Continuous HIPAA Risk Management for Mid-Size and Rural Hospitals: What It Involves and Who Does the Work

Continuous HIPAA risk management means a hospital's Security Risk Analysis stays open all year. In practice it is a standing risk register, remediation items with named owners and due dates, advisor check-ins on the calendar, and a fresh pass at the analysis whenever a new system, site, or vendor changes the risk picture. Small and mid-size hospitals, including rural and critical access facilities, can run this model without an enterprise GRC department. That is the point of it.

What the law requires today

Every hospital that handles electronic protected health information is required, today, to conduct an accurate and thorough assessment of the risks and vulnerabilities to that information. That is the Security Risk Analysis at 45 CFR 164.308(a)(1)(ii)(A), and it is a Required implementation specification, not an addressable one. The 2026 Security Rule update that would tighten several related expectations is still a proposed rule (an NPRM), not final law, so the obligation to know your risks does not wait on it. When OCR investigates a breach, the risk analysis is among the first documents requested, and its date matters: an assessment that predates your current EHR describes a hospital that no longer exists.

What point-in-time looks like, and what continuous looks like

A point-in-time program produces a report with a date on it. Between that date and the next engagement, new servers go live, a clinic gets acquired, a vendor changes subprocessors, and none of it lands anywhere.

A continuous program has furniture:

• A risk register that stays open, with each risk scored and owned.
• Remediation tracking: items, owners, due dates, and evidence when they close.
• A named advisor who already knows your environment, reachable through the year rather than only at assessment time.
• A trigger habit: new EHR module, new delivery site, new imaging vendor, updated risk analysis.
• Documentation that accumulates, so next year's assessment starts from this year's instead of from a blank workbook.

None of that requires new headcount. It requires a platform that keeps the register and a person who keeps the cadence.

The part software alone cannot do: 45 CFR 164.310

The Security Rule's physical safeguards cover facility access controls, workstation use and security, and device and media controls. In a hospital those are concrete questions. Who can reach the server closet, and does the badge log show it? Where do workstations on wheels sit when a nurse steps away? How are retired drives and backup media destroyed, and where is the disposal log? What happens to paper charts in the release-of-information room?

Answering those questions requires someone to assess the facility itself. A hospital risk analysis that skips the physical walkthrough is incomplete on its face, because 164.310 is part of the rule being analyzed.

Multi-site hospitals: one engagement, every site

A hospital is rarely one building. There is a main campus, outpatient clinics, rural health clinics, an attached billing office, sometimes a recently acquired practice still on its own systems. Medcurity runs multi-site Security Risk Analyses under a single engagement: every delivery site assessed, one risk register, one remediation queue, one set of documentation an auditor can follow. Compliance officers at multi-site organizations manage it from one dashboard instead of reconciling site-by-site spreadsheets.

Who this fits, and who it does not

Candor is cheaper than a bad-fit engagement, so here is the map. A large integrated delivery network with a multi-state footprint and an in-house GRC team is usually shopping for an enterprise consultancy; Clearwater is the established name in that segment. A solo practitioner can start with the free SRA tool HHS publishes. The middle of the market is where Medcurity works: small and mid-size hospitals, rural and critical access hospitals, FQHCs and community health centers, and clinics that need the work done right without enterprise overhead.

What working with Medcurity looks like

Medcurity has supported 1,000+ organizations since 2018 and holds a 100% OCR acceptance rate. Hospital engagements pair the platform with people: an onsite assessment of the 164.310 physical safeguards, a compliance advisor available through the year rather than only at assessment time, multi-site coverage under a single engagement, and expert review of the finished analysis. The Security Risk Analysis starts at $499 per year and is right-sized from there, so a critical access hospital is not paying for an IDN's tooling.

If your last risk analysis is a PDF with a date on it, talk with the team about what keeping it open year-round would take at your facility count.

Who Is Responsible When Your Billing Company Is Breached?

Short answer: both of you, in different ways, and your responsibility does not end because the failure happened somewhere else.

This comes up every time a healthcare vendor makes the news. A billing company, a transcription service, or a scheduling platform is compromised, and the practices that used it spend the following week working out what they owe their patients.

Here is how the responsibility divides.

Your vendor's obligations

A vendor handling patient information on your behalf is a business associate. Business associates are directly regulated. They must safeguard the information, and when a breach happens on their side they must notify you without unreasonable delay and no later than 60 days from discovery, under 45 CFR §164.410.

They can face enforcement directly. The Office for Civil Rights has taken action against business associates, not only against the practices that hired them.

Your obligations

Yours do not transfer. Three things remain with you.

Notifying patients. Unless your agreement says otherwise, notifying affected individuals is the covered entity's duty, which means yours. The clock and the content are set by the Breach Notification Rule, and your vendor's notification to you is the starting gun rather than the finish.

Having had an agreement in place. A signed Business Associate Agreement is required before the vendor touches the information. Discovering during a breach that the agreement was never signed, or was signed in 2019 with a company that has since been acquired, is its own finding separate from the breach.

Having assessed the arrangement. Your Security Risk Analysis is supposed to account for the risks of sending patient information outside your walls. A vendor relationship that never appeared in your assessment is a gap that predates the incident.

The part that decides how bad it gets

When OCR reviews a third-party breach, the questions tend to be the same.

• Was there a current signed agreement with this vendor?
• Did your risk analysis account for this relationship?
• What information did the vendor hold, and why did they need that much?
• How quickly did you notify once they told you?
• Do you have a record of any of this?

Notice that four of the five are answerable before an incident. The organizations that come through a vendor breach reasonably well are usually the ones that could produce those answers from a file rather than reconstruct them under pressure.

What to do this quarter

Not a project. A short list.

1. Pull every vendor that touches patient information and confirm a current signed agreement exists for each one. Include the ones you inherited and the ones that changed ownership.
2. For each, write down what data they receive and why. Anything they do not need is risk you are carrying for no benefit.
3. Confirm each agreement names a notification timeline and a contact who still works there.
4. Make sure your Security Risk Analysis reflects this list rather than a version from two years ago.
5. Decide now who at your organization makes the notification call, so that decision is not being made for the first time on the day it matters.

Step one usually takes longer than people expect, and the reason is worth knowing: agreements tend to live in whoever's filing system signed them, which is rarely one place.

A note on the 2026 rule changes

You may have seen vendors citing new HIPAA Security Rule requirements. The updated Security Rule is a proposal. It has not been finalized, and nothing in it is a requirement today. Some of what it proposes would tighten expectations around vendor oversight, so it is worth watching, but you are not behind on rules that do not yet exist.

What is true today is that risk analysis is already required, and that vendor relationships belong inside it.

If the list is longer than you thought

Most organizations find more vendors than they expected, and the tracking becomes real work somewhere around the point where renewal dates stop fitting in one person's memory.

We build Medcurity for this kind of work, including Security Risk Analysis and Business Associate tracking, with advisors available through the year rather than only at assessment time. The self-serve Security Risk Analysis starts at $499/year for organizations up to 20 staff and scales with organization size. If you want it scoped against your real vendor count, start a conversation with our team.

Whichever way you handle it, do the vendor list before you need it. It is the cheapest hour in compliance and it is the first thing anyone asks for.