Multi-location practice IT: one record system, several front doors
For a practice running several sites off one system. What has to be documented, what has to be reported, and how fast.
Multi-location practice IT turns on two designations and one deadline. Legally separate sites under common ownership may designate themselves a single affiliated covered entity, which requires one written record kept six years. A change, addition or deletion of a practice location must reach Medicare within 30 days.
Adding an office starts a 30-day clock most practices do not know is running.
The Medicare enrolment rules list what has to be reported quickly and what can wait. Physicians, non-physician practitioners and their organisations must report a change of ownership, any adverse legal action, or a change, addition or deletion of a practice location within 30 days. All other changes in enrolment get 90 days.
Read the three verbs in that middle item. Opening a fourth office, closing one, or moving one all start the same 30-day clock. It is the single cheapest thing to get right on this list and the one most often missed, because a lease signing and an enrolment update live in different parts of the business.
The other half of the question is quieter and has no deadline attached, which is exactly why it drifts: whether the practice’s sites are one covered entity or several, and whether anyone has written that down.
Affiliated covered entity: a low bar and one document
The rule is short. Legally separate covered entities that are affiliated may designate themselves as a single covered entity, if all of the covered entities designated are under common ownership or control.
Both terms are defined. Common ownership exists when an entity possesses an ownership or equity interest of five per cent or more in another. Common control exists where an entity has the power, directly or indirectly, significantly to influence or direct the actions or policies of another. Five per cent is a low threshold, and most multi-site practices clear it without thinking about it.
What the designation requires is a single artefact: it must be documented, and the documentation maintained as a written or electronic record of a designation, kept for six years from the date of its creation or the date when it last was in effect, whichever is later. There is no filing, no application and no approval. It is self-executing and internal, which is precisely why it gets skipped.
Organized health care arrangement is a different thing entirely
Practices conflate the two constantly, and the distinction is clean once stated. The affiliated covered entity is an ownership concept. The organized health care arrangement is a clinical and operational one.
That arrangement is defined as a clinically integrated care setting in which individuals typically receive care from more than one provider, or an organised system in which more than one covered entity participates, where the participants hold themselves out to the public as participating in a joint arrangement and undertake at least one joint activity — utilisation review, quality assessment and improvement, or payment activities where financial risk is shared.
Nothing in that definition mentions ownership. And the effect differs: an affiliated covered entity becomes one covered entity, while participants in a joint arrangement stay separate entities that may share information for the arrangement’s joint operations.
The reason that deadline matters beyond the paperwork is what sits downstream of it on every claim. Medicare requires the place of service code to identify the setting for each item or service, and requires the name, address and postcode of the service location for everything other than services furnished in the home. Those two fields have to describe the same physical place, and that place has to be an enrolled location. A practice that opened a site in March and enrolled it in September has six months of claims pointing at an address the enrolment record does not contain. Keeping those two records aligned is part of our EHR solutions and of the managed IT services that sit underneath them.
One precision point, because most content on this overstates it. The claims manual does not say claims are rejected when the service address does not match the enrolled address. What it does is require the code to identify the setting and the address to identify the location. State the mechanism rather than a rejection threat that no primary source carries.
Has anyone written down whether your sites are one entity?
We will look at how records, risk analysis and enrolment line up across your locations and tell you which document is missing.
Per-site risk analysis: the obligation is per entity
This comes up every time a practice opens a second office, and the answer is in the text. The Security Rule requires the entity to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information held by the covered entity.
Held by the covered entity. There is no site, facility or location qualifier anywhere in that provision, and nothing requires a separate document per office. One analysis.
But the scope has to reach everywhere. The regulator’s guidance is explicit that an organisation’s risk analysis should take into account all of its electronic protected health information, regardless of the medium in which it is created, received, maintained or transmitted, or the source or location of it. A practice that analysed only its main office has not satisfied the requirement, whatever the document says on its cover.
Findings will still differ by site, and should. The rule requires the entity to take into account its size, complexity and capabilities and the probability and criticality of potential risks. A satellite in a shared building is not the main office, and an analysis that treats them identically has not been done, which is where our HIPAA compliance work usually starts. The regulator also notes there is no single method that guarantees compliance, which disposes of the bought-a-template defence.
Practice location reporting, and the place of service code downstream
A third designation gets reached for by mistake, and it is worth clearing up alongside the enrolment question because both turn on what the entity is rather than where it operates. A hybrid entity is a single legal entity that is a covered entity, whose business activities include both covered and non-covered functions, and that designates health care components.
The trigger is one legal entity doing both covered and non-covered work — not multiple sites. A practice with ten locations all delivering clinical care is not a hybrid entity, because nothing about it is non-covered. If the designation is made, it carries a firewall obligation: the health care component must not disclose protected health information to another component in circumstances where the rules would bar the disclosure between separate legal entities.
New Jersey, stated with its limits
We looked for a New Jersey requirement that a general medical or chiropractic practice separately register or license each location, and did not find one in the sources we could reach. The per-site obligations we did verify are facility-based and triggered by what happens in the room — surgical and ambulatory care settings — rather than by having several offices.
That is stated as not found rather than does not exist, deliberately. The state licensing boards serve their regulation pages from a domain that refuses automated retrieval, and the one comprehensive regulations document we located has no text layer. If this question is load-bearing for a specific practice, it needs a human reading the administrative code or a call to the board, and we would rather say so than imply a clean answer we did not get.
Running several sites: common questions
Do we need a separate HIPAA risk analysis for each office?
What is the difference between an affiliated covered entity and an organized health care arrangement?
How quickly does a new location have to be reported to Medicare?
What has to be documented for an affiliated covered entity designation?
Are we a hybrid entity because we have several locations?
Let’s meet
Qventive supports multi-site practices across New Jersey. Thirty years healthcare IT, one team for EHR and infrastructure.
- The affiliated covered entity designation, the common ownership and control tests, the hybrid entity firewall and the six-year documentation retention. ecfr.gov
- The 30-day reporting requirement for a change, addition or deletion of a practice location, last amended 2 December 2025. ecfr.gov
- The requirement to assess risks to electronic protected health information held by the covered entity. ecfr.gov
- The guidance that a risk analysis should take into account all electronic protected health information regardless of source or location, posted 14 July 2010. hhs.gov
- Place of service and service facility location instructions, Medicare Claims Processing Manual chapter 26, revision 12779 issued 9 August 2024. cms.gov