Quick answer
Before sharing a platform across facilities, identify the legal entities, covered functions and documented HIPAA designations. Common branding does not automatically establish an affiliated covered entity, and a hybrid entity must maintain applicable component boundaries. Translate the reviewed relationships into data access, exports and administration. Tenant architecture implements those decisions; it does not create them.
An enterprise platform may serve owned SNFs, managed facilities and a separate service company under one brand. Those operational relationships are not interchangeable legal relationships. Configuring them all as one organization can expose records across a boundary that was never reviewed.
HIPAA permits qualifying legally separate covered entities under common ownership or control to designate themselves as an affiliated covered entity, with documented designation and safeguards. Its hybrid-entity provisions address health care components within a legal entity and require protections between components. 45 CFR 164.105.
Start with the entity map
List legal name, ownership or control relationship, covered functions, workforce relationships and contracts for each participant. Add the approved designation, effective date and supporting record where applicable. Do not substitute a facility nickname, tax identifier list or software hierarchy for that analysis.
Distinguish the questions: whether an entity is covered, whether several entities have made a valid affiliated designation, whether a single entity has designated health care components, and whether a particular disclosure is permitted. An answer to one does not automatically answer all the others.
Review four enterprise cases
| Synthetic arrangement | Fact to establish | Configuration implication to evaluate |
|---|---|---|
| Two owned SNFs | Separate legal entities and any documented affiliated designation | Preserve entity provenance and approved cross-facility access |
| A third-party managed SNF | Management authority and applicable data-use arrangements | Limit management access to approved purposes and scope |
| County SNF within a broader government entity | Whether a hybrid designation exists and its components | Prevent unrelated government functions from obtaining PHI by default |
| Shared administrative service company | Its legal role for each facility and authorized services | Separate service access from unrestricted enterprise clinical access |
These are review prompts, not determinations that a particular structure qualifies. Other arrangements, such as an organized health care arrangement, require their own analysis; a common tenant is not evidence that one exists.
Translate legal boundaries into data behavior
Create a matrix connecting source entity, recipient entity or component, purpose, record class and reviewed authority. Then map each permitted relationship to the platform's controls. Include ordinary screens, resident search, exports, analytics, support access and identity administration.
In a hybrid entity, the health care component cannot disclose to another component in circumstances where the disclosure would be prohibited if they were separate entities. An employee working in both components must not carry PHI into an impermissible use in the other role. A shared login that always exposes both contexts can undermine that boundary.
An affiliated designation also does not eliminate all safeguards or purpose limits. Maintain source attribution so the organization can respond to requests, investigate access and handle a later change in structure.
Test the boundary with a management change
Use a fictional managed facility that leaves the group. Before the end date, inventory shared accounts, exports, scheduled reports and service integrations. Determine which records the operator may retain for which purposes and which access should stop. The contract and legal review establish those rights; the platform should execute them without rewriting historical ownership.
Test whether a regional user loses access to the departing facility while retaining legitimate access to the owned facilities. Inspect a previously scheduled enterprise report after the change. A hidden chart is insufficient if the report continues to export the same records.
Choose architecture after the decisions
A separate tenant may simplify some boundaries but create transfer and duplicate-identity work. A shared tenant may reduce administrative friction but require stronger partitioning and auditable entity context. Evaluate both against the approved matrix rather than treating either design as inherently compliant.
The purchase should preserve documented designations, entity provenance and change handling. Ease's skilled nursing offering is planned; enterprise configuration and cross-entity sharing would need a defined future design and evidence that it enforces the reviewed relationships.
Questions & answers
Does common ownership automatically make two SNFs one HIPAA covered entity?
No. Legally separate covered entities under common ownership or control may make a documented affiliated-covered-entity designation if the requirements are met. The designation and its scope should be verified rather than assumed from branding.
Can a managed facility be added to the operator’s shared tenant without further review?
A management contract alone does not settle the HIPAA relationship. Review legal entities, covered functions, authority, business-associate or other arrangements and approved uses before configuring shared access.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.