Key Takeaways
- PHI should not enter the diligence data room in identifiable form. HIPAA compliance planning starts before the transaction process begins, not at closing.
- Business associate agreements must be reviewed, updated, or newly executed as part of every healthcare acquisition. In an asset purchase, all vendor BAAs are negotiated fresh; in a stock purchase, existing BAAs are inherited and should be reviewed for adequacy.
- Breach history diligence is a required part of HIPAA review. An unreported breach discovered post-close triggers notification obligations that the buyer now owns. Undisclosed breaches are a material seller liability.
- State health privacy laws often impose stricter requirements than HIPAA for specific categories of records and specific patient populations. A federal HIPAA analysis alone is insufficient in multi-state healthcare acquisitions.
Healthcare is one of the few industries where federal privacy law directly shapes the mechanics of a business acquisition. HIPAA does not sit passively in the background of a healthcare deal: it governs what information can be included in the data room, how patient records transfer at close, what agreements must be in place with vendors and service providers, and what the buyer inherits in the way of compliance obligations and pre-close liability.
A buyer who treats HIPAA as a post-close integration task discovers that the compliance gaps identified after close are harder and more expensive to address than they would have been in diligence. Unreported breaches, missing business associate agreements, inadequate Security Rule documentation, and state privacy law violations are all categories of risk that must be assessed before the deal is priced and structured.
This guide is part of the Healthcare Practice Acquisition Guide cluster. It covers the complete HIPAA framework for healthcare acquisitions: covered entity and business associate definitions, BAA transfer mechanics, the impact of deal structure on HIPAA obligations, patient notice requirements, breach history review, Security Rule diligence, data room PHI handling, EHR integration, and the representations and warranties buyers require at close. For the Stark Law and Anti-Kickback dimension of healthcare acquisitions, see the companion article on Stark and AKS compliance in healthcare M&A.
Buyers evaluating the broader transaction framework should also review the M&A due diligence guide and the asset purchase versus stock purchase guide. Deal structure has direct implications for how HIPAA liabilities and BAA obligations are allocated between parties.
Why HIPAA Drives Timelines in Healthcare M&A
Healthcare transactions routinely take longer to close than comparable transactions in other industries, and HIPAA compliance is one of the structural reasons. HIPAA compliance review requires specialized expertise, a systematic review of vendor relationships and BAAs, analysis of the target's Security Rule implementation, and in some cases the need to remediate gaps before close. These are not activities that can be compressed into the final week before signing.
The data room structure for a healthcare acquisition must be designed with HIPAA in mind before it opens. Patient data, clinical records, and other PHI cannot be placed in the data room in identifiable form without careful analysis of whether the disclosure is permitted under HIPAA and under any applicable BAA between the covered entity and the data room provider. This means that the seller's counsel must be involved in data room setup before any sensitive information is shared.
Post-close integration of healthcare practices involves transitioning vendor relationships, updating BAAs, migrating EHR systems, updating Notice of Privacy Practices, and ensuring the buyer's Security Rule infrastructure extends to the acquired operations. These activities require planning that begins in diligence, not after close. Buyers who do not plan HIPAA integration in advance face a period of heightened compliance risk as the newly acquired operations transition to the buyer's framework.
HIPAA Milestones in the Healthcare M&A Timeline
Covered Entities vs Business Associates
HIPAA applies directly to covered entities: healthcare providers who transmit health information in electronic form in connection with HIPAA-covered transactions, health plans, and healthcare clearinghouses. Physician practices, hospitals, dental practices, and most clinical healthcare providers are covered entities under HIPAA.
Business associates are persons or entities that perform functions or activities on behalf of a covered entity that involve creating, receiving, maintaining, or transmitting PHI. Typical business associates include EHR vendors, billing services, transcription services, IT managed services providers, cloud storage providers who host PHI, and legal counsel and accountants who receive PHI in performing their services. Business associates must have BAAs in place with the covered entity and are independently subject to HIPAA's Privacy and Security Rules with respect to the PHI they handle.
The acquirer's covered entity status: If the buyer is not a covered entity before the acquisition (for example, a private equity firm acquiring a physician practice), the buyer will become one upon acquiring the practice. This means the buyer must have HIPAA compliance infrastructure in place before the acquisition closes, including Privacy and Security policies and procedures, a HIPAA Privacy Officer and Security Officer designation, a workforce training program, and a BAA management process. The complexity of building this infrastructure for the first time while simultaneously managing a healthcare acquisition is a factor that buyers new to healthcare ownership should assess early in the deal process.
Subcontractors of business associates who receive PHI from the business associate are themselves business associates and must execute BAAs with the business associate. In a healthcare acquisition, the chain of BAA relationships extends through the target's full vendor ecosystem. Buyers should map this chain as part of HIPAA diligence to confirm that each level of the relationship is covered by an appropriate BAA.
Business Associate Agreements: Transfer Mechanics
Business associate agreements are contracts that establish the permitted uses and disclosures of PHI by the business associate, the business associate's HIPAA obligations, and the remedies available to the covered entity if the business associate violates the agreement. HIPAA regulations specify minimum required terms for BAAs, and covered entities may negotiate additional protections beyond those minimums.
In an asset purchase, the buyer is a new covered entity that has not previously been a party to the target's BAAs. Each vendor or service provider that will continue to handle PHI post-close must execute a new BAA with the buyer. This means the buyer's counsel must identify every business associate relationship in the target's operations, confirm which vendors will continue post-close, and execute new BAAs before the acquired operations go live under the buyer's ownership.
In a stock purchase, the target's existing BAAs technically survive as part of the acquired entity's contracts. However, buyers should review all existing BAAs rather than assuming they are adequate. BAA requirements under HIPAA have evolved, and agreements executed several years ago may not include all currently required provisions, particularly the 2013 Omnibus Rule updates that expanded business associate obligations and the breach notification requirements.
EHR vendor BAAs: Electronic health record system agreements are among the most significant BAAs in a physician practice. EHR vendors handle the most comprehensive and sensitive PHI in the practice's operations. In a healthcare acquisition, buyers must confirm that the EHR vendor agreement and accompanying BAA are transferable to the buyer, cover all required HIPAA terms, and include appropriate security provisions. EHR transitions are among the most operationally complex elements of healthcare practice integration and warrant dedicated planning.
Billing service BAAs: Third-party billing services have broad access to patient demographic and clinical information in connection with claims processing. BAAs with billing services should specifically address permitted uses of PHI, security obligations, breach notification timelines, and the vendor's obligations upon termination of the agreement. In an asset purchase, the buyer must execute new BAAs with billing services before those vendors begin processing claims for the acquired practice.
Cloud and IT service providers: Cloud storage, managed IT services, and infrastructure providers that host or access ePHI are business associates requiring BAAs. In many healthcare practices, IT vendor relationships have expanded significantly over time and may include providers without documented BAAs if the practice's vendor management process was not rigorous. Identifying and remediating missing BAAs with IT vendors is a common HIPAA diligence finding in physician practice acquisitions.
Asset vs Stock Purchase Effects on HIPAA Obligations
The choice between an asset purchase and a stock purchase has direct and significant consequences for HIPAA compliance obligations at close and in post-close integration. The implications differ across several dimensions: liability for pre-close compliance failures, BAA obligations, patient record transfer mechanics, and the scope of post-close remediation required.
In an asset purchase, the buyer acquires specified assets of the target but does not acquire the legal entity itself. The buyer does not automatically assume the seller's pre-close HIPAA liabilities. Patient records are transferred as part of the asset acquisition, and the transfer is generally permitted under HIPAA's treatment, payment, and operations provision or as a transfer to a successor entity without individual patient authorization, subject to applicable state law requirements. BAAs do not transfer: the buyer must execute new BAAs with all vendors who will handle PHI post-close.
In a stock purchase, the buyer acquires the legal entity with all of its existing obligations and liabilities. The target's existing BAAs survive as contracts of the acquired entity. Pre-close HIPAA violations, unreported breaches, and OCR enforcement exposure are all inherited by the buyer. The buyer becomes responsible for any ongoing notification obligations arising from pre-close breaches discovered post-close.
HIPAA Consequences by Deal Structure
Asset Purchase:
- - No automatic assumption of pre-close HIPAA liabilities
- - New BAAs required with all post-close PHI vendors
- - Patient record transfer permitted as successor acquisition
- - Buyer's HIPAA compliance program must be established before close
- - New Notice of Privacy Practices required post-close
Stock Purchase:
- - Pre-close HIPAA liabilities and breach history inherited
- - Existing BAAs survive but should be reviewed and updated
- - Post-close breach notification obligations for pre-close breaches discovered post-close
- - OCR investigations and enforcement actions transfer with entity
- - Existing Notice of Privacy Practices continues; update required to reflect new ownership
Notice of Privacy Practices Updates at Close
HIPAA's Privacy Rule requires covered entities to provide patients with a Notice of Privacy Practices (NPP) that describes how the entity uses and discloses PHI and patients' rights with respect to their information. The NPP must be updated when there are material changes to the entity's privacy practices and must be made available to patients in the manner prescribed by the regulations.
A change of ownership is a material event for NPP purposes. When a practice is acquired and begins operating under new ownership, patients should receive an updated NPP reflecting the new covered entity's identity and privacy practices. The timing and method of NPP distribution vary by provider type: for most healthcare providers with direct patient contact, the NPP must be provided at the first service encounter after the effective date of the change.
Practical NPP update planning in healthcare acquisitions involves: updating the NPP template to reflect the buyer's organizational identity and contact information; posting the updated NPP on the practice's website (if the practice maintains one); updating patient intake forms and intake processes to deliver the updated NPP at first post-close encounters; and retaining documentation of NPP distribution in accordance with HIPAA's documentation requirements. These are operational tasks that should be planned as part of the post-close integration checklist.
Patient Consent Requirements for PHI Transfer
HIPAA generally does not require individual patient authorization for the transfer of patient records as part of a bona fide sale of a healthcare practice. The transfer of records to a successor entity in a practice acquisition is generally characterized as part of healthcare operations, or as a transfer to a successor who will use the records to continue the patients' care. Under this analysis, individual patient authorization is not required for the records transfer itself.
However, the absence of a HIPAA authorization requirement does not mean the transfer is unconditionally permissible. The transfer must be structured in a manner that limits PHI to the minimum necessary for the purpose, that is consistent with applicable state law requirements, and that does not exceed the scope of what HIPAA permits for the specific type of disclosure involved. Buyers should work with healthcare counsel to confirm the legal basis for the records transfer and document the analysis.
Mental health, substance use disorder, and HIV records: Certain categories of patient records are subject to heightened federal and state privacy protections that go beyond HIPAA's general framework. Substance use disorder treatment records covered by 42 CFR Part 2 have their own authorization and disclosure requirements that are more restrictive than HIPAA. Mental health records in many states require specific patient authorization or court order for disclosure in contexts where HIPAA would permit disclosure without authorization. HIV status records are similarly subject to heightened state law protections in most jurisdictions. Healthcare acquisitions involving practices that treat these patient populations require specialized analysis of the applicable federal and state requirements for the specific record categories involved.
State Health Privacy Laws Overlaying HIPAA
HIPAA establishes a federal floor for health privacy protection, not a ceiling. States may enact health privacy laws that provide greater protections than HIPAA, and where state law is more stringent, state law controls. In a healthcare acquisition, the applicable state privacy laws for each state where the target operates must be identified and analyzed alongside HIPAA. A federal HIPAA analysis alone is insufficient.
State health privacy laws vary significantly in their scope and stringency. Some states have comprehensive health privacy frameworks that require specific patient consent for disclosures that HIPAA would permit without consent. Others have specific laws governing mental health records, HIV status, genetic information, reproductive health, and minor patient records that create narrower exceptions and more robust patient rights than HIPAA provides. California's Confidentiality of Medical Information Act, New York's health privacy framework, and Texas's medical records statute are examples of state laws that healthcare acquirers must assess for targets operating in those states.
State attorney general enforcement of health privacy violations is a separate risk from federal OCR enforcement. Several state attorneys general have active health privacy enforcement programs, and violations of state health privacy laws can result in civil penalties and enforcement actions independent of any federal consequences. Healthcare buyers acquiring practices in states with robust attorney general enforcement should factor state law compliance into their diligence assessment and post-close compliance planning.
Conducting HIPAA Diligence on a Healthcare Acquisition?
Alex Lubyansky works with healthcare buyers on physician practice and healthcare entity acquisitions, including HIPAA compliance review, BAA structuring, and post-close integration planning. Submit your transaction details for an engagement assessment.
Submission Received
Your transaction details are under review. If there is alignment, we will be in touch.
Meanwhile, feel free to call us directly at (248) 266-2790
Breach History Diligence and Prior Audits
Breach history diligence is a required component of HIPAA review in any healthcare acquisition. The target's breach notification log, HHS OCR breach reporting records, and state attorney general notifications provide the buyer with a baseline view of the target's PHI security history and any open regulatory matters that will transfer with the business.
HIPAA's Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media of breaches of unsecured PHI. Breaches affecting fewer than 500 individuals are logged and reported to HHS annually. Breaches affecting 500 or more individuals must be reported to HHS and the media without unreasonable delay and within 60 days of discovery. HHS maintains a public list of breaches affecting 500 or more individuals (the "Wall of Shame"), which buyers should review during preliminary diligence.
Unreported breaches as a deal risk: An unreported breach at the target is a material compliance deficiency. If the breach occurred during the lookback period and meets the HIPAA reporting threshold, the entity had an obligation to report that has not been satisfied. In a stock acquisition, the buyer inherits this unreported obligation. Post-close discovery of an unreported breach creates an immediate compliance decision for the buyer: report the breach to HHS (and potentially affected individuals) and accept the late-reporting exposure, or risk that the breach surfaces in an OCR audit with even greater exposure. Healthcare counsel with HIPAA enforcement experience should guide this analysis.
OCR investigations: An open OCR investigation at the target is a significant diligence finding. OCR investigations can result in resolution agreements, corrective action plans, and civil monetary penalties. The investigation timeline, scope, and settlement status should be fully disclosed by the seller. In a stock acquisition, the buyer assumes the risk of the investigation's outcome. In an asset purchase, the investigation follows the entity and may not transfer to the buyer, but the operational impact of an investigation on the acquired practice should be assessed.
Prior OCR audits: The HHS OCR conducts periodic compliance audits of covered entities and business associates. A prior audit at the target may have identified compliance deficiencies. Buyers should request disclosure of any prior OCR audit findings and corrective action plans, and assess whether the identified issues have been remediated. Unresolved corrective action plan items are a post-close compliance obligation that the buyer must be aware of and plan to address.
Security Rule Diligence: Administrative, Physical, Technical
HIPAA's Security Rule establishes national standards for protecting the confidentiality, integrity, and availability of electronic PHI (ePHI). The Security Rule is organized around three categories of safeguards: administrative, physical, and technical. Each category includes required and addressable implementation specifications. Covered entities must implement required specifications and must either implement addressable specifications or document why alternative measures are reasonable and appropriate.
Security Rule diligence in a healthcare acquisition involves reviewing the target's documentation of its Security Rule compliance, including its Security Risk Assessment, its policies and procedures for each safeguard category, and its documentation of addressable implementation specification decisions. A well-documented Security Rule program signals a mature compliance infrastructure. Sparse or missing documentation is a risk indicator that warrants follow-up.
Security Rule Diligence: Three Safeguard Categories
Administrative Safeguards:
Administrative safeguards are the policies, procedures, and management actions that govern the selection, development, implementation, and maintenance of security measures. Key administrative safeguard elements in diligence include: the Security Risk Assessment (required); a security management process with written policies; documented risk management decisions; a security awareness and training program for workforce members; workforce clearance procedures; and a contingency plan for ePHI system outages. The SRA is the foundation of the administrative safeguards analysis and should be reviewed as a priority.
Physical Safeguards:
Physical safeguards govern the physical access to facilities and equipment that contain ePHI. Key elements include: facility access controls and policies; workstation use and security policies; device and media controls covering disposal, re-use, backup, and accountability for devices containing ePHI; and access control and audit controls for physical access to systems. Practices that have moved to cloud-based EHR systems may have limited on-premises infrastructure, but physical safeguards for workstations and practice devices remain applicable.
Technical Safeguards:
Technical safeguards involve the technology and policies governing access to ePHI and its protection during transmission and storage. Key elements include: access controls limiting ePHI access to authorized users; audit controls providing hardware, software, and procedural mechanisms to examine ePHI access; integrity controls to prevent unauthorized alteration or destruction of ePHI; and transmission security measures such as encryption for ePHI transmitted over networks. Encryption of ePHI at rest and in transit is an addressable specification that, when implemented, renders breached data "unsecured" PHI (which triggers breach notification) less likely to result in reportable breaches under the Breach Notification Rule.
Data Rooms Handling PHI Pre-Close
The due diligence data room in a healthcare acquisition is a sensitive environment from a HIPAA compliance perspective. The seller's counsel and management must structure what goes into the data room carefully to avoid unauthorized PHI disclosures that could constitute HIPAA violations independent of the transaction.
HIPAA's Privacy Rule permits covered entities to disclose PHI for certain purposes without individual patient authorization. Healthcare operations disclosures include certain due diligence activities, but the scope of what qualifies as a permissible operations disclosure is not unlimited and does not clearly extend to full patient record access by a potential acquirer's diligence team. Best practice is to avoid placing identifiable PHI in the data room entirely and to rely on de-identified data for any population-level or clinical utilization analysis that the buyer requires.
Healthcare Data Room: HIPAA-Compliant Information Categories
- ✓De-identified clinical and claims data (de-identified under Safe Harbor or Expert Determination methods)
- ✓Aggregate patient volume statistics by specialty, payer mix, and visit type (without individual identifiers)
- ✓HIPAA compliance documentation: policies, procedures, BAAs, Security Risk Assessment, training records
- ✓Breach notification logs and OCR correspondence (document-level, not patient-identifiable content)
- ✓EHR vendor agreements and BAAs (contract documents without PHI content)
- ✓Business associate agreement templates and executed agreements
- ✓State privacy law compliance documentation for each state of operation
The data room platform itself is a business associate if it stores or provides access to PHI. Healthcare transactions typically require the data room provider to execute a BAA with the covered entity before PHI is uploaded to the platform. Sellers should confirm whether the data room provider offers a BAA and whether the data room service meets the HIPAA Security Rule technical safeguard requirements before loading any potentially identifiable information.
Post-Close Integration of EHR Systems
EHR system integration is one of the most operationally complex and HIPAA-sensitive aspects of post-close healthcare acquisition integration. The acquired practice may be running on a different EHR platform from the buyer, or may be running an older version of the same platform. Migrating patient records from one EHR system to another involves transferring large volumes of ePHI and requires careful planning to maintain Security Rule compliance throughout the process.
EHR data migration must be conducted by a business associate (typically the EHR vendor or a specialized healthcare IT firm) under an executed BAA. The migration process must maintain ePHI integrity and must protect ePHI from unauthorized access during transit and during any period when data exists in both systems. Access controls must be updated to ensure that only authorized users can access patient records in the new system, and audit controls should be in place to document who accessed what records during the migration period.
Some healthcare acquisitions involve continuing to operate the acquired practice on its existing EHR system for a transition period rather than immediately migrating to the buyer's platform. This approach can reduce immediate integration disruption but creates a period during which the buyer is operating multiple EHR systems, which complicates BAA management, Security Rule compliance, and workforce access control administration. The integration timeline and approach should be planned with the operational and HIPAA compliance requirements in mind before close.
Reps and Warranties for HIPAA Compliance
HIPAA representations and warranties in a healthcare purchase agreement allocate the risk of pre-close compliance failures between the parties. Well-drafted HIPAA reps go beyond a generic "compliance with applicable law" representation and address the specific elements of the HIPAA regulatory framework that are most likely to present post-close liability.
Core HIPAA reps should cover: that the target has complied in all material respects with HIPAA and applicable state health privacy laws throughout the lookback period; that all required BAAs are in place with vendors and service providers who handle PHI; that the target has conducted a Security Risk Assessment within a reasonable period prior to close; that the target has implemented administrative, physical, and technical safeguards as required by the Security Rule; that all breaches of unsecured PHI have been identified, reported, and documented in accordance with the Breach Notification Rule; and that no OCR investigation, audit, enforcement action, or state attorney general inquiry is pending or threatened.
HIPAA Reps and Warranties Checklist
- ✓Material compliance with HIPAA Privacy Rule, Security Rule, and Breach Notification Rule throughout the lookback period
- ✓Material compliance with applicable state health privacy laws for each state of operation
- ✓All required BAAs in place and meeting current HIPAA requirements
- ✓Current Security Risk Assessment conducted within the stated period
- ✓Written HIPAA Privacy and Security policies and procedures implemented
- ✓Complete and accurate breach notification log; all reportable breaches timely disclosed
- ✓No open OCR investigation, audit, resolution agreement, or corrective action plan
- ✓No state attorney general inquiry or enforcement action pending or threatened
- ✓HIPAA Privacy and Security Officers designated and currently serving
- ✓Workforce HIPAA training program implemented and current
The survival period for HIPAA representations should reflect OCR's enforcement lookback period. HIPAA civil monetary penalties can be assessed for violations that occurred within specified lookback periods depending on the level of culpability involved, and the lookback period can be substantial for violations involving willful neglect. Healthcare M&A agreements often include extended survival periods for HIPAA reps and specific indemnification provisions for post-close discovery of pre-close breaches, OCR enforcement matters, and state attorney general actions.
The indemnification structure for HIPAA reps should be reviewed alongside the broader indemnification framework in the purchase agreement. The indemnification provisions guide covers basket, cap, and survival mechanics that apply across the rep and warranty framework. Buyers evaluating deal structure should also review the asset purchase versus stock purchase guide for how structure affects HIPAA liability allocation, and the MSO healthcare guide for the management services organization model that some buyers use in healthcare acquisitions.
Acquiring a Healthcare Practice and Need HIPAA Diligence Support?
Acquisition Stars works with healthcare buyers on physician practice and healthcare entity acquisitions, including HIPAA compliance review, BAA analysis, breach history diligence, and post-close integration planning. Alex Lubyansky handles each engagement directly. Submit your transaction details to begin the engagement assessment process.
Frequently Asked Questions
Is a new BAA needed at every acquisition?
In an asset purchase, yes: the buyer is a new covered entity and must execute new BAAs with every vendor or service provider who will handle PHI post-close. In a stock purchase, existing BAAs technically survive with the acquired entity, but buyers should review all BAAs and update any that do not meet current HIPAA standards. Post-close integration activities that add new vendors accessing PHI require new BAAs regardless of deal structure. BAA management is an ongoing obligation, not a one-time close task.
Does HIPAA require patient consent to transfer records?
HIPAA generally does not require individual patient authorization for the transfer of records in a bona fide practice acquisition. The transfer is typically characterized as a healthcare operations disclosure or as a successor entity transfer. However, state law may impose additional patient rights or consent requirements that overlay HIPAA. Certain record categories, including substance use disorder treatment records under 42 CFR Part 2 and mental health records in many states, are subject to stricter standards than HIPAA. Counsel should confirm the applicable framework for the target's patient population and states of operation before close. This is educational content only, not legal advice.
Are state health privacy laws stricter than HIPAA?
Many states have health privacy laws that are more protective than HIPAA in specific areas, including mental health records, HIV status, substance use disorder treatment, reproductive health, genetic information, and minor patient records. Where state law is more stringent, state law controls. California, New York, Texas, Florida, and other states with active health privacy frameworks require analysis alongside the federal HIPAA framework in any healthcare acquisition. State attorney general enforcement of health privacy violations operates independently of federal OCR enforcement and represents a separate risk exposure.
Should buyers audit prior breaches during diligence?
Yes. Breach history diligence is a standard component of HIPAA review. Buyers should request disclosure of all breaches in the lookback period, including HHS OCR reports, state attorney general notifications, and affected individual notices. An unreported breach discovered post-close triggers notification obligations that the buyer now owns in a stock acquisition. Breach history also reveals the target's security posture and informs the scope of representations and indemnification the buyer should require. The HHS OCR public breach database is a starting point for preliminary diligence on the target's large breach history.
How is PHI protected in the data room?
PHI should not enter the data room in identifiable form. De-identified data, aggregate statistics, and summary operational data can be shared without HIPAA disclosure concerns. Where identifiable PHI review is genuinely necessary, the parties should plan the access through a controlled process with appropriate legal analysis and protections. The data room platform itself may be a business associate requiring a BAA if it stores PHI. Healthcare data room procedures require advance planning with counsel before the data room opens.
Does a covered entity inherit prior HIPAA liability?
In a stock purchase, the buyer acquires the legal entity with its pre-close HIPAA liabilities, including unreported breaches, open OCR investigations, and compliance violations. In an asset purchase, the buyer generally does not assume the seller's pre-close HIPAA liabilities, but HIPAA compliance diligence remains essential to understand the target's compliance posture and inform deal structure, representations, and indemnification. Even in an asset purchase, the buyer becomes responsible for HIPAA compliance in the acquired operations from the date of close.
Do I need a HIPAA security risk assessment before close?
A HIPAA Security Risk Assessment is a regulatory requirement for all covered entities and business associates. As part of HIPAA diligence, buyers should review the target's most recent SRA. An outdated or missing SRA is a compliance finding. Post-close, the buyer must conduct or update the SRA to reflect the new operational context, including infrastructure and system changes resulting from the acquisition. Whether a pre-close SRA update is required depends on transaction timing and deal structure. This summary is educational only and does not substitute for legal advice.
What reps should cover HIPAA compliance?
Core HIPAA reps should cover: material compliance with HIPAA and applicable state privacy laws; all BAAs in place and current; Security Risk Assessment completed within a reasonable period; administrative, physical, and technical safeguards implemented; all reportable breaches timely disclosed; no open OCR investigation or enforcement action; and no state attorney general inquiry pending. Survival periods should reflect OCR's enforcement lookback. HIPAA-specific indemnification provisions should address post-close discovery of pre-close breaches and regulatory actions. Scope and structure require healthcare M&A counsel review. This is educational content only, not legal advice.
Complete the Healthcare M&A Framework
HIPAA compliance is one layer of the healthcare M&A legal framework. Review the related guides for the complete picture.
Related Resources
Healthcare Practice Acquisition Guide
The complete legal framework for physician practice and healthcare entity acquisitions.
Read Guide →Stark Law and Anti-Kickback in Healthcare M&A
Fraud and abuse compliance framework for physician practice acquisitions: Stark exceptions, AKS safe harbors, and diligence red flags.
Read Guide →MSO Healthcare Guide
Management services organization structures in healthcare acquisitions and ongoing operations.
Read Guide →Healthcare M&A Attorney Michigan
Legal representation for physician practice acquisitions, HIPAA compliance, and healthcare deal structuring.
View Services →Small Business Acquisition Attorney
M&A legal services for healthcare buyers and sellers through diligence, structuring, and close.
View Services →Related Practice Areas
Our attorneys handle M&A transactions and securities matters nationwide. Alex Lubyansky leads every engagement personally.