2026 HIPAA Security Rule: What Home Healthcare Agencies Need to Know
Editor's Note: As of May 2026, HHS/OCR has proposed updates to the HIPAA Security Rule, but agencies should confirm the final regulatory language once published. This article is for educational purposes and does not constitute legal advice.
A Deep Dive for Agency Owners, Administrators, Compliance Officers, and Healthcare Leaders
Healthcare is moving into the home. That is no longer a prediction; it is the direction of the industry.
Across the United States, home healthcare agencies are being asked to do more: support older adults who want to age in place, reduce unnecessary hospitalizations, coordinate with physicians and payers, document outcomes, meet quality expectations, and manage increasingly complex patient needs outside traditional clinical settings.
But as care moves into the home, something else moves with it: cyber risk.
Every home visit now depends on technology. Scheduling systems, electronic visit verification platforms, EMRs, mobile phones, tablets, laptops, email, cloud storage, billing systems, payer portals, referral platforms, and third-party vendors all play a role in delivering care. That means patient information is no longer sitting in one file cabinet or one office system. It is moving constantly across people, devices, applications, and organizations.
That is why the expected 2026 update to the HIPAA Security Rule matters so much for home healthcare agencies.
As of May 2026, HHS/OCR has issued a major Notice of Proposed Rulemaking to strengthen the HIPAA Security Rule, but the final rule has not yet been confirmed as published. HHS describes the proposal as an effort to update cybersecurity safeguards, better address modern threats, and require covered entities and business associates to better protect electronic protected health information, or ePHI, against internal and external threats.
For home healthcare leaders, the direction is clear: HIPAA security is becoming more specific, more operational, and more difficult to treat as a paperwork exercise.
The HIPAA Security Rule Is No Longer Just an IT Issue
The existing HIPAA Security Rule already requires covered entities and business associates to protect the confidentiality, integrity, and availability of ePHI through administrative, physical, and technical safeguards.
That sounds technical, but it is really a business leadership issue.
For a home healthcare agency, confidentiality means patient information is not exposed to unauthorized people. Integrity means patient information is accurate, reliable, and not improperly changed. Availability means staff can access the systems and data they need to deliver care when they need them.
A ransomware attack can destroy availability. A phishing incident can destroy confidentiality. A poorly managed user account can threaten integrity. A lost laptop, weak password, compromised email account, or careless vendor can become a HIPAA problem, an operational problem, and a patient trust problem at the same time.
This is why agency owners and administrators cannot leave cybersecurity entirely to "the IT person." The consequences are too broad. A cyber incident can interrupt visits, delay billing, expose patient records, damage referral relationships, trigger regulatory scrutiny, and create reputational harm in the community.
Cybersecurity has become part of care delivery.
Why Home Healthcare Agencies Are Especially Exposed
Hospitals and large health systems usually have centralized IT departments, security teams, compliance offices, and formal governance processes. Many home healthcare agencies operate differently.
They often have distributed workers, lean administrative teams, limited cybersecurity budgets, high staff turnover, multiple cloud platforms, and a mix of agency-owned and personal devices. Some staff access patient information from home, from the field, from a car, from a patient's residence, or from a mobile device connected to a public or home Wi-Fi network.
That creates a very different risk profile.
A typical agency may use one system for scheduling, another for billing, another for payroll, another for email, another for caregiver communication, another for document storage, and another for electronic visit verification. Patient information may flow through emails, attachments, spreadsheets, portals, text messages, scanned documents, and mobile apps.
This complexity creates gaps.
Common weaknesses include no multi-factor authentication, shared passwords, unmanaged laptops, personal phones used for work communication, weak email security, no endpoint detection and response, no tested backup, incomplete HIPAA risk analysis, outdated policies, limited staff training, and no clear incident response process.
These issues are not rare. They are common across small and mid-sized healthcare organizations. And the expected HIPAA Security Rule update is likely to make these gaps harder to ignore.
The Proposed Rule Signals a More Prescriptive Era
One of the most important things about the proposed HIPAA Security Rule update is its tone. HHS has stated that the proposed rule would clarify and provide more specific instruction about what regulated entities must do to protect ePHI. It would also require policies and procedures to be written, reviewed, tested, and updated regularly.
That matters.
For years, many organizations leaned on the flexibility of the Security Rule. Flexibility was useful because a small home healthcare agency does not have the same resources as a national hospital system. But flexibility was never intended to mean doing the minimum or avoiding basic cybersecurity controls.
The proposed rule reflects a larger shift in healthcare regulation: cybersecurity expectations are becoming more concrete.
In practical terms, agencies should expect more scrutiny around whether they can demonstrate actual security practices, not just policies. It will not be enough to say, "We take HIPAA seriously." Agencies will need evidence.
That evidence may include risk analysis documentation, asset inventories, access control reviews, MFA implementation, backup testing, incident response plans, vendor oversight, staff training records, and proof that security policies are reviewed and updated.
Risk Analysis Will Remain the Foundation
If there is one area every home healthcare agency should focus on immediately, it is the HIPAA Security Rule risk analysis.
OCR's January 2026 cybersecurity newsletter emphasized that the Security Rule's risk analysis provision requires regulated entities to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI, including risks from unpatched software.
For home healthcare agencies, a proper HIPAA risk analysis cannot be generic. It must reflect how the agency actually operates.
That means asking:
- Where does ePHI enter our agency?
- Which systems store patient information?
- Which employees, contractors, and vendors can access it?
- Which devices are used by field staff?
- Are personal phones being used to communicate patient information?
- Is email protected with multi-factor authentication?
- Are laptops encrypted?
- Are former employees removed from systems immediately?
- Are backups tested?
- Do we know what to do if our EMR or billing system goes down?
- Do our vendors have access to ePHI?
- Do we have signed Business Associate Agreements?
A superficial checklist will not be enough. The agency must understand its real environment. If patient information flows through a process, device, application, vendor, or employee, that area belongs in the risk analysis.
Asset Inventory and ePHI Mapping Will Become Critical
One of the most practical changes home healthcare agencies should prepare for is the need for better system inventory and ePHI mapping.
You cannot protect what you cannot identify.
An agency should know every system, application, device, and vendor that creates, receives, maintains, transmits, or stores ePHI. This includes the obvious systems, such as EMRs and billing platforms, but also less obvious tools such as cloud drives, spreadsheets, email archives, scanned documents, messaging platforms, payroll systems, referral portals, and backup systems.
For many agencies, this exercise is eye-opening. Leaders often discover that patient information is scattered across more places than expected.
A strong system inventory should answer:
- What technology do we use?
- Who owns each system?
- What patient information is inside it?
- Who has access?
- Is access role-based?
- Is MFA enabled?
- Is the data encrypted?
- Is the system backed up?
- Does a vendor support it?
- Do we have a Business Associate Agreement?
- When was access last reviewed?
This type of inventory is not just for compliance. It improves operational discipline. It helps with onboarding, offboarding, vendor management, cyber insurance, incident response, and disaster recovery.