HIPAA compliance for multi-location groups, one program, every site.

Each covered entity must designate a privacy officer and a security officer, and one qualified person can hold both roles across locations of the same organization. HIPAA does not require a separate officer at each location. What it does require is the designation in writing, and in practice every site needs to know who that person is and how to reach them. If your practices are separate legal entities, each one needs its own designation unless they have formally designated themselves a single affiliated covered entity.

Not under federal law. No federal statute or regulation tells a provider how often to check the Office of Inspector General's (OIG) List of Excluded Individuals/Entities, but OIG updates the list every month and says screening employees and contractors each month best minimizes the risk of repayment and civil money penalties. Some states go further: state Medicaid agencies must check enrolled providers monthly, and many state Medicaid programs require their providers to screen staff and contractors monthly against the federal list and the state's own list. Across hundreds of employees and many sites, the practical question is whether anyone can prove the checks happened. Live Compliance runs them on hire and monthly, on every plan, with the record kept.

Every workforce member gets it, the curriculum follows the role rather than the ZIP code, and a new hire is trained on arrival with the date recorded. Completion then feeds a single view the compliance lead can read office by office. The federal rule wants both the training and the documentation proving it happened, and keeping that proof in a different spreadsheet at every address is how groups lose it. Some states add their own deadlines; Texas, for example, requires training within 90 days of hire.

Yes, that is what the Enterprise plan is for. Training, policies, risk assessment status and exclusion checks sit on a single record that reads either office by office or all at once, and the HRIS integrations keep the roster honest as people join, move and leave. The compliance lead gets the whole board; a site manager gets their own column.

Sometimes. If your locations are all one legal entity, you are already one covered entity and need no special designation. If your practices are separate legal entities under common ownership or control, HIPAA lets them designate themselves as a single affiliated covered entity. The group can then run one program: one privacy official, one security official, one set of policies and procedures, and one notice of privacy practices. The designation has to be in writing and kept for six years, and every member stays responsible: each one can be held jointly and severally liable for a violation by the group. An affiliated covered entity is different from an organized health care arrangement, where separate covered entities, such as a hospital and its medical staff, keep their own programs but may share a joint notice. Whether your structure qualifies is a question for your attorney. (Source: 45 CFR 164.105(b)-(c), 164.103, 160.402(b)(2), 164.520(d).)

Published, like every other price here: $399, $895 or $1,450 a month, plus $8.33 per employee per month, billed annually, with nothing added on top. The multi-location roll-up and the HRIS integrations sit on the Enterprise plan at $1,450. Example: 20 employees. Enterprise is $1,616.60 a month.