Aprio is a board portal built for U.S. community health center boards, with HIPAA compliance, legally binding e-signatures, and an audit trail of votes, signatures, and logins, used by health centers like HopeHealth in South Carolina. A community health center funded under Section 330 of the Public Health Service Act, the kind most people call an FQHC, runs what may be the most regulated volunteer board in American health care. Federal law fixes how many people may sit on it, requires that a majority of them be patients of the center, and orders it to meet every single month and keep minutes. This guide lays out what those rules ask for, what a federal reviewer reads, and what happens when the record does not hold up.
What does federal law actually require of a health center board?
Most board rules are best practice. These are statute. Section 330 requires that a health center have a governing board that “meets at least once a month, selects the services to be provided by the center, schedules the hours during which such services will be provided, approves the center’s annual budget, approves the selection of a director for the center … and, except in the case of a governing board of a public center … establishes general policies for the center.” The board must be “composed of individuals, a majority of whom are being served by the center.”1
Sources: 42 U.S.C. 254b(k)(3)(H); 42 CFR 51c.304; HRSA Health Center Program Compliance Manual, Chapter 20 (the 51 percent figure is HRSA’s operational reading of the regulation’s “majority”); HRSA Site Visit Protocol, Board Authority chapter.
The regulation adds the numbers. A health center board “shall consist of at least 9 but not more than 25 members,” a range the Secretary may waive for good cause shown, though HRSA will not grant a waiver except where a center has demonstrated an inability to meet the requirement.2, 3 A majority must be people who are or will be served by the center, and as a group they have to represent the patient population. Of the members who are not patients, no more than half may earn more than 10 percent of their annual income from the health care industry. No board member may be an employee of the center, or the spouse, child, parent, or sibling of one, though the chief executive may sit as a non-voting ex officio member. And the board “shall hold regularly scheduled meetings, at least once each month, for which minutes shall be kept.”2
The patient majority has a documentary test behind it. For board composition purposes, the Health Resources and Services Administration (HRSA), the federal agency that runs the Health Center Program, counts someone as a patient if they “received at least one service in the past 24 months that generated a health center visit,” where both the service and the site sit inside the center’s approved scope of project, meaning the services and locations HRSA has approved for that center.3 Reviewers check that against billing records.4 A standard community health center cannot waive the patient majority; only centers funded solely for migratory and seasonal agricultural workers, people experiencing homelessness, or public housing residents can even apply.1, 3
What has to be in the minutes?
HRSA’s answer is one sentence: the board “must hold monthly meetings and record in meeting minutes the board’s attendance, key actions, and decisions.” The longer answer is a list of authorities the minutes have to prove the board exercised, in HRSA’s words, “without restriction.” Nothing may sit above the board on these. No committee, no executive committee, no parent organization may hold veto or approval power over them, and if an executive committee acts in an emergency, the full board has to vote on it afterward.5
| What the record has to show | How often |
|---|---|
| A meeting held with a quorum present, and the attendance, key actions, and decisions recorded | Every month |
| Approval of the selection, evaluation, and if necessary the dismissal of the chief executive | As it happens; the most recent evaluation is requested at the site visit |
| Approval of the annual budget, covering the uses of both the federal award and other revenue | Every year |
| Approval of the center’s sites, hours of operation, and services, including any decision to subaward or contract a substantial portion of services | On every change |
| Review of the annual audit results, with the follow-up actions the board required | Every year |
| Long-range planning covering financial management and capital expenditure needs | At least every three years |
| Adoption or re-approval of the sliding fee discount, quality improvement, billing and collections, financial management, and personnel policies | At least every three years |
| Evaluation of the center’s performance using quality assessments, with follow-up on project objectives, service utilization, quality of care, efficiency, and patient satisfaction including grievances | Ongoing, evidenced across the year |
Source: HRSA Health Center Program Compliance Manual, Chapter 19 (Board Authority), Demonstrating Compliance.
Two small mercies worth knowing. If your minutes say the board “accepted” a policy, HRSA treats that as equivalent to “approved.”6 And the Health Center Program does not require signatures to demonstrate approval of board minutes.7
Twelve meetings a year. Could you produce all twelve sets of minutes tomorrow?
Aprio keeps every meeting’s minutes and materials in one searchable place, so a year of the record is a search rather than a hunt.
What does a HRSA site visit ask you to hand over?
HRSA checks compliance through an operational site visit, or OSV, held roughly at the midpoint of each health center’s project period, the multi-year window HRSA also calls the period of performance.6 That period has historically run three years and is moving to four, so the visit comes around less often than it used to, which also means more record to assemble when it does.8 The list of documents is published in advance, question by question, which means an administrator can rehearse the whole thing.7
Here is what the governance reviewer asks for, and how far back each item reaches.
| What you hand over | How far back |
|---|---|
| Board agendas and minutes for every meeting | The most recent 12 months |
| Committee minutes or committee documents that support board functions | The most recent 12 months |
| A board calendar or other scheduling documents | The most recent 12 months |
| A sample of board packets from two board meetings | A sample from the most recent 12 months |
| Minutes showing approval of the sliding fee discount, quality improvement, billing and collections, financial management, and personnel policies | Any relevant meeting in the past 3 years |
| The strategic plan or other long-term planning documents | Within the past 3 years |
| Articles of incorporation, and bylaws if they changed since your last application | Current |
| The chief executive’s position description, employment agreement, and most recent evaluation | Current |
Source: HRSA Site Visit Protocol, Board Authority chapter, and Site Visit Protocol Introduction.
Everything is due at least two weeks before the visit starts, and HRSA is blunt about the deadline: documents not provided by the close of the first day “will not be considered in the compliance assessment.”6
Then the reviewer answers a yes or no question that decides the whole element: “Do board minutes document that the board met monthly for the past 12 months and had a quorum present that enabled the board to carry out its required authorities and functions?” Further questions ask for examples of the board approving the budget, the sites and hours, the services, the chief executive’s selection and evaluation, and the audit follow-up. A no on any of them requires an explanation. The reviewer also interviews the board itself, aiming to speak with a majority of members as a group, or failing that the officers and at least one patient board member.7
This is where the shape of your record starts to matter more than its contents. Twelve months of minutes pulled from twelve email threads is a week of work. In Aprio you start each set of minutes from that meeting’s agenda, track attendance as the meeting runs, and assign action items to members as topics are covered, so the packet and the minutes stay together and the year is already assembled when the request arrives.
What happens if the record does not hold up?
A governance finding does not produce a stern letter. It places a condition on the federal award itself, and starts the process HRSA calls Progressive Action. Phase One is a formal notice of award naming the specific requirement the center has not demonstrated, with 90 days to address it.9 A condition that is adequately addressed within its window does not advance to the next phase.
Left unresolved, Phase Two adds 60 days, and the stakes change: any active 60-day or 30-day condition is displayed on the center’s public Health Center Profile, where anyone can look it up. Phase Three adds a final 30 days and is, in HRSA’s words, the last opportunity. The long 120-day implementation phase is not automatic: it applies only where HRSA has approved the center’s corrective action plan, and it exists to carry that plan out and document compliance. A center that runs out the clock is determined to have failed the terms of its award, and its period of performance can be shortened or the award terminated.9
Each phase is shown to scale, so the shrinking windows are the shape of the picture.
Source: HRSA Health Center Program Compliance Manual, Chapter 2 (Health Center Program Oversight).
Miss the last window and HRSA may shorten the center’s period of performance by terminating all or part of the award. Short of that, the funding itself gets worse: a center that fails to demonstrate compliance may be awarded only a one-year period of performance, and after two consecutive one-year awards HRSA will not fund a third. At that point it can open the service area to competition and look for another organization to run it.9
There is one more layer that surprises new board members. Health centers get medical malpractice protection by being deemed Public Health Service employees under the Federal Tort Claims Act, and that coverage reaches “governing board members, officers, employees, and certain individual contractors.” The board members are covered individuals. Deeming also requires annual reporting to the board on risk management activities, performance against risk management goals, and the follow-up actions taken.10 So the board’s own liability protection depends in part on the board’s own paperwork. In Aprio that annual report is stored with the meeting it was presented to, so it sits alongside the minutes rather than in a folder someone has to remember.
What do the IRS and HIPAA rules add on top?
For a health center organized as a 501(c)(3) nonprofit, a second documentation clock runs alongside the federal one. Form 990 asks whether the organization contemporaneously documented every meeting held and every written action taken by its board and by committees acting on the board’s behalf. The IRS defines contemporaneous as the later of the next meeting or 60 days after the meeting. Answering no means explaining your documentation practices on Schedule O, on a public filing. Form 990 also asks whether the organization has a written conflict of interest policy.11 Separately, when the board sets executive compensation, the rules that make that compensation presumed reasonable require the minutes to record the terms and date approved, who was present during debate and who voted, the comparability data and how it was obtained, and any action taken by a member with a conflict.12
Sources: IRS 2025 Instructions for Form 990, Part VI Line 8; 45 CFR 164.316(b)(2)(i); HHS Office for Civil Rights, Enforcement Highlights, as of October 31, 2024.
HIPAA adds a retention clock rather than a drafting one. A health center has to conduct a risk analysis of the threats to its electronic protected health information, and the documentation the Security Rule requires has to be kept for six years from creation or from when it was last in effect, whichever is later.13, 14 Breach notification to affected individuals runs no later than 60 calendar days after discovery.15 Enforcement is real: the HHS Office for Civil Rights had settled or imposed a civil money penalty in 152 cases, just under $145 million, as of October 31, 2024.16
Aprio holds those years in a searchable library, with role-based control over who can open which materials.
Who do health centers serve, and why does that land on the board?
Who the patients are is what makes the sliding fee discount program board business rather than finance business. Across the 32.7 million people health centers served in 2025, nearly half were covered by Medicaid, roughly one in six had no insurance at all, and 67.7% of those with known income were at or below the federal poverty guideline.17
All 32.7 million patients in 2025, by main insurance. Other public insurance, 0.6%, is the thin sliver at the right end.
Source: HRSA Uniform Data System, Table 4, Selected Patient Characteristics, 2025. Figures rounded.
That is the job Aprio does for a health center board. The agenda, the packet, the minutes, the votes, and the signatures live in one place instead of five, and the reporting behind them shows attendance and vote results when a reviewer or a committee asks. Where geography makes monthly attendance hard, HRSA allows the meeting to run by phone or other electronic means as long as everyone can hear and speak, and Aprio launches those meetings through the videoconferencing tool you already use.5 Board data is hosted in the US or in Canada, your choice. Health centers like HopeHealth and Premier Community Healthcare run their boards on it.
Minutes that are finished before the 60-day clock matters
In Aprio you start each set of minutes from that meeting’s agenda and send it to an approver as soon as the draft is done.
Frequently asked questions
How often must a community health center board meet?
Every month. The requirement sits in the statute, which says the governing board “meets at least once a month,” and in the regulation, which requires “regularly scheduled meetings, at least once each month, for which minutes shall be kept.”1, 2 Where geography or other circumstances make monthly in-person attendance burdensome, HRSA allows the meeting to be held by telephone or other electronic means where all parties can hear and speak to each other.5
How many members must an FQHC board have, and how many must be patients?
At least 9 and no more than 25 voting members under 42 CFR 51c.304.2 The Secretary may waive that range for good cause shown, but HRSA will not grant a waiver except where the health center has demonstrated an inability to meet the requirement. At least 51 percent must be patients of the health center, and as a group they must represent the patient population. Of the non-patient members, no more than half may earn more than 10 percent of their annual income from the health care industry, and no member may be an employee of the center or an employee’s immediate family member.3
What do HRSA reviewers ask for at an operational site visit?
For the governance review: bylaws and articles of incorporation, a board calendar and 12 months of board agendas and minutes, 12 months of committee minutes, board packets from two of those meetings, older minutes from the past three years showing key policy approvals, the strategic plan from within the past three years, and the chief executive’s position description, employment agreement, and most recent evaluation.7 Documents are due at least two weeks before the visit, and anything not provided by the close of the first day is not considered.6
What happens if a health center fails a governance requirement?
HRSA places a condition on the award and starts its Progressive Action process: 90 days in Phase One, a further 60 in Phase Two, a further 30 in Phase Three, plus 120 days to implement an approved plan where one applies. Active 60-day and 30-day conditions appear on the center’s public HRSA profile. A center that does not demonstrate compliance may receive only a one-year period of performance, and after two consecutive one-year awards HRSA may open the service area to competition.9
Is there a board portal built for community health center boards?
Yes. Aprio is a board portal built for U.S. community health center boards, with board packets, minutes, voting, legally binding e-signatures, and a complete audit trail in one secure system, backed by ISO 27001, SOC 2 Type 2, and HIPAA compliance. Health centers like HopeHealth in South Carolina and Premier Community Healthcare in Florida run their boards on Aprio.
For more on how health centers run their boards on the platform, see Aprio’s board portal for healthcare, or book a demo.
References
- U.S. Government Publishing Office. United States Code, Title 42, Section 254b (Health centers), subsection (k)(3)(H). 2024 edition. govinfo.gov
- Office of the Federal Register. Electronic Code of Federal Regulations, 42 CFR 51c.304, Governing board. Current through September 2026. ecfr.gov
- Health Resources and Services Administration. Health Center Program Compliance Manual, Chapter 20: Board Composition. Page last reviewed November 2025. bphc.hrsa.gov
- Health Resources and Services Administration. Health Center Program Site Visit Protocol, Chapter 18: Board Composition. Page last reviewed December 2025. bphc.hrsa.gov
- Health Resources and Services Administration. Health Center Program Compliance Manual, Chapter 19: Board Authority. Page last reviewed November 2025. bphc.hrsa.gov
- Health Resources and Services Administration. Health Center Program Site Visit Protocol, Introduction. Page last reviewed December 2025. bphc.hrsa.gov
- Health Resources and Services Administration. Health Center Program Site Visit Protocol, Chapter 17: Board Authority. Page last reviewed December 2025. bphc.hrsa.gov
- Health Resources and Services Administration. Service Area Competition Frequently Asked Questions, fiscal year 2026. Page last reviewed December 2025. bphc.hrsa.gov
- Health Resources and Services Administration. Health Center Program Compliance Manual, Chapter 2: Health Center Program Oversight. Page last reviewed November 2025. bphc.hrsa.gov
- Health Resources and Services Administration. Health Center Program Compliance Manual, Chapter 21: Federal Tort Claims Act (FTCA) Deeming Requirements. Page last reviewed December 2025. bphc.hrsa.gov
- Internal Revenue Service. Instructions for Form 990 (2025), Part VI, Lines 8 and 12. 2025. irs.gov
- Office of the Federal Register. Electronic Code of Federal Regulations, 26 CFR 53.4958-6, Rebuttable presumption that a transaction is not an excess benefit transaction. Current through September 2026. ecfr.gov
- Office of the Federal Register. Electronic Code of Federal Regulations, 45 CFR 164.308, Administrative safeguards. Current through September 2026. ecfr.gov
- Office of the Federal Register. Electronic Code of Federal Regulations, 45 CFR 164.316, Policies and procedures and documentation requirements. Current through September 2026. ecfr.gov
- Office of the Federal Register. Electronic Code of Federal Regulations, 45 CFR 164.404, Notification to individuals. Current through September 2026. ecfr.gov
- U.S. Department of Health and Human Services, Office for Civil Rights. HIPAA Enforcement Highlights, enforcement results as of October 31, 2024. Page last reviewed November 2024. hhs.gov
- Health Resources and Services Administration. Uniform Data System, National Health Center Program Data, Table 4: Selected Patient Characteristics. 2025. data.hrsa.gov