Per-Site Risk Analyses Don't Add Up to One Enterprise-Wide Analysis

A HIPAA Security Risk Analysis is scoped to the entity, not the building. If your organization runs six
sites and you have six separate risk analyses, you do not have an enterprise-wide analysis. You have six
documents and a merge problem.

This distinction is easy to miss because per-site assessments feel more thorough. Each location got its own
attention. The trouble is that the rule sets the boundary somewhere else.

The scope boundary is the ePHI, not the facility

45 CFR §164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of risks and vulnerabilities to all
electronic protected health information held by the covered entity or business associate. The scope follows
the data. Wherever ePHI is created, received, maintained, or transmitted by the entity, it is in scope, on
whatever system and at whatever location.

That produces a different question than "did we assess each site." The question is whether the analysis
accounts for every place the entity's ePHI lives. Those are not the same set, and the difference is where the
gaps sit.

The gaps that survive a per-site approach

Six that turn up repeatedly when site-level assessments get consolidated:

1. Systems shared across sites and owned by none of them. The central scheduling instance, the shared file server, the enterprise imaging archive. Each site's assessment treats it as somebody else's system.
2. ePHI outside the EHR. Fax servers with retained documents, scanner spools, report exports built for a grant submission, secure messaging archives, backup media. This is usually the largest category and the one nobody owns.
3. Sites added since the last assessment. An acquired practice or a new satellite. Growth outpaces the assessment cycle and the new location is not in any document.
4. Physical safeguards at smaller locations. §164.310 covers facility access controls, workstation use and security, and device and media controls. A remote questionnaire records what someone believes about a building nobody assessed in person.
5. Business associates unique to one site. The local shredding vendor or the regional courier the main campus does not use. A BAA inventory assembled centrally misses it.
6. Remote and hybrid staff. Coders, schedulers, and telehealth clinicians working from home are inside the entity and inside the scope.

Notice that four of the six are invisible from inside any single site's assessment. They are properties of the
organization, and only an enterprise-wide view surfaces them.

What consolidation requires

Merging per-site documents into an enterprise view is not a formatting exercise. To do it properly you need:

• One asset inventory spanning all sites, with each system attributed to the locations that use it
• A single scope statement naming every included location and department, and anything deliberately excluded with its reason
• Risk determinations made on a consistent method, so that "high" means the same thing at every site
• One remediation plan with owners and dates, rather than six lists with overlapping items
• A record of periodic review and of reassessment after material change

The consistency requirement is the one that usually breaks a merge. If site A rated a finding high and site B
rated the same finding medium, the consolidated analysis has to reconcile them, and there is often no basis on
which to do it.

The architectural version of the problem

For engineers this maps onto something familiar. Per-site assessments are the compliance equivalent of
per-service monitoring with no aggregation layer. Every service reports healthy. Nobody can answer whether the
system is healthy, because the question was never asked at the level where it matters.

Enterprise-wide scope is the aggregation layer. Each site is still assessed in its own right. The findings roll
up into one analysis of one entity, on one method, producing one remediation plan and one answer to "where do
we stand."

If you are trying to work out where you are

A quick test. Can you name, right now, every location and every system in the current scope of your
organization's Security Risk Analysis? If yes, you are in reasonable shape. If you would have to go and check,
the uncertainty is itself the finding, and it is a solvable one.

---

Medcurity models multiple sites under a single engagement, with each location assessed individually and rolled
into one enterprise-wide analysis. We have guided more than 1,000 healthcare organizations through Security
Risk Analysis since 2018, from private practices to large health systems. If it would help to talk through
scope for your sites, start a conversation with our team.