. Physical access controls must be implemented at the new facility — workstation placement, visitor access, device storage. Staff at the new location need EHR access, which requires decisions about access scope and role configuration. Vendors that serve the new location may be different from vendors at the original site, or the same vendors may now be handling a larger data scope. Each of those changes is a trigger for a risk analysis update under OCR's published guidance.
Example
Access control drift is the most common technical finding in multi-location practice assessments. EHR systems typically configure access at the user level, not the location level, unless the practice has explicitly built location-based access policies into the role configuration. A practice that grants clinical staff 'full clinical access' at site one and replicates that role for new hires at sites two through four has given every staff member access to every patient record across all locations. The minimum necessary standard under §164.502(b) requires that access be limited to the minimum necessary to perform job functions. A therapist at location four has no clinical need for records from location one. The access control configuration violates the standard whether or not any impermissible access ever occurs.
Most EHR platforms support location-based access scoping. The configuration is not automatic — it requires deliberate setup of location-based roles and periodic review as staff roles change. Practices that use the EHR vendor's default role templates without customizing for location scope are operating with access controls that were not designed for multi-site deployment.
What assessments of medium practices consistently show
Assessment base: Vulnox assessment data, 2024-2025, medium healthcare practice engagements across physical therapy, dental, and multi-specialty groups
Risk analyses that predate significant operational changes
In assessments of medium practices with 2 to 6 locations, Vulnox finds that the risk analysis on file predates at least one significant operational change in the majority of engagements. The changes most frequently not reflected: addition of a patient portal, transition to a new billing clearinghouse, implementation of a telehealth platform, and — most commonly — the opening of additional practice locations. Practices treat the risk analysis as a compliance artifact produced during an initial implementation project, not as a living document that requires updating when the environment it describes changes.
An OCR investigator reviewing a breach at a four-location practice will ask when the risk analysis was last updated and what system changes have occurred since then. A risk analysis that predates the addition of two locations is not a current risk analysis for a four-location practice. The gap between the documented environment and the actual environment is both a finding in itself and evidence that the controls in the analysis may not have been applied to the uncovered portions of the environment.
BAA gaps with patient portal and scheduling platform vendors
Patient portals and scheduling platforms are the two vendor categories most frequently missing adequate BAAs in medium practice assessments. Patient portals are often implemented by clinical or operations staff who select the platform, configure it, and launch it without routing the vendor relationship through a BAA review process. Scheduling platforms that collect patient information to send appointment reminders are business associates under HIPAA if they handle ePHI in that process — a classification many practices and vendors do not recognize. The BAA gap is not usually that no agreement exists; it is that the agreement was executed using the vendor's standard terms, which frequently do not meet the specificity requirements of §164.308(b)(1) for HIPAA-covered data.
A patient portal breach at a medium practice will trigger OCR review of the BAA within the first evidence request. An agreement that does not specify the vendor's security obligations, does not include audit rights, and was executed using the vendor's standard business terms rather than a HIPAA-specific agreement is likely to generate a BAA deficiency finding alongside the breach finding.
BYOD creating physical safeguard violations that no one is tracking
Medium practices with telehealth programs or staff who access records remotely frequently have informal BYOD policies — not formal policies permitting personal device access, but an absence of any policy restricting it. Staff access the EHR on personal phones and tablets because it is convenient and no one has told them not to. The Security Rule's physical safeguard requirements under §164.310 apply to workstations that access ePHI. A personal device accessing ePHI is a workstation under this definition. Without mobile device management, there is no assurance that the device has disk encryption enabled, that it locks automatically, or that ePHI is not cached in the device's local storage or photo library.
BYOD physical safeguard violations are invisible until a device is lost or compromised. A staff member's personal phone, used to access the patient portal app, cached patient records in the app's local storage. The phone was stolen. The practice had no MDM, no remote wipe capability, and no policy documenting that personal device access was prohibited or managed. The physical safeguard failure was the finding. The stolen device was the trigger.
The access control that looks complete and covers too much
Common belief
Practices that have implemented an EHR with role-based access control, enforced MFA, and documented their access control policy believe their technical safeguards for access control are implemented. The policy exists. The roles are configured. MFA is running. The control is checked.
What we found
In assessments where practices cited MFA and RBAC as their primary access control evidence, Vulnox found that access scope violations under the minimum necessary standard were present in every engagement. The most common pattern: clinical roles configured with practice-wide record access because location-based scoping required additional EHR configuration that was never completed at the time of implementation.
MFA and role-based access control satisfy the authentication requirement under §164.312(d) and contribute to the access control requirement under §164.312(a). They do not satisfy the minimum necessary standard under §164.502(b), which is a Privacy Rule requirement that applies to the scope of access granted, not just the mechanism of authentication. A role that is authenticated via MFA and grants access to all patient records in a four-location practice still violates the minimum necessary standard if the user's clinical role does not require access to records from all locations. The authentication is secure. The access scope is excessive. Those are two different control requirements, and satisfying one does not address the other.
What medium practices say before the assessment
'We use a cloud-based EHR that is HIPAA-certified. The vendor manages security.'
Root cause:EHR vendors who describe their platform as HIPAA-certified are describing their own security posture, not the practice's compliance status. The vendor's BAA confirms that they will handle ePHI in accordance with HIPAA requirements on their side. It does not configure access controls, enforce the minimum necessary standard, or conduct the practice's risk analysis. The practice is responsible for configuring the EHR to reflect its own access control policies, for maintaining a risk analysis that covers the EHR environment, and for ensuring that workforce training addresses EHR-specific procedures. The vendor's certification covers the vendor. The practice's compliance is a separate obligation.
'We signed a BAA with every vendor we use. We went through the list a couple of years ago.'
Root cause:A BAA review conducted two years ago does not account for vendors added since then, vendors whose role has expanded since the agreement was signed, or vendors who have changed subcontractors or infrastructure in ways that affect their data handling. Medium practices with active growth have vendor relationships that change faster than biennial review cycles can track. The BAA that covered the billing clearinghouse for the original location may not have been updated when the practice added three locations and the clearinghouse began processing a materially larger volume of ePHI across additional payer relationships.
'Our staff completes HIPAA training every year. We have the certificates.'
Root cause:Annual training completion certificates confirm that staff sat through a training program. OCR's documentation requirement is more specific: evidence that training addressed each employee's responsibilities for ePHI under their specific role, was updated to reflect changes in policies and procedures, and was repeated when policies changed. A generic annual security awareness course covers the training completion requirement. It does not cover the role-specific training requirement for clinical staff handling patient records differently from administrative staff processing billing data. When OCR requests training documentation, they request content records alongside completion records.
What medium practice HIPAA programs consistently miss
Telehealth platform vendor relationships
Telehealth platforms implemented during or after 2020 are frequently missing adequate BAAs or operating under agreements that predate current HHS guidance on telehealth data handling. The OCR enforcement discretion period that covered some telehealth HIPAA requirements during the public health emergency ended in 2023. Practices that implemented telehealth under enforcement discretion and did not revisit their BAA and technical safeguard obligations after the discretion period ended are operating with compliance gaps that are no longer covered. The telehealth platform is a business associate. The agreement needs to meet current BAA requirements, not pandemic-era accommodations.
Contingency planning for practice-specific scenarios
HIPAA's contingency planning requirements under §164.308(a)(7) require data backup, disaster recovery, and emergency mode operation plans. Medium practices typically have a backup — either through the EHR vendor's cloud infrastructure or an internal backup solution. They rarely have a tested plan for operating when the EHR is inaccessible. The contingency plan needs to address how patient care continues, how ePHI is accessed during the outage, and what the practice's obligations are if backup data is also compromised. A plan that says 'contact EHR vendor support' is not an emergency mode operation plan.
Termination procedures for ePHI access
The Security Rule requires documented procedures for terminating access when employment ends or a role changes. Medium practices with high staff turnover — common in clinical settings — frequently have a gap between when a staff member's employment ends and when EHR access is terminated. In assessments, Vulnox finds former employees with active EHR credentials in every engagement where the practice uses manual termination procedures rather than automated deprovisioning tied to HR systems. The access window between termination and credential revocation is the insider threat exposure period — and it is entirely preventable.
Where HIPAA enforcement reaches medium practices
OCR will begin prioritizing medium-sized covered entities — specifically multi-location practices with 10 to 50 employees — for proactive audit program inclusion, following a pattern where breach data shows this practice size has the highest ratio of unreported violations to reported breaches.
OCR's breach data consistently shows that medium practices underreport breaches affecting fewer than 500 individuals, which are reported to OCR on an annual basis rather than immediately. The gap between unreported small breaches and the compliance posture those breaches reveal is a documented enforcement opportunity. OCR has stated publicly that the audit program will expand. Medium practices are a logical target because they have enough complexity to generate systematic violations but not enough resources to have retained compliance counsel who would identify the violations proactively.
Confidence: mediumA published OCR audit program update specifying medium-sized covered entities as a priority selection category, before Q2 2028.At least one medium healthcare practice group will face an OCR civil monetary penalty specifically for telehealth BAA failures — agreements that were never updated after the enforcement discretion period ended in 2023 — with the penalty triggered by a breach originating in the telehealth platform environment.
The enforcement discretion period created a population of practices with telehealth implementations that were stood up without full HIPAA compliance review. The discretion period ended. Most of those implementations have not been revisited. Telehealth platforms have experienced breaches at a higher rate than core EHR systems in the 2024-2025 period. The combination of unreviewed BAAs, incomplete technical safeguard implementation, and active breach risk in this vendor category makes a qualifying enforcement action predictable within a 24-month window.
Confidence: highA published OCR resolution agreement citing telehealth BAA failure as a primary violation category for a practice with fewer than 100 employees, before Q4 2027.
The compliance program that was built for one location is not a compliance program for four
Medium practices that expanded from one location to multiple and did not rebuild their HIPAA compliance program at each expansion point are not running a compliance program. They are running the original program, unchanged, applied to an environment it was not designed for. The risk analysis describes a different organization. The BAAs cover a subset of the current vendor relationships. The access controls were scoped for a single-site staff population. This is not a failure of intent — it is a structural failure in how HIPAA compliance programs are maintained during growth. Compliance programs need to be tied to organizational change events, not calendar cycles. Every new location is a compliance event. Every new vendor handling ePHI is a compliance event. Every new platform is a compliance event. Organizations that treat those as operational decisions and defer compliance review to the next annual cycle are accumulating violations with each change.
Counterargument
The counterargument is that tying compliance review to every operational change imposes an unsustainable burden on practices that are growing precisely because they are resource-constrained. A four-location physical therapy group does not have a compliance officer. The operations manager who is also managing vendor contracts, HR, and billing cannot conduct a scoped risk analysis update every time a new scheduling platform is onboarded. That is a fair description of the operational reality. It does not change what OCR will find when a breach occurs. The practical resolution is a lightweight change management checklist that triggers a scoped compliance review for specific event types — new vendor with ePHI access, new location, new remote access method — rather than a full program review. That is achievable. Deferring to the annual cycle is not.
One thing to do this week
Pull the list of every vendor your practice has shared ePHI with in the last 24 months and verify that each relationship has an executed BAA that was signed before data sharing began and covers the current scope of data the vendor handles. Start with your patient portal provider, your billing clearinghouse, and any telehealth platform. For any vendor where the BAA predates a significant expansion of the relationship — more locations, more data types, more users — flag it for legal review before the next OCR audit cycle reaches your practice size. The BAA gap is the finding OCR documents first, because it is the one that requires no technical investigation to identify.
Further Reading
Gap Analysis
framework gap analysisVulnerability Assessment
vulnerability assessment serviceHIPAA Official Homepage
HIPAA official guidanceNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideHIPAA Security Rule Summary
HIPAA Security Rule overview
Frequently Asked Questions
What HIPAA gaps are most common when a healthcare practice expands from one location to multiple?
Three gaps appear consistently in Vulnox assessments of multi-location practices. First, access controls configured for a single-site user population that were never scoped to location — staff at one site can access patient records from another site without clinical need, violating the minimum necessary standard under 45 CFR 164.502(b). Second, Business Associate Agreements executed with vendors at the original location that were never reviewed when new locations came with their own vendor relationships. Third, the risk analysis completed for the original site that was never updated to reflect the new network segments, physical access configurations, and data flows the additional locations introduced.
Does the HIPAA addressable encryption requirement mean a medium practice can skip encryption?
Technically, addressable means the organization must assess whether encryption is a reasonable and appropriate safeguard and document that assessment. In practice, any organization that documents a decision not to encrypt ePHI and then experiences a breach will face OCR scrutiny of that decision. The breach notification safe harbor under 45 CFR 164.402 requires NIST-standard encryption with proper key management — organizations that implement encryption but store keys in the same environment as the data have not satisfied the safe harbor. For medium practices, the operational risk of relying on the addressable designation is higher than the cost of implementing encryption correctly.
How often must a medium healthcare practice update its HIPAA risk analysis?
The HIPAA Security Rule requires that the risk analysis remain accurate and thorough — which means it requires updating whenever the environment changes. OCR guidance specifies that environmental and operational changes trigger the update requirement. For a medium practice, this includes adding a location, onboarding a new EHR integration, switching billing vendors, implementing a patient portal, or changing how staff access records remotely. A risk analysis that predates any of those changes is not a compliant risk analysis for the current environment. OCR settlements consistently cite outdated risk analyses as a primary violation category.
What makes a Business Associate Agreement inadequate for a medium healthcare practice?
The most common BAA failures in medium practices: agreements executed after the vendor began handling ePHI, agreements that do not specify the vendor's security obligations with enough precision to assign liability, agreements that do not include audit rights, and agreements that cover the original use case but were never updated when the vendor's role expanded. Medium practices with multiple billing vendors, a patient portal provider, an EHR vendor, and a clearinghouse frequently have BAA gaps with at least one of those relationships — either missing entirely or covering a narrower scope than the actual data sharing.
What does HIPAA workforce training documentation need to include to satisfy OCR?
OCR settlements that cite workforce training failures consistently involve one of two documentation gaps: no record that training occurred, or no record that training covered the specific topics required by the Security Rule for each employee role. Training completion logs need to show who was trained, when, on what topics, and that the training addressed the employee's specific responsibilities for ePHI. A generic annual security awareness course with a sign-in sheet satisfies less of this requirement than most practices assume. Role-specific training documentation — clinical staff training on minimum necessary standards, administrative staff training on PHI handling in billing workflows — is what OCR requests when training documentation is at issue.
What is the realistic HIPAA penalty exposure for a medium healthcare practice that experiences a breach?
OCR civil monetary penalties are tiered by culpability from $137 to $68,928 per violation, with annual caps per violation category reaching approximately $2 million. A breach that involves multiple violation categories — impermissible disclosure, inadequate BAA, outdated risk analysis — generates separate penalty exposure for each category. Beyond OCR penalties, medium practices face patient notification costs, credit monitoring obligations, and potential state attorney general actions. OCR settlements involving medium-sized covered entities have exceeded $500,000 in multiple recent cases. The practices that settled at lower amounts had documented evidence of proactive compliance efforts before the breach.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.