The day you sell your clinic, they will ask for this

Most ABA clinic owners meet HIPAA as a grudge purchase: a rule to satisfy, a binder to buy, a box to tick. Then one day a broker calls, or a regional group makes an approach, or a private equity roll-up sends a letter, and HIPAA stops being a rule and becomes a number.

Because the buyer’s counsel is going to ask, and what you can hand them in the first week of diligence will move your price.

What they actually ask for

The HIPAA diligence request is remarkably consistent across deals, and it is short enough to print. Every item on it exists because a specific provision of the rules creates it, and every item is either in your hands on day one or it is not.

Notice what that list is. It is not a special acquisition artifact. It is the HIPAA program, reorganized into a buyer’s mental model instead of a regulator’s. Which is the entire point of this page.

The six-year window is not a coincidence

HIPAA requires that required documentation be retained for six years from the date of its creation or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)(i)). Six years is also, in practice, the lookback a careful acquirer applies.

So the evidence file you would hand an OCR investigator and the evidence file you would hand a buyer’s counsel are substantially the same file, pointed at a different reader. The operator who has been maintaining it all along walks into diligence with the work already done. The operator who has not spends the diligence window building a compliance record under a deadline, while the buyer watches, which is the worst possible condition under which to construct one.

Why they open with the risk analysis

They open with it for the same reason OCR does: it is the least fakeable document in the program, and its absence is diagnostic.

OCR has run a dedicated Risk Analysis Initiative since late 2024, and the pattern in its own announcements is relentless. In April 2026 it settled four ransomware investigations at once, totaling 1,165,000 dollars across breaches affecting more than 427,000 people, and the finding in all four was the same: no accurate and thorough risk analysis before the breach.

And for anyone in this field who still believes enforcement is a hospital problem, there is one settlement that should end the argument. In July 2025, OCR settled with Deer Oaks, a behavioral health provider, for 225,000 dollars and a two-year corrective action plan, after breaches affecting over 171,000 individuals. OCR’s finding: the organization failed to conduct an accurate and thorough risk analysis.

A buyer’s counsel reads that record too. So when they ask for your risk analysis and you cannot produce one, the inference is not that you have a gap. The absence of the risk analysis is not read as a gap in a program. It is read as proof the program was never real, and that inference then colors every other compliance representation you make in the deal.

What a red answer actually does

It rarely kills the deal outright. It reprices it, and the mechanics are worth knowing before you are inside them.

“The absence of the risk analysis is not read as a gap in a program. It is read as proof the program was never real”

The multiple comes down. Unquantifiable risk gets quantified conservatively, by the party who benefits from the conservative number.

The escrow goes up. Cash you earned sits in a holdback for years against violations that might surface later, because HIPAA liability can follow the entity or the assets depending on how the deal is structured.

Indemnities survive closing. A carve-out that outlives the general survival period is a tail you carry personally.

A restructuring condition delays the close. Months, sometimes, while you rebuild a compliance record, and every month of delay is a month in which something else in the deal can break.

And the insurance does not save you. Representation and warranty insurance generally excludes known issues. A problem surfaced in diligence is, by definition, known. It cannot be insured around; it comes out of the price or it goes into escrow.

Diligence already scores targets red, yellow, and green to drive exactly these adjustments. The buyer’s counsel was going to build that scored picture anyway, by hand, out of whatever box of documents you send them. The only question is whether the picture they build matches the one you would have built yourself.

The trap: a binder that is worse than nothing

There is a temptation, once the term sheet is in sight, to paper over the gap quickly. Buy a policy set. Backdate nothing, but produce a great deal of documentation in a hurry.

Do not. Documentation that does not describe what your clinic actually does is worse than no documentation, and it is worse for a precise reason: it converts an evidentiary hole into an admission. It demonstrates that the organization knew the requirement and represented a compliance program it did not have. An empty file is a gap. A false file is a finding, and in a transaction it is a representation you signed.

This is why the honest posture is not just ethically better. It is commercially better. A seller who hands over a program with two amber items, a dated remediation plan, and evidence of the work is more credible, and more valuable, than a seller who hands over an implausibly perfect binder assembled last month.

What to do, if a sale is anywhere on your horizon

Not on the eve of the deal. Now, while it is quiet, which is the only time this is cheap.

Do the risk analysis properly, on a real inventory of where your ePHI actually lives. It is the page they open with, and it is the one that colors everything else.

Close the vendor register. Every vendor touching PHI, every BAA executed and current. The walkthrough is here, and this is the second item their counsel checks, because it is the easiest to falsify by omission.

Keep the incident log, even for the small ones. A clinic with a log showing three minor incidents, assessed and closed, reads as a functioning program. A clinic with an empty log reads as a clinic that never looked.

Make the training record a record, not a memory: who, when, on what.

Fix the amber items and keep the receipts. Remediation with dates is an asset in diligence. It shows a program that finds and closes things, which is exactly what a buyer wants to inherit.

Everything on that list is required of you anyway. The only thing the sale changes is who reads it, and what it costs you if it is not there.

The honest summary

The file that satisfies an auditor is the file that satisfies a buyer. Both of them are asking the same question, and it is not “did you mean well.” It is: show me.

You will build that file eventually. You will either build it over years, quietly, as a by-product of running the clinic properly, or you will build it in six weeks, under a deadline, with a counterparty whose financial interest is served by finding it thin.

Those are the two options, and the price difference between them is the largest number in this article that nobody ever writes down.