A hospital system spanning 15 buildings, a dozen satellite care centers, and more than 6,000 connected and disconnected medical devices doesn’t have a single HIPAA risk profile. It has dozens, all needing to be accounted for at once. 

Amplix conducted this large not-for-profit teaching hospital system’s annual HIPAA Security Risk Assessment, evaluating the administrative, physical, and technical safeguards protecting patient data across its EHR platform and every other system that touches it.  

Quick Answer  A HIPAA Security Risk Assessment for a multi-site health system needs to account for every location, device, and system that creates, receives, maintains, or transmits ePHI, not just the primary EHR. Amplix’s assessment of a large multi-site health system found gaps in business associate agreement tracking, device inventory, and physical security across a campus of 15 buildings and 10+ satellite centers.

The Challenge 

A Large, Distributed Environment with Limited Oversight 

The health system’s main campus alone includes an emergency room, physician offices, a cancer center, and a diagnostic center, plus ten additional primary and specialty care centers spread across its service area. A single IT security team of roughly 30 people was responsible for installation, configuration, inventory, monitoring, and access control across all of it. 

• More than 6,000 connected and disconnected medical devices exist across the system, some accessible remotely 
• Several departments had purchased hardware and software outside the knowledge and control of the IT security department 
• An initial document request yielded over 100 policy and procedure documents, most in unsearchable PDF (image) format 
• Business associate agreements were often incomplete, out of date, or missing entirely 
• Physical security controls across the distributed footprint were subpar 

The Approach 

A Nine-Step Risk Assessment Methodology 

Amplix scoped the assessment around the health system’s EHR platform and its surrounding operations, then worked through a structured methodology: scoping the assessment, collecting data, identifying and documenting threats and vulnerabilities, assessing current security measures, determining the likelihood and potential impact of each threat, calculating overall risk level, and finalizing documentation for periodic review. 

This approach let the assessment scale across a genuinely distributed environment (multiple buildings, multiple care center types, and thousands of devices) without losing track of where accountability actually sat. 

The Solution 

Turning Findings into an Actionable, Trackable Plan  

Amplix’s recommendations focused on giving the health system tools it could maintain long after the assessment concluded:

• A report outlining improvements to inventory and asset management for all devices containing ePHI, including excess and decommissioned equipment 
• A documented disposal process for ePHI-containing devices, with clinical engineering staff ensuring an IT team member is present during installation, movement, and disposal 
• A business associate agreement tracking spreadsheet denoting what’s in place, the scope of ePHI access granted, and when each was last signed and reviewed 
• A recurring procedure for reconciling the BAA list against the active vendor list, rather than relying on one-time documentation 
• An expiration date requirement on vendor and contractor badges to tighten physical access control 

The Outcome 

A Health System That Can Track Its Own Risk Going Forward

Rather than a static report, the health system came away with living tools: a BAA tracking spreadsheet it could update as vendor relationships changed, an asset disposal process with clear departmental ownership, and a documented plan for keeping business continuity and incident response plans current. Physical security improvements and tighter asset inventory tracking closed gaps that manual, ad hoc processes had let slip. The organization now has both a snapshot of its risk and a repeatable process for reassessing it. 

Why Amplix 

A health system this size doesn’t have one HIPAA risk profile. It has as many as it has buildings, devices, and vendor relationships, and each one needs to be tracked, not just assessed once. Amplix helps healthcare organizations build risk assessment processes that scale with their footprint. Learn more about Amplix’s cybersecurity capabilities, or talk with an Amplix advisor about your own HIPAA risk assessment. 

---

Frequently Asked Questions

What is a HIPAA Security Risk Assessment?  

It’s a structured evaluation of the administrative, physical, and technical safeguards protecting electronic protected health information (ePHI), required annually under HIPAA’s Security Rule. 

What is a HIPAA business associate agreement? 

A business associate agreement (BAA) is a contract between a covered entity and any vendor or partner that creates, receives, maintains, or transmits ePHI on its behalf, outlining how that data must be protected. 

Who needs to sign a business associate agreement under HIPAA? 

Any vendor, contractor, or third party that handles ePHI on behalf of a covered entity needs a signed BAA in place before that access begins. 

How often is a HIPAA risk assessment required? 

HIPAA requires risk assessments be conducted periodically, and most healthcare organizations complete a full assessment annually to keep pace with changes in technology, vendors, and regulations. 

How does a multi-site health system manage HIPAA risk across so many locations and devices? 

It requires centralized inventory tracking, a documented device disposal process, regularly reconciled business associate agreements, and a risk assessment methodology that scopes each location and system individually rather than treating the organization as a single environment.