Author Archive
67 articles written by Obi Ibeto, Founder & CEO — ShieldForce Corporation.
A focused archive without featured content or extra filters.
The HIPAA Breach Notification Rule establishes the federal framework for notifying patients and HHS following a breach of unsecured PHI. What it doesn't establish is the only notification obligation a...
Read article
The Business Associate Agreement is the contract through which an EHR vendor accepts HIPAA obligations for the patient data in their platform. Most home health agencies sign whatever BAA the...
Read article
Electronic Visit Verification became a federal mandate through the 21st Century Cures Act, which required all states to implement EVV for Medicaid personal care and home health services. The mandate...
Read article
Microsoft Defender for Business has become one of the most common security platform claims in home health agency security questionnaires. It's included with Microsoft 365 Business Premium at a combined...
Read article
When most home health administrators think about cybersecurity threats, they think about external attackers — ransomware groups, phishing campaigns, dark web credential sales. These are real and serious threats. But...
Read article
One of the most common points of confusion for home health compliance officers preparing for OCR audits is: "We completed a risk assessment last year — does that satisfy the...
Read article
Home health scheduling software is the most frequently overlooked ePHI system in HIPAA compliance reviews. The EHR gets scrutiny because it's obviously clinical. The billing system gets scrutiny because it...
Read article
Hospital discharge planning departments have quietly become one of the most consequential cybersecurity gatekeepers in home health. The agencies that receive consistent referral volume from major health systems in 2026...
Read article
The FTC Safeguards Rule isn't the first regulation that comes to mind for home health administrators thinking about data security. It's primarily associated with financial institutions — banks, mortgage lenders,...
Read article
The 2026 HIPAA Security Rule update elevated the incident response plan from an addressable specification — meaning organizations could implement it or document a reasonable alternative — to a mandatory...
Read article
Business Email Compromise generated $2.9 billion in reported losses across U.S. organizations in 2023, according to the FBI's Internet Crime Complaint Center (IC3) — more than ransomware, more than data...
Read article
Home health aides represent a compliance challenge that's rarely addressed directly in HIPAA security guidance — because that guidance is almost universally written for a technically literate audience with reliable...
Read article
HIPAA doesn't specify what annual security training must cover, how long it must be, or what format it must take. What it does specify is that covered entities must implement...
Read article
Enterprise security platforms cost $150K+ and fail 60% of the time in nursing homes. Learn why generic tools don't work for long-term care and what nursing homes actually need.
Read article
CMS CoP audits don't need to be stressful. Learn exactly what surveyors look for during cybersecurity inspections, what documentation they request, and why most nursing homes struggle to pass.
Read article
Ransomware attacks on nursing homes are inevitable. Learn from 3 real 2024 incidents, detect attacks early, and execute a step-by-step 24-hour recovery plan that stops downtime before it starts.
Read article
Family portals enable shared care—but weak security turns them into data theft and family conflict nightmares. Learn how to build HIPAA-compliant family access that actually protects sensitive data.
Read article
End-of-life conversations are deeply sensitive and deeply vulnerable to security breaches. Learn how to secure telehealth for palliative care without sacrificing the intimacy and access families need.
Read article
The most common objection home health administrators raise when considering a managed security provider is: "We already have an IT person." That's an understandable instinct — the internal IT staff...
Read article
Every healthcare cybersecurity tool — your EDR platform, your SIEM, your email security gateway — generates alerts. Some of those alerts represent genuine threats. Some represent benign activity that the...
Read article
Two years ago, a Medicare Advantage plan cybersecurity assessment of a preferred home health provider was a rarity. Today it's becoming standard practice among the larger MA plans — Humana,...
Read article
The structural separation of HIPAA compliance into Privacy Officer and Security Officer roles has created a persistent compliance gap at home health agencies across the country. The Privacy Officer manages...
Read article
Mobile Device Management is not optional for a home health agency in 2026. The 2026 HIPAA Security Rule update's mandatory encryption requirement — which applies to every device storing or...
Read article
Across home health HIPAA compliance programs, the Acceptable Use Policy is one of the most commonly mishandled required documents — either missing entirely, written in language no field nurse could...
Read article
Most home health administrators think about cybersecurity in terms of HIPAA fines, ransomware payments, and data breach costs. These are real consequences — see What Does a HIPAA Breach Actually...
Read article
Of all the HIPAA Security Rule requirements, the Security Officer designation is the one most commonly either missing entirely or documented in a way that wouldn't survive ten minutes of...
Read article
The agencies that come through a data breach intact — financially, operationally, reputationally — are almost always the ones that prepared before the incident occurred. The ones that sustain lasting…
Read article
The conversation between a private equity-backed home health company and its portfolio management team about cybersecurity has changed materially in the past three years. What was once a periodic compliance…
Read article
A home health organization that operates in New York, New Jersey, Connecticut, and Pennsylvania is not managing one cybersecurity compliance environment. It is managing four state-level data breach notification frameworks…
Read article
I respect the instinct to build things yourself. It reflects a resourcefulness and self-sufficiency that serve home health organizations well in many areas of operations. In cybersecurity, the DIY approach…
Read article
One of the questions I hear most often from home health administrators, hospice agency owners and nursing homes associations considering ShieldForce is: "How long until we're actually protected?" The answer…
Read article
A general IT managed service provider serves a portfolio of clients that might include a manufacturing company, a law firm, a retail chain, and a home health agency. The team…
Read article
eClinicalWorks, Greenway Health, and NextGen are the three EHR platforms that serve the majority of the Federally Qualified Health Center market in the United States. Each has been selected by…
Read article
HRSA's Health Center Program requirements have always addressed patient information protection as a component of the broader operational standards that FQHCs must meet. What has changed in 2026 is the…
Read article
A Federally Qualified Health Center serving 12,000 patients annually in a rural county is legally required to implement the same HIPAA Security Rule requirements as a major urban hospital system…
Read article
Hospice pharmacy management involves a category of patient data that sits at the intersection of two distinct regulatory frameworks: HIPAA's privacy and security requirements for protected health information, and the…
Read article
In twenty-three years of hospice cybersecurity work, I have never had a hospice administrator proactively raise the security of chaplaincy documentation as a priority. It is always my observation, not…
Read article
Hospital and health system discharge planning teams have become inadvertent cybersecurity assessors. In the wake of high-profile healthcare supply chain breaches — most consequentially the Change Healthcare incident that disrupted…
Read article
Hospice M&A activity has accelerated significantly over the past three years, driven by private equity consolidation, regional health system acquisitions, and the operational pressure that smaller independent hospices face competing…
Read article
The CMS Conditions of Participation require hospice agencies to provide bereavement services to surviving families for a period of no less than one year following the patient's death. This requirement…
Read article
In October 2024, a mid-size hospice organisation in the Mid-Atlantic region experienced a ransomware attack that rendered their EHR inaccessible for eleven days. During those eleven days, the hospice was…
Read article
Hospice compliance officers typically maintain two separate compliance frameworks in parallel: the CMS Conditions of Participation framework, which governs clinical quality, patient rights, and care delivery standards; and the HIPAA… <strong>Related CMS Requirement Guide for Other Vertical:</strong> <a href="/blog/cms-conditions-of-participation-home-health-cybersecurity-medicare-2026" title="Home Health version">Home Health version</a>
Read article
Brightree and MatrixCare serve significant portions of the hospice EHR market alongside Axxess — each with genuine clinical capability and legitimate security programmes at the application level. The pattern I…
Read article
The interdisciplinary group meeting is the clinical and ethical centre of hospice care — the regular gathering where physician, nurse, social worker, chaplain, aide, and bereavement coordinator review each patient's…
Read article
Hospice care is, at its core, about accompanying people through the most profound human experience — the dying process. The information that hospice organisations collect and manage to provide that…
Read articleNew York's Value-Based Payment transformation is reshaping how home health agencies are compensated — moving from a pure fee-for-service model toward outcome-based arrangements that reward agencies for keeping patients healthy,…
Read article
RHIO compliance reviews are no longer a rare occurrence at SHIN-NY participating home health agencies. All four New York RHIOs have expanded their compliance review programmes in response to increasing…
Read article
The compliance-focused discussion of SHIN-NY sometimes obscures a more fundamental point: SHIN-NY participation exists to improve patient care, not to create compliance obligations. The security requirements that come with SHIN-NY…
Read article
New SHIN-NY participants consistently underestimate the documentation intensity of the onboarding process. The agencies I have seen complete onboarding smoothly — in 60 days or less — are the ones…
Read article
When a security incident potentially involves SHIN-NY health information exchange data, the notification obligations that arise are parallel to — not instead of — HIPAA notification obligations. This distinction matters…
Read article
A home health agency serving patients in both the Capital Region and the Finger Lakes region of New York may find itself participating in two separate RHIO networks — Hixny…
Read article
A home health administrator in Syracuse told me recently that her agency had passed its SHIN-NY renewal without any findings and was therefore confident in its HIPAA compliance. I did…
Read article
The Rochester RHIO serves Western New York including Monroe, Livingston, Ontario, Seneca, Wayne, and Yates counties — one of the most medically integrated regional health markets in New York State,… <strong>Related RHIO Guides for Other NY Regions:</strong> <a href="/blog/healtheconnections-cspp-home-health-central-new-york-syracuse-compliance" title="HealtheConnections/Syracuse (Central NY)">HealtheConnections/Syracuse (Central NY)</a> | <a href="/blog/how-to-complete-the-healthix-cspp-a-field-guide-for-nyc-and-long-island-home-health-agencies" title="Healthix (NYC & Long Island)">Healthix (NYC & Long Island)</a>
Read article
HealtheConnections is the SHIN-NY RHIO serving Central New York — a region that includes Onondaga, Oswego, Madison, Cayuga, Cortland, Jefferson, Lewis, and surrounding counties. For home health agencies serving the… <strong>Related RHIO Guides for Other NY Regions:</strong> <a href="/blog/rochester-rhio-cspp-home-health-western-new-york-monroe-county" title="Rochester/Monroe County (Western NY)">Rochester/Monroe County (Western NY)</a> | <a href="/blog/how-to-complete-the-healthix-cspp-a-field-guide-for-nyc-and-long-island-home-health-agencies" title="Healthix (NYC & Long Island)">Healthix (NYC & Long Island)</a>
Read article
Healthix is the largest New York RHIO by patient population, serving New York City's five boroughs, Long Island, and portions of the Hudson Valley. The breadth and complexity of the… <strong>Related RHIO Guides for Other NY Regions:</strong> <a href="/blog/rochester-rhio-cspp-home-health-western-new-york-monroe-county" title="Rochester/Monroe County (Western NY)">Rochester/Monroe County (Western NY)</a> | <a href="/blog/healtheconnections-cspp-home-health-central-new-york-syracuse-compliance" title="HealtheConnections/Syracuse (Central NY)">HealtheConnections/Syracuse (Central NY)</a>
Read article
SHIN-NY's cybersecurity requirements for participating home health agencies have continued to evolve through 2025 and into 2026, driven by two parallel forces: the 2026 HIPAA Security Rule mandatory updates, which raised the baseline security standard that SHIN-NY compliance reviewers expect to see documented;
Read article
The decision to pay a ransomware demand is one of the most consequential choices a home health administrator will ever face — made under enormous time pressure, with incomplete information,…
Read article
Annual penetration testing became a mandatory HIPAA Security Rule requirement in 2026, and many home health administrators are encountering the requirement for the first time during their current compliance review…
Read article
SHIN-NY annual renewal is the compliance event that most New York home health agencies handle reactively — receiving the renewal notice from their RHIO and scrambling to update documentation that…
Read article
Email domain spoofing is one of the simplest attacks available to cybercriminals — and one of the most consistently underdefended vulnerabilities at home health agencies. Without DMARC, DKIM, and SPF…
Read article
Sophisticated ransomware groups do not select targets randomly. They spend days or weeks conducting open-source intelligence gathering — collecting publicly available information about potential targets to assess their data value,…
Read article
The credential theft data is consistent across every home health sector threat analysis I have reviewed: password reuse between work accounts and consumer websites is the most common credential exposure…
Read article
CMS CoP requirements include patient information protection provisions that connect directly to cybersecurity. Here is how a strong security program supports CoP readiness. <strong>Related CMS Requirement Guide for Other Vertical:</strong> <a href="/blog/cms-conditions-of-participation-hospice-cybersecurity-surveyors-2026" title="Hospice version">Hospice version</a> <strong>Related Requirements for Agencies in Both Programs:</strong> <a href="/blog/ny-medicaid-managed-care-cybersecurity-home-health" title="Medicaid (NY) guide">Medicaid (NY) guide</a>
Read article
The conversation about "remote work cybersecurity" has been dominated for the past five years by the image of a corporate employee working from a home office — a professional at…
Read article
The proposed 2026 HIPAA Security Rule would make MFA, encryption, and annual pen testing mandatory once finalized. Use this complete checklist to close every gap before your next OCR audit or insurance renewal.
Read article
Advanced persistent threats in healthcare maintain unauthorized access for 18–21 days before striking. Here is how APTs target home health agencies specifically — and the detection architecture that stops them before detonation.
Read article
The Ingram Micro ransomware attack demonstrated that restoring systems is no longer enough — because data was stolen before encryption. Here is what double-extortion means for home health agencies and how to defend against both threats simultaneously.
Read article