When two healthcare organizations merge, patient data doesn’t merge with them automatically. It arrives as two sets of policies, two IT security teams, and two ways of doing almost everything, all needing to become one.

A multi-state healthcare management services organization formed through the combination of two legacy organizations engaged Amplix to conduct its annual HIPAA Security Risk Assessment. One of the first findings: 35 policies from one legacy organization that the other side hadn’t been able to obtain for years. Amplix retrieved them in two weeks.

Quick Answer: A HIPAA Security Risk Assessment after a merger needs to reconcile two full sets of policies, systems, and personnel into one compliant environment. Amplix’s assessment of a newly merged healthcare MSO recovered 35 missing legacy policies in two weeks and identified gaps in audit reporting, disaster recovery planning, and incident response documentation.

The Challenge 

One Organization, Two of Everything  

The MSO’s environment was shaped by an in-progress merger, and the compliance picture reflected that. Several separate EHR systems existed to manage the same categories of patient data, each carried over from a legacy organization rather than consolidated into one. 

• Two different sets of policies and procedures were still in effect, one from each legacy organization 
• Two separate IT security systems and personnel teams operated independently of each other 
• Different geographic footprints, funding sources, decision-makers, and points of contact all needed to merge into a single structure 
• One legacy organization hadn’t been able to obtain copies of the other’s policies for years   

The Approach 

A Full Review, Reconciling Two Environments Into One 

Amplix’s assessment covered the full scope of HIPAA Security and Privacy documentation. That meant reviewing policies and procedures, network diagrams, roles and responsibilities, asset inventories, access control lists, and business associate contracts, then verifying it all through interviews with stakeholders and site walk-throughs at both corporate and satellite locations. 

Where documentation was missing, Amplix went and got it. One legacy organization had been unable to obtain copies of the other’s policies for years; Amplix retrieved 35 of them within two weeks. 

The Solution 

A Reconciliation Plan, Not Just a Findings List 

Amplix’s recommendations were built around unifying two environments into one compliant organization: 

• Develop a process for reviewing and updating policies and procedures for the newly merged organization, rather than maintaining two parallel sets 
• Generate monthly audit reports for the Security Officer, since none had existed previously 
• Establish a secondary site for disaster recovery to restore critical systems and services if the primary environment went down 
• Conduct a Business Impact Analysis and update Business Continuity and Disaster Recovery plans for the merged organization, with annual testing going forward 
• Update the Computer Security Incident Response Plan to align with the new BC/DR plans, also tested annually 

The Outcome 

A Documented Foundation for the Newly Merged Organization  

The MSO came away from the assessment with a specific plan for consolidating two compliance environments into one, backed by documentation that had been missing for years on one side of the merger. Monthly audit reporting gave the Security Officer ongoing visibility that hadn’t existed before. Updated BC/DR and incident response plans, tied together and tested annually, replaced two disconnected legacy plans with a single, current one.

Why Amplix 

A merger doesn’t pause HIPAA’s requirements while two organizations sort out whose policy applies. Amplix helps healthcare organizations reconcile compliance environments during a merger instead of leaving legacy gaps to surface later. Learn more about Amplix’s cybersecurity capabilities, or talk with an Amplix advisor about your own compliance environment. 

---

Frequently Asked Questions

Does a HIPAA Security Risk Assessment need to be redone after a merger or acquisition?

Yes. Combining two organizations’ systems, policies, and personnel creates a new compliance environment that needs its own assessment rather than relying on either legacy organization’s prior results. 

What documents does a HIPAA risk assessment typically review?

A thorough assessment reviews policies and procedures, network diagrams, roles and responsibilities, asset inventories, access control lists, and business associate agreements and contracts.

What is a Business Impact Analysis in the context of HIPAA compliance?

A Business Impact Analysis (BIA) identifies which systems and processes are critical to operations and how quickly they need to be restored after a disruption, forming the foundation for an organization’s disaster recovery planning. 

How often should business continuity and disaster recovery plans be tested? 

Most healthcare organizations test BC/DR plans annually at minimum, and more frequently after significant environment changes such as a merger or system migration. 

What is a HIPAA Security Risk Assessment? 

It’s a structured evaluation of the administrative, physical, and technical safeguards protecting electronic protected health information (ePHI), required annually under HIPAA’s Security Rule.