Sharing office space can make a lot of sense for healthcare providers. It’s cost-effective, it looks professional, and it can even make things more convenient for patients. But there’s a side most providers don’t think about: when you share space, you can also share HIPAA liability.
And here’s the kicker — even if you’re doing everything right, another provider in your suite could put you at risk if proper safeguards aren’t in place. OCR doesn’t care whose staff member clicked the wrong link; they’ll want to know whether you had the right agreements, policies, and technical protections in place to prevent that mistake from affecting you.
Why Co-Location Isn’t Just About Rent
HIPAA’s Privacy Rule (45 CFR §164.502) and Security Rule (45 CFR §164.308–316) make each covered entity individually responsible for protecting PHI. That doesn’t change just because you share a roof, a receptionist, or an internet connection.
We’ve seen OCR investigations triggered by:
- Shared Wi-Fi without proper network segmentation.
- Reception staff scheduling patients for multiple practices from a single computer login.
- Fax lines or voicemail systems where one practice could see another’s PHI.
The pattern is clear: shared infrastructure without safeguards = shared risk.
The Agreements That Matter
If your practice is truly independent — separate staff, separate records, separate systems — a Space-Sharing Agreement may be enough. This covers things like rent, utilities, and confidentiality rules for shared areas.
But the moment PHI is involved across entities, you may also need:
- Business Associate Agreement (BAA) – Required (45 CFR §164.502(e)) when one entity’s staff or systems handle PHI for another.
- Organized Health Care Arrangement (OHCA) – Defined in 45 CFR §160.103; allows sharing PHI for joint operations under a shared Notice of Privacy Practices.
- Shared Services Agreement – Not a HIPAA mandate, but a best practice to spell out who maintains shared systems, how costs are split, and how security is enforced.
Three HIPAA-Compliant Ways to Share Space and Systems
Model 1: Complete Separation
- Setup: Separate internet, phones, faxes, and IT systems. No staff overlap.
- Agreements: Space-Sharing Agreement with confidentiality provisions.
- Controls: Physically separate hardware, unique Wi-Fi SSIDs, dedicated voicemail.
- Risk: Lowest, but higher costs.
Model 2: Shared Infrastructure with Segmentation
- Setup: Share internet or phones, but segment systems with firewalls, VLANs, and access controls.
- Agreements: Space-Sharing + Shared Services Agreement; BAA if one entity manages another’s systems.
- Controls: VLANs, role-based voicemail access, encryption, logging, separate email domains.
- Risk: Moderate — cost-effective but requires ongoing IT vigilance.
Model 3: Fully Shared Systems Under an OHCA
- Setup: Providers operate as a coordinated care team, sharing phones, scheduling, and EHRs.
- Agreements: OHCA Agreement + Shared Services Agreement.
- Controls: Unified HIPAA training, shared breach protocols, centralized access controls.
- Risk: Higher joint liability, but streamlined operations.
Why We Approach This as Both an IT and Legal Project
Here’s the truth: you can have perfect legal paperwork and still fail HIPAA if your systems aren’t configured properly. Likewise, you can have the most secure IT setup in the world, but if your agreements don’t match how you operate, you’re still exposed.
That’s why at Magister Business Advisors, we work side-by-side with your IT vendors and your attorneys to:
- Design the right technical safeguards.
- Ensure your agreements reflect your actual workflows.
- Align legal compliance with operational reality.
And because HIPAA enforcement is as much about documentation as it is about implementation, we make sure you have both.
Important: Consult a qualified healthcare attorney. All agreements should be drafted and reviewed by a qualified healthcare attorney to ensure they meet HIPAA and state law requirements.
Key Takeaways
- One provider’s mistake in a shared office can become everyone’s problem.
- The more you share — internet, phones, staff — the more you need formal agreements and technical controls.
- Think of co-location planning as half legal, half IT. You can’t do it right without both.
Next Steps
If your practice is moving into a shared office, or you’re already co-located and not sure if your agreements and systems are compliant, now’s the time to act.
A quick HIPAA co-location risk assessment can tell you exactly where you stand — before OCR does.
Visual Guide: HIPAA-Compliant Co-Location Models
