Nursing Home
8 min read
CMS Cybersecurity Requirements for Nursing Homes & SNFs
How CMS Conditions of Participation intersect with cybersecurity, what surveyors look for, and SNF-specific risks like med-carts and IoT devices.
Read articleAuthor Archive
Obi Ibeto
102 articles written by Obi Ibeto.
Articles
A focused archive without featured content or extra filters.
FQHC
8 min read
HRSA Cybersecurity Requirements for FQHCs: A Compliance Guide
How HRSA Health Center Program requirements intersect with cybersecurity, what site visits examine, and where HIPAA and HRSA compliance overlap.
Read article
risk analysis
9 min read
HIPAA Risk Analysis for Home Health Agencies: Step-by-Step
The most commonly cited deficiency in OCR audits, broken into a step-by-step process: identify PHI flows, identify threats, assess likelihood and impact, document controls, and prioritize remediation.
Read article
incident response
9 min read
Incident Response Plan for Home Health Agencies (with Template)
A real, usable incident response plan template: detection, containment, eradication, recovery, the 60-day HHS notification requirement, and staff notification.
Read article
vendor risk management
9 min read
Vendor Security Assessments & BAAs: A Home Health Guide
What a HIPAA Business Associate Agreement must include, red flags in vendor contracts, and a 10-question security assessment template for EHR vendors, billing companies, and scheduling software.
Read article
telehealth security
9 min read
Telehealth HIPAA Compliance for Home Health Agencies
The COVID-era telehealth enforcement discretion ended with the Public Health Emergency. What HIPAA-compliant telehealth actually requires now: BAAs, end-to-end encryption, and caregiver device security for video visits.
Read article
cloud security
9 min read
Home Health Cloud Security Policy: Template & Best Practices
Which cloud services need a HIPAA BAA, what a cloud security policy must cover, and a full adaptable policy template you can use as your agency's first draft.
Read article
patch management
9 min read
Patch Management for Home Health Agencies: HIPAA, Process & Automation
Unpatched software is the #1 ransomware entry point. How HIPAA's Security Rule treats patching, a step-by-step patching process, how to patch a 24/7 care fleet without disrupting it, and how ShieldForce automates the whole thing.
Read article
mobile security
9 min read
Mobile Device Security for Home Health: BYOD, MDM & PHI
Most home health agencies run on BYOD, and that is their biggest attack surface. A practical guide to MDM, device encryption, selective remote wipe, mobile MFA, and writing a personal-vs-agency device policy that actually holds up under HIPAA.
Read article
checklist
10 min read
Home Health Agency Cybersecurity Checklist: 35 Items by HIPAA Category
A 35-item home health cybersecurity checklist organized by HIPAA Administrative, Physical, and Technical safeguards -- built to survive an actual OCR audit, not just read well as a listicle.
Read article
HIPAA
4 min read
What Hospice Agencies Need to Know About the 2026 HIPAA Security Rule Update
The proposed 2026 HIPAA Security Rule update would change several requirements from \"addressable\" to mandatory — with direct implications for hospice agencies. Here's what the proposed rule contains and how your agency should prepare.
Read article
BYOD
4 min read
Personal Devices on Home Wi-Fi: The Security Gap Killing HIPAA Compliance for Home Health Agencies
When field nurses access patient records from personal devices on home Wi-Fi networks, it creates HIPAA compliance gaps that most agencies haven't addressed. Here's how to close them without disrupting care delivery.
Read article
Compliance
13 min read
Home Health Agency Data Retention: How Long to Keep Records and How to Delete Them Securely
Data retention is the compliance obligation that home health administrators most consistently defer until something forces them to address it. The forcing functions are rarely pleasant: an OCR audit requests…
Read article
Compliance
14 min read
Cybersecurity Metrics Every Home Health Agency Board Should See Quarterly
I have sat in on enough home health agency board meetings to know that cybersecurity reporting — when it happens at all — tends to follow one of two patterns.…
Read article
Compliance
3 min read
New York SHIELD Act and Home Health Agencies: What State Law Adds Beyond HIPAA
New York's Stop Hacks and Improve Electronic Data Security Act — the SHIELD Act — became effective March 21, 2020, and applies to any person or business that owns or…
Read article
HIPAA
3 min read
HIPAA Employee Offboarding at Home Health Agencies: The Complete Security Checklist
Of all the security compliance failures I encounter at home health agencies, the persistence of former employee access is simultaneously the most common, the most preventable, and the most likely…
Read article
Cybersecurity ROI
3 min read
Cybersecurity Across Multiple Locations: Home Health Franchise Security Management
A home health franchise organisation that operates thirty locations faces a cybersecurity challenge that is qualitatively different from the challenges facing a single-location agency. The single-location agency controls one environment,…
Read article
AI
3 min read
HIPAA and AI Documentation: What Home Health Agencies Must Record in 2026
Artificial intelligence tools have entered home health operations at a pace that has significantly outrun the compliance frameworks most agencies have in place to govern their use. Care coordinators use…
Read article
Home Healthcare Security
3 min read
When a Home Health Data Breach Becomes a Class Action: Legal Liability in 2026
For most of the history of HIPAA enforcement, the primary legal consequence of a home health data breach was an OCR investigation and potential civil monetary penalty. Class action litigation…
Read article
Home Health
4 min read
Third-Party Risk Assessment for Home Health: A Practical Vendor Scorecard
Not all vendor risks are equal. Here is a tiered vendor scorecard for home health agencies — allocating scrutiny proportional to each vendor's level of ePHI access.
Read article
home health
3 min read
Multi Factor Authentication For Home Health Why Sms Codes Are No Longer Enough
The proposed 2026 HIPAA Security Rule update would mandate MFA for all ePHI access. Not all MFA is equal — here is why SMS codes fall short, what stronger options exist, and how to deploy them to field staff.
Read article
home health
3 min read
How Home Health Agencies Can Achieve Hitrust Certification A Step By Step Roadmap
HITRUST is becoming a hospital-referral differentiator for home health agencies. Here is the step-by-step roadmap from HIPAA compliance to HITRUST e1 certification.
Read article
home health
3 min read
Hipaa Breach Notification A Step By Step Guide For Home Health Agencies
A confirmed data breach triggers strict notification obligations within 60 days, 72 hours, and immediately. Here is exactly what home health agencies must do to stay HIPAA compliant. This incident response guide complements the proactive approach outlined in: <a href="/blog/hipaa-security-risk-assessment-home-health-agency-guide" title="HIPAA Risk Analysis & Assessment: Complete Step-by-Step Guide for Home Health Agencies">HIPAA Risk Analysis & Assessment: Complete Step-by-Step Guide for Home Health Agencies</a>
Read article
home health
4 min read
How Home Health Agencies Can Win More Hospital Referrals With Cybersecurity Certification
Hospital discharge planners increasingly prefer home health agencies that can demonstrate cybersecurity compliance. Here's how a strong security posture becomes a competitive advantage for referrals.
Read article
email
2 min read
Email Security for Home Health Agencies: Stopping the #1 HIPAA Breach Vector
Phishing email drives the majority of home health data breaches. Here is the layered email security approach that stops credential theft, domain impersonation, and BEC attacks.
Read article
cyber
2 min read
Cyber Insurance for Home Health Agencies: What Carriers Now Require and How to Qualify
Cyber insurance underwriters are tightening requirements for home health agencies. Here is what carriers now demand — and how to qualify for maximum coverage at the best premium.
Read article
home health cybersecurity
4 min read
2026 Home Health Cybersecurity Threat Report: What Attacks Are Actually Happening
Ransomware, BEC, and credential theft dominate the 2026 home health threat landscape. Here is current attack data on frequency, cost, targets, and what controls stop each threat type.
Read article
purpose-built healthcare cybersecurity
4 min read
The ShieldForce Advantage: Why Purpose-Built Healthcare Cybersecurity Beats Generic IT Security
Generic IT security doesn't understand HIPAA, SHIN-NY, or how home health agencies actually work. Here's why purpose-built healthcare cybersecurity delivers better protection and better compliance outcomes.
Read article
incident response
5 min read
Incident Response for Home Health Agencies: The First 24 Hours
The first 24 hours of a cybersecurity incident determine whether your home health agency pays a ransom, notifies patients, and faces OCR — or contains the damage and recovers clean.
Read article
state survey
3 min read
Cybersecurity for Home Health Agencies During a State Survey: What Surveyors Look For
State health department surveyors are increasingly reviewing cybersecurity documentation during home health agency surveys. Here's exactly what they look for and how to be prepared.
Read article
cybersecurity due diligence
4 min read
Cybersecurity Due Diligence When Acquiring or Merging Home Health Agencies
Home health agency acquisitions create hidden cybersecurity liability. Here's the cyber due diligence checklist every buyer needs before closing a deal.
Read article
pediatric home health
4 min read
Protecting Pediatric Home Health Patients: Why Children's Health Data Requires Extra Security
Pediatric home health patients face unique privacy risks — their health data has a decades-long exposure window. Here's what extra security and HIPAA protections are required for agencies serving children.
Read article
New York Medicaid
3 min read
Medicaid Managed Care and Cybersecurity: What NY Home Health Agencies Must Know
New York Medicaid managed care organizations are adding cybersecurity requirements to provider agreements. Here's what NY home health agencies must demonstrate to maintain managed care contracts. <strong>Related Requirements for Agencies in Both Programs:</strong> <a href="/blog/cms-conditions-of-participation-home-health-cybersecurity-medicare-2026" title="Medicare guide">Medicare guide</a>
Read article
security awareness training
4 min read
Security Awareness Training That Actually Works for Home Health Care Teams
Generic security training doesn't work for home health care teams who learn on mobile devices between patient visits. Here's how to design training that sticks and satisfies HIPAA.
Read article
home health cybersecurity
4 min read
The Home Health Cybersecurity Buyer's Guide: How to Evaluate Managed Security Providers in 2026
Choosing a managed security provider for your home health agency is a high-stakes decision. Here's the complete evaluation framework — what to ask, what to avoid, and what separates specialists from generalists.
Read article
supply chain cybersecurity
4 min read
Supply Chain Cybersecurity for Home Health: Why Your Vendors Are Your Biggest Blind Spot
Home health agencies focus on their own security — but vendor breaches are now the leading cause of healthcare data exposure. Here's how to manage third-party cyber risk in 2026.
Read article
network segmentation
4 min read
Network Segmentation for Home Health Agencies: Why Your Office WiFi and EHR Should Never Share a Network
Home health agencies that run clinical systems and guest WiFi on the same network are one compromised device away from a full breach. Here's what network segmentation is and how to implement it.
Read article
HIPAA
4 min read
HIPAA-Compliant Telehealth: Securing Remote Patient Visits for Home Health Agencies
Telehealth visits by home health agencies create specific HIPAA security obligations. Here's how to secure video visits, remote monitoring data, and digital patient communication in 2026.
Read article
social engineering
4 min read
Social Engineering Attacks Targeting Home Health Scheduling Staff: What to Watch For in 2026
Home health scheduling departments are a prime target for social engineering. Attackers impersonate patients, families, physicians, and Medicare officials to extract information and gain system access.
Read article
HIPAA
5 min read
The Home Health Agency HIPAA Security Risk Assessment: A Step-by-Step Guide
A HIPAA Security Rule risk assessment is the foundation of every compliant home health security program — and the first document OCR investigators request. Here's how to conduct one correctly.
Read article
SOC 2
4 min read
SOC 2 vs. HIPAA: What Home Health Agencies Need to Know About the Difference
SOC 2 and HIPAA are both security frameworks — but they serve different purposes. Home health agencies need to understand both when evaluating technology vendors and cybersecurity providers.
Read article
ransomware
4 min read
How Hackers Compromise Home Health EHR Systems: The Attack Playbook Exposed
Ransomware groups have a specific playbook for compromising home health EHR systems. Understanding how attacks unfold is the first step to stopping them.
Read article
HIPAA
4 min read
Cybersecurity for Home Health Billing Companies: The Hidden Attack Surface
Third-party billing companies that handle home health claims are a major HIPAA compliance risk. Here's what agencies must know about securing the billing relationship.
Read article
community health
4 min read
How Community Health Centers Can Afford Enterprise Cybersecurity on a Safety-Net Budget
FQHCs don't have hospital IT budgets — but they face the same cybersecurity threats. Here's how community health centers access enterprise-grade protection within safety-net financial constraints.
Read article
hospice
3 min read
Volunteer Data Security in Hospice Organizations: An Overlooked HIPAA Risk
Hospice volunteers who access patient scheduling, names, and contact information are handling PHI and are frequently left out of HIPAA security programs. Here's how to fix that.
Read article
HIPAA
4 min read
HIPAA and AI: What Home Health Agencies Need to Know About Using AI Tools Safely
AI tools like ChatGPT and Microsoft Copilot are entering home health agencies. Here's what HIPAA requires before any AI tool can touch patient data — and what the risks are.
Read article
FQHC
4 min read
FQHC Telehealth Security: How to Protect Patient Data in Virtual Visits
FQHCs using telehealth platforms for virtual visits face unique HIPAA risks. Here's how to secure telehealth for community health centers without disrupting care delivery.
Read article
pediatric hospice
3 min read
Cybersecurity for Pediatric Hospice: Protecting the Most Sensitive PHI in Healthcare
Pediatric hospice patients are minors with terminal diagnoses — their records require heightened security and privacy protections beyond standard HIPAA requirements. Here's what pediatric hospice agencies must do.
Read article
SHIN-NY
4 min read
SHIN-NY Compliance for Small NY Home Health Agencies Under 25 Staff
SHIN-NY cybersecurity requirements apply to home health agencies of every size. Here's a right-sized compliance approach for small New York home health agencies with under 25 staff and no IT department.
Read article
SHIN-NY
4 min read
How to Write a SHIN-NY Incident Response Plan Your RHIO Will Accept
Your SHIN-NY CSPP must include an incident response plan — and your RHIO reviews it. Here's what to include to write a plan that satisfies RHIO requirements and actually works when you need it.
Read article
SHIN-NY
3 min read
How to Present SHIN-NY Compliance Progress to Your Board of Directors
Home health agency boards are increasingly expected to oversee cybersecurity posture. Here's how to present SHIN-NY compliance progress to your board in terms they understand and can act on.
Read article
SHIN-NY
5 min read
SHIN-NY RHIO Comparison: Hixny vs. Rochester RHIO vs. HealtheConnections vs. Healthix
New York's four RHIOs — Hixny, Rochester RHIO, HealtheConnections, and Healthix — each have specific SHIN-NY compliance processes. Here's what home health agencies need to know about each one.
Read article
hospice
3 min read
Securing Axxess for Hospice Agencies: Beyond the Platform's Built-In Security
Axxess is a widely used hospice software platform — but its security doesn't extend to your devices, networks, or staff behavior. Here's the security layer your hospice agency must build around Axxess.
Read article
Home Healthcare Security
3 min read
Managed Detection and Response (MDR) for Home Health: What It Is and Why It Beats Antivirus
Managed Detection and Response goes far beyond antivirus for home health agencies, providing 24/7 human-monitored threat detection and active response. Here's what it is and what it costs.
Read article
Home Healthcare Security
4 min read
Securing PointClickCare for Home Health Agencies: The Security Layer HHAs Must Add
PointClickCare is widely used in home health and post-acute care, but its security doesn't cover your devices, networks, or staff. Here's what your agency must add to stay HIPAA-compliant.
Read article
Home Health Security
4 min read
HIPAA Penalties in 2026: What Home Health Agencies Are Actually Being Fined For
OCR HIPAA penalties are accelerating in 2026. Here's what home health agencies are actually being penalized for and the specific documentation gaps that trigger six-figure fines.
Read article
Home Healthcare Security
5 min read
The Hidden Cost of Cheap Cybersecurity for Home Health Agencies
Cheap cybersecurity tools leave home health agencies exposed to HIPAA violations, ransomware, and six-figure breach costs. Here is the real price of cutting corners on security.
Read article
Home Healthcare Security
4 min read
AI Threats to Healthcare: How Deepfake Voice Attacks Are Targeting Home Health Billing Departments
AI-generated voice cloning attacks are now reaching home health billing departments, impersonating physicians, Medicare officials, and executives to authorize fraudulent transfers.
Read article
42 CFR Part 2
5 min read
42 CFR Part 2 + HIPAA: What Community Health Centers Serving Substance Use Patients Must Protect
FQHCs serving patients with substance use disorders face a dual privacy framework — HIPAA and 42 CFR Part 2. Here's what each requires and how to build a cybersecurity program that protects both.
Read article
FQHC
6 min read
FQHC Cybersecurity Budget Guide: How to Fund HIPAA Compliance Through Section 330 Grants
Section 330 grants cover HIPAA cybersecurity as an allowable cost under 45 CFR Part 75 — here's the exact budget narrative language, cost ranges by health center size, and the documentation HRSA expects at review.
Read article
HRSA
4 min read
HRSA Site Visit Prep: The Cybersecurity Documentation Auditors Check First at Community Health Centers
HRSA site reviewers increasingly assess health information security as part of health center compliance reviews. Here's the cybersecurity documentation your FQHC must have ready before a visit.
Read article
home health security
5 min read
Zero Trust Security for Home Health: What It Is and Why Your Agency Needs It
Zero Trust security assumes no user or device is trusted by default — a model that fits home health perfectly. Here's how it works and what it means for your agency's HIPAA compliance.
Read article
home healthcare security
5 min read
Disaster Recovery Planning for Home Health Agencies: Beyond the Backup
A backup is not a disaster recovery plan. Home health agencies need documented, tested recovery procedures that keep patient care running during a cybersecurity incident or technology failure.
Read article
home healthcare security
4 min read
Dark Web Monitoring for Home Health Agencies: Is Your Patient Data Already Compromised?
Stolen home health credentials and patient data are actively sold on dark web forums. Here's how dark web monitoring works, what it finds, and why every home health agency needs it in 2026.
Read article
home healthcare security
4 min read
What the 2025 United Health Group Breach Means for Every Home Health Agency
The UnitedHealth Group breach exposed 190 million Americans. Here's what it means for home health agencies — including increased phishing risk, supply chain exposure, and patient notification obligations.
Read article
home healthcare security
7 min read
How to Pass a HIPAA Security Audit: A Home Health Agency Preparation Guide
HIPAA Security Rule audits are increasing in 2026. Here's exactly how home health agencies should prepare — with the documents, controls, and evidence OCR investigators look for first.
Read article
FQHC
4 min read
MFA Would Be Mandatory for Every System Accessing ePHI Under the Proposed 2026 Rule: What This Means for FQHC Staff Workflows
The proposed 2026 HIPAA Security Rule update would make MFA mandatory for all ePHI access at FQHCs if finalized. Here's how to implement it across a diverse community health center workforce without disrupting clinical operations.
Read article
FQHC
4 min read
FQHCs Are the Most Under-Defended Target in Healthcare Cybersecurity. Here's the Evidence.
Federally Qualified Health Centers face the same ransomware and phishing threats as hospitals but with a fraction of the security resources. Here's the data — and what FQHCs must do in 2026.
Read article
FQHC
5 min read
The Proposed 2026 HIPAA Security Rule for FQHCs: What It Could Mean for HRSA Grant Conditions
The proposed 2026 HIPAA Security Rule update would create mandatory cybersecurity requirements for FQHCs — and HRSA grant conditions increasingly align with these standards. Here's what your health center should prepare for.
Read article
hospice
4 min read
The Hospice HIPAA Audit Checklist: What CMS Surveyors and OCR Investigators Ask for First
When CMS surveyors or OCR investigators visit your hospice, these are the documents and controls they request first. Use this checklist to ensure your agency is prepared.
Read article
ransomware
4 min read
When the Cherry Street Ransomware Hit 182,000 Patients: What Every FQHC Should Learn From It
The Cherry Street Health Services ransomware attack exposed 182,000 patients at a Michigan FQHC. Here are the specific security failures that made it possible — and what every community health center must do differently.
Read article
FQHC
5 min read
Multi-Site HIPAA Compliance for Community Health Centers: How to Manage 10 Locations Without 10 IT Teams
Multi-site FQHCs face amplified cybersecurity complexity — each site is an additional attack surface. Here's how to manage HIPAA compliance across multiple locations without proportional IT headcount.
Read article
SHIN-NY
4 min read
How New York's Cybersecurity Regulations Compare to Other States: What Home Health Agencies in MA, VT, NH, and NJ Should Know
New York has the most complex cybersecurity compliance stack for home health agencies. Here's how SHIN-NY and the SHIELD Act compare to what Massachusetts, Vermont, New Hampshire, and New Jersey require.
Read article
SHIN-NY
7 min read
How to Choose a Cybersecurity Provider for Your Home Healthcare Agency: 12 Questions to Ask
Choosing the wrong cybersecurity provider for your home health agency can leave you exposed. These 10 questions separate healthcare-specialized MSSPs from generic IT vendors.
Read article
Hospice
4 min read
How a Hospice Agency Survived a 2am Ransomware Attack Without Paying the Ransom
A composite case study of how a ShieldForce-protected hospice agency detected and recovered from a ransomware attack without paying, without losing patient data, and without disrupting care delivery.
Read article
Hospice
4 min read
Ransomware During an Active Patient Census: Why Hospice Agencies Are a High-Value Target in 2026
Hospice agencies are among healthcare's most targeted ransomware victims — and the consequences go beyond data. Here's why attackers target hospice specifically and what meaningful protection looks like.
Read article
Home Health
5 min read
From Zero to HIPAA-Ready: A 90-Day Cybersecurity Roadmap for Home Health Agencies Without IT Staff
A practical, week-by-week 90-day roadmap for home health agencies with no IT department to achieve HIPAA-ready cybersecurity — covering the 2026 Security Rule update requirements.
Read article
Home Health
4 min read
What Does a HIPAA Breach Actually Cost a Home Health Agency? (Real Numbers, 2026)
The real cost of a HIPAA breach for a home health agency goes far beyond the OCR fine. Here is a complete breakdown of financial exposure — from forensic investigations to lost revenue — with 2026 figures.
Read article
Hospice
4 min read
CMS Conditions of Participation and Cybersecurity: What Hospice Agencies Must Document Before a Survey
CMS Conditions of Participation don't explicitly list cybersecurity — but surveyors increasingly cite inadequate data protection as a deficiency. Here's what hospice agencies must document to pass a survey in 2026.
Read article
Hospice
4 min read
Securing Brightree for Hospice Agencies: Closing the Security Gaps the Platform Doesn't Cover
Brightree is a widely used hospice EHR, but vendor security doesn't protect your devices, networks, or staff. Here's the security layer your hospice agency must build around Brightree.
Read article
Hospice
4 min read
What Cyber Insurance Carriers Require Before Covering Your Hospice Agency in 2026
Hospice agencies face tightening cyber insurance underwriting in 2026. Here's exactly what controls carriers require — and what misrepresentation on your application means for your coverage.
Read article
Hospice
4 min read
End-of-Life Data: Why Hospice Patient Records Are Among the Most Sensitive PHI in Healthcare
Hospice patient records contain irreplaceable, deeply personal information — terminal diagnoses, advance directives, family dynamics. Here's why this data requires exceptional protection and what that means for your security program.
Read article
SHIN-NY
4 min read
SHIN-NY Security Breach Notification Requirements: What You Must Report and When
A confirmed breach affecting SHIN-NY data triggers specific notification obligations to your RHIO, OCR, and potentially affected individuals. Here's the exact timeline and process for NY home health agencies.
Read article
SHIN-NY
4 min read
SHIN-NY Workforce Training Requirements: What Your Nurses and Aides Need to Know About Cybersecurity
SHIN-NY requires documented security awareness training for all workforce members with access to health information exchange data. Here's what the training must cover and how to make it practical for field staff.
Read article
Hospice
4 min read
Securing Netsmart myUnity: What Hospice Agencies Need Beyond the EHR Vendor's Defaults
Netsmart myUnity is a leading hospice EHR — but vendor security doesn't cover your devices, networks, or staff behavior. Here's what hospice agencies must add to be HIPAA-compliant.
Read article
SHIN-NY
5 min read
NY SHIELD Act + SHIN-NY + 2026 HIPAA Rule: Navigating Three Cybersecurity Compliance Layers at Once
New York home health agencies face three overlapping cybersecurity frameworks simultaneously: HIPAA, SHIN-NY, and the NY SHIELD Act. Here's how they interact and how to build one program that satisfies all three.
Read article
Hospice
4 min read
Remote Wipe, Device Policies, and Lost Devices: A Practical Guide for Hospice Field Staff
Hospice field staff frequently work with devices containing sensitive patient data in patient homes and community settings. Here's how to build a practical device security policy that works in the field.
Read article
SHIN-NY
3 min read
SHIN-NY Audit Log Requirements: What You Need to Track and How to Prove It
SHIN-NY requires audit logs for all access to health information exchange data — with specific retention, review, and documentation obligations. Here's exactly what your New York home health agency needs.
Read article
Home Health
6 min read
Ransomware at 2am: What Actually Happens to a Home Health Agency That Gets Hit
A ransomware attack on a home health agency doesn't just lock files — it stops care. Here's the real sequence of events when attackers strike, and what protection looks like before, during, and after.
Read article
SHIN-NY
4 min read
What Is a CSPP Document and Why SHIN-NY Requires One
The SHIN-NY Cybersecurity Policies and Procedures Program (CSPP) is the foundational compliance document for every New York home health agency participating in SHIN-NY. Here's what it contains, why it matters, and how to build one.
Read article
SHIN-NY
4 min read
How Much Does SHIN-NY Compliance Cost? A Realistic Budget Guide for NY Home Health Agencies
SHIN-NY compliance has real costs — but so does non-compliance. This guide breaks down the realistic budget for a New York home health agency to achieve and maintain SHIN-NY cybersecurity requirements in 2026.
Read article
SHIN-NY
6 min read
SHIN-NY Cybersecurity Requirements Explained: What Every NY Home Health Agency Must Do in 2026
SHIN-NY cybersecurity requirements are now enforceable for New York home healthcare agencies. This definitive guide explains every control, deadline, and documentation obligation — in plain English.
Read article
SHIN-NY
3 min read
The $50,000 Fine: What Happens to NY Home Health Agencies That Fail SHIN-NY Cybersecurity Compliance
Non-compliance with SHIN-NY cybersecurity requirements carries real consequences — from RHIO suspension to HIPAA penalties. Here's what enforcement actually looks like for New York home health agencies.
Read article
SHIN-NY
4 min read
SHIN-NY vs. HIPAA: What's the Difference and Why NY Agencies Must Comply with Both
SHIN-NY and HIPAA are not the same compliance obligation. New York home healthcare agencies must satisfy both — and the requirements don't always overlap. Here's a clear, side-by-side comparison.
Read article
SHIN-NY
4 min read
The SHIN-NY Readiness Checklist: 18 Controls Your NY Home Health Agency Must Have
A complete SHIN-NY compliance checklist for New York home health agencies — covering every CSPP requirement, technical control, and documentation obligation. Use this to assess your readiness before your RHIO review.
Read article
SHIN-NY MFA requirements
3 min read
SHIN-NY MFA Requirements: What Multi-Factor Authentication Means for Your Care Team's Daily Workflow
SHIN-NY requires MFA for all users accessing health information exchange data. Here's what that means in practice for nurses, billing staff, and administrators — and how to implement it without disrupting care.
Read articleHome Health
11 min read
2026 HIPAA Security Rule: What Home Healthcare Agencies Need to Know
The expected 2026 HIPAA Security Rule update could raise cybersecurity expectations for home healthcare agencies. Learn how to prepare for ePHI protection, MFA, risk analysis, vendor oversight, backup, and incident response. <strong>Related HIPAA 2026 Update Guide for Other Vertical:</strong> <a href="/blog/2026-hipaa-security-rule-hospice-agency-requirements" title="Hospice version">Hospice version</a>
Read articleHome Health
10 min read
19 Million Home Visits: What UnitedHealth's Scale Reveals About the Future of Home Healthcare, Cybersecurity, and Patient Trust
UnitedHealth Group delivered 19 million in-home visits in 2025. For home healthcare agencies, this signals a permanent shift in care delivery — and a rising standard for cybersecurity, HIPAA readiness, and digital resilience.
Read article
Home Health
2 min read
Cybersecurity in Home Care: Protecting Patient Data Beyond the EMR
Home care agencies are carrying more digital responsibility than ever before. Patient records, schedules, billing information, caregiver communication, payroll, referral data, and family updates now move across multiple systems —…
Read articleCybersecurity
10 min read
Preventing Cyberattacks Before They Destroy Home Health Revenue: A 2026 Strategy Guide
Cyberattacks cost home health agencies $154,000–$325,000 per incident in direct losses — before VBP penalties, referral loss, and staff turnover. Here is the prevention architecture that stops attacks before financial damage occurs
Read article
Compliance
9 min read
Immutable Backup for Home Health Agencies: Why Ransomware Recovery Is Only Half the Story
Most home health agencies think about immutable backup as ransomware defense. Silent data corruption — corrupted backups discovered weeks after the damage — is the threat most backup strategies miss entirely.
Read article
Compliance
10 min read
Covenant Health Breach: What the 8,000-to-478,000 Scope Escalation Teaches Home Health Agencies About Breach Assessment
Covenant Health initially reported 8,000 affected individuals. Forensic review revealed 478,000. That gap is not just a larger notification list — it is a HIPAA compliance crisis. Here is what every New England home health agency must learn from it.
Read article