Not every therapy practice on Long Island operates alone in its own building. Professional office complexes — like The Amityville Workhouse, a converted building now home to several independent therapy practices under one roof — are increasingly common, and they raise IT and compliance questions that a single-suite practice simply doesn’t have to think about. If your practice shares a building, a network closet, or even just an internet connection with other tenants, this one’s for you.
The Core Problem: One Building, Multiple Compliance Obligations
When several therapy practices share a physical space, it’s tempting to also share IT infrastructure — one Wi-Fi network, one router, maybe even one printer on a shared drive. It’s convenient. It’s also a HIPAA risk waiting to happen. Each practice is independently responsible for the privacy and security of its own patients’ PHI, and that responsibility doesn’t get smaller just because the internet bill is split three ways.
What Proper Shared-Building IT Actually Looks Like
Network segmentation
The single most important fix for a multi-tenant building is network segmentation — typically using VLANs (virtual local area networks) so that each practice’s traffic is logically isolated, even if it’s running over shared physical cabling or a shared internet connection. Practice A’s devices simply cannot see or reach Practice B’s devices, even though they’re in the same building.
Separate, encrypted Wi-Fi per tenant
A single “building Wi-Fi” password shared by every tenant and their patients is a common but serious mistake. Each practice should have its own secured network for clinical devices, separate from any guest or waiting-room Wi-Fi.
Independent backups per practice
Shared infrastructure should never mean shared backups. Each practice’s patient records need their own encrypted, access-controlled backup — not a folder on a common server that other tenants’ staff could theoretically browse to.
Physical security tied to digital access
Door access logs, server closet locks, and device physical security matter as much as passwords in a shared building. If anyone with a building key can walk up to a server rack, the network segmentation above only goes so far.
A Practical Checklist for Multi-Tenant Practices
- Confirm your practice has its own segmented network, not just a password-protected shared one
- Verify your patient data backups are isolated to your practice, with access limited to your staff
- Clarify in writing who is responsible for the shared internet connection’s security and uptime
- Make sure your Business Associate Agreements cover any shared IT vendor, not just software vendors
- Test that a device on another tenant’s network genuinely cannot reach your systems
Why This Matters More Than It Seems
A HIPAA breach doesn’t care that the vulnerability technically belonged to “the building” rather than your practice specifically. If patient data was exposed because of shared, unsegmented infrastructure, your practice is still on the hook. Getting this right at the network level, before it’s ever tested by an incident, is far cheaper than explaining a breach after the fact.
Getting It Right
Buildings like The Amityville Workhouse show how common this setup actually is on Long Island — independent practices sharing walls, sometimes sharing wiring, but never allowed to share compliance risk. If your practice operates in a shared space and you’ve never had your network segmentation specifically verified, that’s worth doing before it becomes a problem instead of after.
Get a free Therapy Practice IT Assessment and we’ll check whether your shared-building setup is actually as separate as you think it is.