Policy PDFs Aren't Evidence: What Multi-Site Medical Groups Need for Payer and Cyber-Insurance Questionnaires

You have a Notice of Privacy Practices. Your policy binder lives on SharePoint. The office manager knows where the BAA folder is. Then a questionnaire from a payer, a hospital partner or a cyber underwriter lands and asks: “When did you last update your risk analysis to reflect the new billing system?” or “Provide evidence that MFA is enforced for all users with ePHI access across locations.” The policy PDF does not answer those questions. The NPP definitely does not.

Multi-site medical groups face a growing expectation gap. OCR enforcement, cyber insurance underwriting, and payer credentialing all ask for operational proof of HIPAA compliance — not statements of policy, but dated evidence that controls exist, were tested, and cover every location. If your group added a second clinic last year, expanded EHR access to a third site, or switched billing vendors, the questionnaire is going to ask how that change made it into your risk analysis and what controls you implemented as a result. A policy that says “we conduct annual risk analyses” is not evidence. A dated risk analysis deliverable that scopes the new location is.

OCR Expects Risk Analysis Scope to Track Operations

OCR’s July 7, 2025 settlement with Deer Oaks – The Behavioral Health Solution reinforced a pattern that multi-site groups cannot ignore: the HIPAA risk analysis requirement applies across your organization, and it must be updated when operations change. Deer Oaks paid $225,000 and accepted two years of OCR monitoring after OCR investigated two incidents: discharge summaries exposed online through a patient-portal coding error, and a 2023 breach through a compromised account that affected 171,871 people. OCR found Deer Oaks had failed to conduct an accurate and thorough risk analysis. OCR Director Paula Stannard noted that common deficiencies include failing to update risk analyses when implementing new technologies or expanding operations.

The Deer Oaks resolution agreement and press release are published by HHS. OCR’s July 2025 press release named failing to update the risk analysis “when implementing new technologies or expanding operations” as a common deficiency. OCR’s Risk Analysis Initiative, launched in late 2024, has continued producing enforcement actions through 2026, aimed at organizations that skipped the risk analysis or let it go stale.

For a multi-location group, this requirement is unambiguous. If you added a second office, you cannot treat the risk analysis as complete until it documents how ePHI moves between locations, where patient data is stored at the new site, and what network or cloud architecture connects them. If you brought on a new EHR vendor or shifted billing to an external clearinghouse, the risk analysis must identify the new third-party relationships and the controls that protect ePHI in those workflows. OCR’s 2010 risk analysis guidance says the scope covers all e-PHI an organization creates, receives, maintains or transmits, including “complex networks connected between multiple locations”: HHS.gov/HIPAA/for-professionals/security/guidance/guidance-risk-analysis.

When OCR investigates a breach or responds to a complaint, one of the first documents they request is the risk analysis. If the document does not reflect your current operations, OCR treats that as a compliance failure independent of whatever incident triggered the investigation. For multi-site groups, the question is not whether you have a risk analysis — it is whether the risk analysis your office manager can find in thirty seconds scopes all your locations and reflects your current EHR, billing, and telehealth workflows. If it does not, you are in Deer Oaks territory.

Use the ONC/OCR Security Risk Assessment Tool for Multi-Location Scope: The Office of the National Coordinator for Health IT and OCR jointly publish the Security Risk Assessment Tool, a free Windows desktop application that walks covered entities through a structured risk analysis process. Version 3.7 adds a scope question covering every location that handles ePHI. It will not do the risk analysis for you, but it will keep you from accidentally scoping only one office when you operate three. ONC notes the tool targets small and medium providers and may not be appropriate for larger organizations. Download it at HealthIT.gov.

Cyber Insurance Applications Ask Control Questions You Must Demonstrate

Cyber insurance underwriters increasingly follow up a “yes” to “Do you enforce multi-factor authentication?” with more questions: MFA on what systems? Enforced for which user roles? What happens when a clinician logs in from home? Can your billing staff bypass MFA if the token fails?

These are control-implementation questions, and they require evidence. A written policy that mandates MFA is a start, but the underwriter wants proof that the policy is operationally true — screenshots of MFA enforcement settings in your EHR, logs showing MFA enrollment across your user base, or a signed attestation from your IT vendor confirming that no ePHI system allows username/password-only access. The same pattern applies to encryption, offline backups, security training, PHI volume estimates, and incident response capability. The questionnaire is testing whether your compliance posture is documented and auditable, or whether it lives in the IT vendor’s head and your office manager’s email.

A representative example is CRES Insurance’s general cyber liability questionnaire, which asks for PII/PHI record counts, which services enforce MFA (including remote access), whether weekly backups are kept offline or on a separate network, and whether security training is mandatory at least annually. Most of those questions map to a Security Rule standard: risk analysis (164.308(a)(1)(ii)(A)), security awareness training (164.308(a)(5)), data backup (164.308(a)(7)(ii)(A)) and person or entity authentication (164.312(d)). Each one is answered best with an artifact or system configuration you can demonstrate, not a policy statement.

For multi-site groups, the underwriter will also ask whether the controls are consistent across locations. If your main office has MFA and your satellite clinic does not, that is a coverage red flag. If your EHR enforces encryption at rest but your imaging center’s PACS server does not, the underwriter treats that as a gap. If your billing vendor signed a business associate agreement but you have never audited their security practices, the application will ask you to explain how you monitor third-party risk. The questions are not theoretical — they reflect the breach patterns insurers see in claims data.

Some carriers now ask whether you have tested your incident response plan; a dated tabletop summary answers that question. A documented IR plan is useful, but a dated tabletop scenario with participant sign-in and a post-exercise debrief note demonstrates that your staff has rehearsed the plan.

EHR and Billing Transitions Expand the Evidence Surface

When a multi-site group migrates to a new EHR, switches billing clearinghouses, or consolidates practice management systems across locations, the compliance surface expands in ways that policy binders do not track. Each of those transitions introduces new third-party relationships, new data flows, and new technical risk that must be documented in the HIPAA risk analysis and managed through business associate agreements.

The EHR migration itself is a high-risk event. Patient data moves from the old system to the new one, often through an intermediary migration vendor. That vendor becomes a business associate, and you need a signed BAA before the data moves. The new EHR vendor also requires a BAA, and the terms of that agreement should specify how ePHI is encrypted, who has administrative access, and what breach notification obligations the vendor carries. If the old EHR system remains accessible during a transition period for reference or reporting, that is another system in scope for your risk analysis.

Billing transitions follow the same pattern. If you move from in-house billing to an external clearinghouse, the clearinghouse is a business associate. If the clearinghouse subcontracts eligibility verification or claims scrubbing to a downstream vendor, that subcontractor is also a business associate, and your BAA with the clearinghouse should require them to obtain a downstream BAA. The same applies to patient portal vendors, telehealth platforms, medical transcription services, and any SaaS tool that touches ePHI. Every one of those relationships should appear in your BAA inventory, and your risk analysis should document how each vendor’s security controls were evaluated before you transmitted ePHI to them.

For multi-site groups, the evidence layer that matters is the BAA inventory and the risk analysis update date. If your last risk analysis is dated 2023 and you migrated to a new EHR in 2024, OCR will ask why the analysis does not reflect the new system. If your BAA folder contains agreements with three vendors but your billing workflow relies on five, the gap will surface in an audit or breach investigation. The expectation is not perfection — it is documentation that tracks operational reality.

The Notice of Privacy Practices also requires attention during transitions. A new location must have the current NPP available on site and posted prominently, and new patients must receive it no later than their first service delivery (164.520(c)(2)). When you revise it, make the new version available on request and update what is posted at every site. If you change how you use or disclose ePHI — for example, by introducing a patient portal that allows patients to share records with third-party apps — you may need to revise the NPP to reflect that new workflow. The NPP is not evidence of HIPAA compliance, but an outdated or inconsistent NPP across locations is an OCR finding waiting to happen.

The Artifact Set Payers and Underwriters Expect

When a payer credentialing committee or a cyber underwriter asks for HIPAA compliance evidence, they expect a set of dated, organization-scoped deliverables that demonstrate your controls are operational across all locations. The following checklist reflects the artifact set these questionnaires typically ask about:

Dated enterprise risk analysis covering all locations: The deliverable should include scope definition, identified vulnerabilities, likelihood and impact assessment, and risk level assignments. If the document does not explicitly list each office location and each ePHI system, it is not enterprise-scoped.
Risk management plan with assigned ownership: For each finding in the risk analysis, document the remediation action, the responsible individual, and the target completion date. If a finding is accepted rather than remediated, document the business justification.
MFA enforcement evidence: Export MFA enrollment reports from your EHR, email system, and any remote access tools. If your IT vendor manages MFA, request a signed attestation confirming enforcement settings and coverage scope.
System activity review samples: Retain logs or screenshots showing that administrative access to ePHI systems is monitored. A quarterly review note with findings and sign-off is sufficient — you are demonstrating process, not perfection.
Business associate agreement inventory: List every vendor, clearinghouse, transcription service, portal provider, and IT management firm that handles ePHI on your behalf. Confirm each BAA is signed, current, and covers breach notification, subcontractor requirements, and termination data return.
Security training attestations: Maintain training records for all workforce members. The Security Rule requires a security awareness and training program (164.308(a)(5)) and the Privacy Rule requires training for new workforce members within a reasonable period (164.530(b)). Annual refreshers are best practice and what insurers ask about. A sign-in sheet, LMS export, or emailed attestation is the record.
Backup and restore log: Retain evidence that backups run on schedule and that at least one backup set is stored offline or in immutable storage. A restore test log — even an annual one — demonstrates the backups are viable.
Incident response or tabletop documentation: Documented security incident procedures are required (164.308(a)(6)), but a tabletop exercise summary with participant names and a debrief note shows the plan has been tested. If you have had an actual incident, document how it was detected, contained, and resolved.

None of these artifacts require expensive software or outside consultants to produce. They require time, attention, and a commitment to documentation discipline. The groups that struggle with questionnaires are not the ones missing sophisticated tools — they are the ones that cannot locate a dated risk analysis, do not know which vendors have signed BAAs, and have no record of the last time backups were tested. The artifacts list above is the minimum viable evidence set for a multi-site group operating in the current credentialing and underwriting environment.

The Evidence Gap Is Closeable

Multi-site medical groups do not fail questionnaires because the controls are missing — they fail because the evidence is missing. The MFA might be enforced, but no one exported the enrollment report. The BAAs might be signed, but they live in three different email accounts and no one compiled the list. The risk analysis might have been conducted, but it predates the second location and no one updated it. These are documentation gaps, not security gaps, and they are closeable with structured effort.

The exercise that clears many questionnaire stalls is the artifact inventory. Sit with your office manager, your billing lead, and your IT contact. Open the BAA folder and count how many agreements you have versus how many vendors handle ePHI. Pull the most recent risk analysis and check whether it lists all locations and current systems. Check MFA settings in your EHR and email admin consoles. Export a backup log. Find the training sign-in sheet from last year’s HIPAA session. If any of those artifacts are missing or outdated, you know what to fix before the next credentialing cycle or insurance renewal.

For groups that have deferred the risk analysis entirely, the floor is higher but the path is the same. Commission the analysis now, scope it to every location and system, document the findings, and build the risk management plan. OCR’s Risk Analysis Initiative is active, cyber insurance markets are tightening, and payer credentialing committees are asking harder questions. The groups that get through those gates without delay are the ones that treated documentation as part of operations, not as an audit response.

Privacy Medic helps multi-location health groups assemble the evidence set credentialing and underwriting questionnaires require — without turning it into a binder project. If your group is expanding, transitioning systems, or facing a questionnaire you cannot answer with current documentation, that is a fixable problem.

Sources and References

U.S. Department of Health and Human Services, Office for Civil Rights. (2025, July 7). Deer Oaks – The Behavioral Health Solution Resolution Agreement. HHS.gov; press release
U.S. Department of Health and Human Services, Office for Civil Rights. (2010, July 14). Guidance on Risk Analysis Requirements under the HIPAA Security Rule. HHS.gov
Office of the National Coordinator for Health IT. Security Risk Assessment Tool. HealthIT.gov
CRES Insurance. (2024). Cyber Liability Questionnaire. cresinsurance.com