A Texas group with 6 offices is not 6 small practices. Breach thresholds, records-access clocks and risk-analysis scope all count the whole entity, while networks, door locks and front desks stay stubbornly local. That gap is where multi-site medical IT breaks. Here is how groups running 3 to 30 Texas locations close it, and what changes the day you open the second door.
What multi-location medical practice IT management actually covers
Multi-location medical practice IT management means running one clinical system, one identity directory and one security program across separate offices, where each site keeps its own network but every patient record belongs to a single covered entity.
The work splits in 2. Those halves pull against each other. Half is consolidation, which is where most healthcare IT management effort goes. One EHR tenant, one Microsoft 365 directory, one backup target, one set of policies. The other half stays local, because a check-in kiosk in Sugar Land cannot be fixed from Dallas and a modality in a Plano imaging suite does not move. Groups get into trouble when they treat that second half as an afterthought, or when they let each office solve it alone. We cover the general version of this in our guide to IT support for multi-location businesses. Healthcare changes the math. This is the part that changes it.
Every office adds patients. Only the entity gets counted.
Here is the inversion. Nobody plans for it. Your practice grows one office at a time. Almost every obligation you answer to, though, is measured against the whole organization. A single 11-person clinic rarely crosses a public reporting threshold alone. Six of them sharing a file server cross it in an afternoon.
Worth writing down. The difference between a quiet incident and a press release is arithmetic, not judgment.
| What it triggers | Threshold | Counted where | Clock |
|---|---|---|---|
| Written notice to affected patients | Any breach of unsecured PHI | Entire covered entity | 60 calendar days from discovery |
| Notice to the Texas Attorney General | 250 Texas residents | Entire covered entity | 30 days from determination |
| Notice to HHS alongside the patient letters | 500 individuals | Entire covered entity | Contemporaneous with patient notice |
| Notice to prominent Texas media outlets | More than 500 Texas residents | Entire covered entity | 60 calendar days from discovery |
Run a group with 4 clinics. Say a shared scheduling server holds 160 active patient records per site. Any one clinic sits at 160. That means patient letters and an entry in the annual log to HHS. Nothing more. Now put those same 4 sites behind one server and the count is 640, which clears the 250-resident Texas Attorney General trigger under Business and Commerce Code 521.053, clears the 500-individual HHS trigger in 45 CFR 164.408, and clears the media threshold in 45 CFR 164.406. Same incident. Same records. Different consequence entirely, because the sites are one entity.
One detail here catches out-of-state groups and quietly protects them. Media notice counts residents of a state or jurisdiction. So a chain with 300 affected patients in Texas and 300 in Oklahoma owes no media notice in either place. A Texas-only group has no such split. Every patient is a Texas resident. Every record lands in the same bucket. Growing inside one state concentrates exposure rather than spreading it.
None of that argues against opening more offices. It argues for one security program instead of 6.
A Texas doctor’s office averages 11 people. That is the real constraint.
We pulled the 2025 annual averages from the Bureau of Labor Statistics Quarterly Census of Employment and Wages for NAICS 6211, offices of physicians, to see what a Texas medical site actually looks like at the establishment level.
| Area | Physician offices | People employed | Average per office |
|---|---|---|---|
| Texas, statewide | 26,255 | 284,887 | 10.8 |
| Harris County | 4,128 | 46,847 | 11.3 |
| Dallas County | 2,854 | 38,863 | 13.6 |
| Tarrant County | 1,908 | 21,546 | 11.3 |
| Bexar County | 1,821 | 24,143 | 13.3 |
| Travis County | 1,174 | 17,462 | 14.9 |
Now add a hospital. The same dataset counts 1,119 hospital establishments employing 378,164 people, an average of 338 per site. A physician office is roughly 1/31st the size. It still runs a clinical record system carrying the same regulatory weight. Dental offices are smaller again at 7.0 people each across 12,662 Texas locations, which is exactly why dental support organizations went multi-site first.
That ratio explains a lot. No 11-person office can justify a server room, a spare firewall, an after-hours on-call rotation or somebody who knows what a DICOM node is. A 6-office group of 66 people can justify all 4, once. So the unit of IT investment has to be the group, not the building. Practices that miss this end up with 6 different answers to the same question and a compliance file nobody can reconcile.
One EHR tenant, six networks
Ask a practice manager where the EHR lives and you will usually get a clean answer. Ask where the label printer at the Katy office gets its IP address. The room goes quiet. That split is normal. It has to be deliberate.
| System | Where it belongs | Reason |
|---|---|---|
| EHR and practice management | One hosted tenant | Audit logs and records access are judged entity-wide, not per office |
| Identity, email and MFA | One Microsoft 365 or Google tenant | One offboarding action has to close every door at every site |
| Backup and recovery | Central target, restore tested per site | A restore that only works at headquarters is not a tested restore |
| Imaging archive | Central archive, local acquisition | Modalities are bolted to a room, studies are large, the archive is not |
| Phones and check-in | Central platform, local endpoints | Call routing follows patients, handsets and kiosks do not |
| Internet circuit and firewall | Local hardware, central management | Every site needs its own path out and one person setting the rules |
| Label, wristband and script printers | Local, standardized model | They fail constantly and a spare in a closet beats a shipment |
That standardized-model line does more work than it looks like. A group we brought on had 5 offices running 4 different printer brands, because each office manager bought whatever was on sale. Every jam became a research project. Consolidating to a single model turned a 40-minute ticket into a swap from the supply closet.
Bandwidth deserves its own sentence. Imaging traffic and a hosted EHR fight over the same circuit at the same time of day, which is why the 8:30am slowdown is almost never the EHR vendor’s fault. Size against the modality. Not headcount.
The records request arrives at whichever front desk is closest
Federal law allows 30 calendar days to fulfill a patient’s request for their records under 45 CFR 164.524. Texas is tighter. Under Health and Safety Code 181.102, if your EHR can produce the record electronically, you have 15 business days from the date the provider receives a written request.
Read that last part again. The clock starts when the provider receives it. Not when the request reaches whoever handles records. In a single-office practice those are the same moment. In a 9-office group they are not, and the gap gets filled by a request sitting in a folder behind the front desk in Conroe while the records coordinator in Houston has no idea it exists.
The fix is dull. One intake channel, logged centrally, reachable from any front desk, timestamped the moment any staff member touches the request. Some groups run it inside the EHR. Others use a shared ticket queue. Either works. What matters is that no site can start a clock the rest of the organization cannot see.
A downtime plan that names each building
Most multi-site groups have a downtime plan. Fewer have 6 of them. That distinction matters, because a plan written at headquarters assumes headquarters conditions, and the branch that loses its circuit at 7:40am on a Monday has no spare workstation, no printed schedule and nobody who remembers where the paper forms went.
Per site, 3 things. A designated downtime workstation holding a current patient schedule. Printed encounter forms that match today’s EHR templates rather than a 2019 version nobody uses. And a named person allowed to declare downtime without calling 3 people first.
Form drift is the one that bites. Offices that joined the group in different years often carry different consent and intake forms, so a downtime day at 2 sites produces 2 incompatible stacks of paper that both have to be keyed back in. Nobody catches it in advance.
Declaration authority matters. Argue it out in advance. If only the practice administrator can call it, and the practice administrator is in a car on I-35, the branch will improvise. Improvisation is how PHI ends up in a personal email.
Access that follows the clinician, not the building
Float staff are the defining feature of a multi-site practice. They are also the hardest thing to model in access control. A medical assistant covering 3 offices in a week needs the same login everywhere, different door access at each, and a session that locks behind them when they walk out mid-shift.
Three specifics keep coming up.
- Shared exam-room workstations under generic logins. Fast. And it makes the audit log useless. Badge-tap or PIN-based fast user switching answers the speed complaint without giving up attribution.
- Session timeouts set for an office job. A 45-minute lock screen makes sense at a billing desk. In an exam room a clinician steps out for 4 minutes and a patient is alone with an open chart.
- Termination that only runs at one site. Someone leaves the Round Rock office and their badge still opens the Cedar Park door 6 weeks later, because door access sits with a local vendor nobody told.
Workstation use and workstation security are separate standards under 45 CFR 164.310, and they apply to physical locations. That assessment happens per building. The policy is one document. The evidence is 6 walkthroughs.
Your business associate list is longer than you think
Central vendors are easy. The EHR, the clearinghouse, the backup provider, the IT partner. Those show up in every practice’s binder. Then there are the ones each office signed locally, sometimes years before the group acquired it.
- The shredding company the Pearland office has used since 2016
- A copier lease where the device stores scanned charts on an internal drive
- The after-hours answering service one location kept when the others moved
- A transcription contractor a single physician still emails files to
- The cleaning crew with keys to a room holding a workstation
Not all of those need a business associate agreement. The copier does. So does the transcriptionist. The real problem is that nobody at headquarters can name them, so the inventory has to be built site by site, in person, by someone who opens the closet and reads the label on the machine. We do this during onboarding. It consistently turns up 2 or 3 vendors per office that were on nobody’s list.
Adding office 7 without inheriting office 7’s problems
Acquisition is the most common way a group goes multi-site. Due diligence usually lands after closing. That ordering is expensive, because unresolved compliance problems transfer to the surviving entity rather than staying with the seller. An incomplete risk analysis. An unreported incident. An open investigation. All of it comes with the building.
Ask for 5 things before the network cable goes in.
- The most recent security risk analysis, with dates, and the remediation status of anything it flagged
- The breach and incident log, including anything under 500 individuals that went into the annual submission
- Every business associate agreement, matched against a list of what is physically in the building
- Local administrator credentials and a full inventory of what holds a static IP, especially anything medical
- A written answer on where the old EHR data will live and who decommissions the legacy server
Item 5 gets skipped. Every time. A legacy practice management server left powered on in a back room, still reachable, still holding records, still unpatched, is the single most common finding when we assess a recently acquired site. It has no owner because the person who ran it left with the deal.
Bring the new site onto your identity directory before you bring it onto your network. Reverse that order and an unassessed network gets a path to everything else you run.
What this costs when it goes wrong
Healthcare has been the most expensive industry for data breaches 13 years running. The 2026 IBM Cost of a Data Breach report puts the healthcare average at $6.64 million, down from $7.42 million the year before but still well above the $4.99 million global average across all sectors.
Those figures describe large organizations. A 6-office group will never see a number like that. Ranking is the useful part, not the dollar amount. Healthcare stays at the top because patient records carry identity, insurance and clinical data in one place, and because clinical operations cannot pause while an investigation runs.
Texas has supplied its own reminders. In 2026 a single 226-bed hospital in Nacogdoches reported a breach affecting more than 2.5 million people, the largest ever reported by a community hospital in the United States. One building. Millions of records.
Want the control-by-control version? Our HIPAA IT compliance checklist for Texas medical practices walks the requirements without the multi-site framing. This post is about what changes when there is more than one building.
How Uprite supports multi-site practices across Texas
We run managed IT for healthcare practices across all 3 major Texas metros, and multi-site groups are where most of that work sits. A dental group we support went through this exact progression, consolidating scattered infrastructure and security across locations as it grew. The full write-up is in our case study on healthcare IT infrastructure for multi-location growth.
Coverage by metro. Dispatch distance is real, and remote hands only go so far.
- Managed IT services for healthcare in Houston, including Katy, Sugar Land, Pearland and The Woodlands
- Healthcare IT services in Dallas, covering Plano, Frisco, Irving and the wider Metroplex
- Healthcare IT services in San Antonio, including New Braunfels, Schertz and Boerne
Uprite has supported Texas businesses since 2001 with a team of 42, and healthcare has been a core vertical for most of that. If a group runs 3 or more offices and cannot say where its business associate agreements are filed, that is usually the first thing we fix.
Questions multi-site practices ask us
Do we need a separate HIPAA risk analysis for every office?
No. You need one risk analysis that covers every office. The Security Rule requires an accurate and thorough assessment across the covered entity, and physical safeguards under 164.310 apply to each facility, so findings get recorded per location and then reconciled into a single document. One analysis, 6 walkthroughs, one reconciled result. Groups that skip the walkthroughs and file a single desk-based assessment usually cannot show which office a given control was tested in, and that is the first thing an investigator asks for.
Our EHR vendor says they handle HIPAA. Doesn’t that cover us?
It covers their piece. Your EHR vendor is a business associate responsible for the platform they host, not for your workstations, networks, door locks, staff training or risk analysis. Everything physically inside your buildings stays yours, and that is most of what an audit actually looks at.
How many patient records does it take before a breach becomes public in Texas?
More than 500 Texas residents triggers notice to prominent media outlets, and 500 individuals triggers immediate notice to HHS. Both count across your whole organization, not per office. The Texas Attorney General threshold is lower at 250 residents, with 30 days to file, and the AG publishes what it receives.
We just bought a 2-doctor practice. What has to happen before we plug it into our network?
Get their risk analysis, incident log and business associate agreements first, then inventory what is physically in the building. Bring the site onto your identity directory before your network. The most common finding at a newly acquired office is a legacy practice management server nobody has patched since the previous owner ran it.
Is one EHR instance always better than letting each site keep its own?
Almost always, and it is not close. Separate instances mean separate audit logs, separate upgrade schedules, separate downtime procedures and a patient who exists twice. The exception is a genuinely different specialty running a purpose-built system, and even then the identity layer and the security program stay unified.
What happens to the 15-day records deadline if the request goes to the wrong office?
The clock still started. Texas Health and Safety Code 181.102 runs 15 business days from the date the provider receives the written request, and any of your offices counts as the provider. A request that sits at a front desk for a week has already spent a third of your window.
Get an assessment
Running 3 or more Texas offices? If the answers above raised more questions than they settled, we will walk your sites and tell you what we find. No obligation attached. Request an assessment and we will scope it around how many locations you actually have.
