Author Archive
57 articles written by Obi Ibeto, Founder & CEO — ShieldForce Corporation.
A focused archive without featured content or extra filters.
eClinicalWorks, Greenway Health, and NextGen are the three EHR platforms that serve the majority of the Federally Qualified Health Center market in the United States. Each has been selected by…
Read article
HRSA's Health Center Program requirements have always addressed patient information protection as a component of the broader operational standards that FQHCs must meet. What has changed in 2026 is the…
Read article
A Federally Qualified Health Center serving 12,000 patients annually in a rural county is legally required to implement the same HIPAA Security Rule requirements as a major urban hospital system…
Read article
Hospice pharmacy management involves a category of patient data that sits at the intersection of two distinct regulatory frameworks: HIPAA's privacy and security requirements for protected health information, and the…
Read article
In twenty-three years of hospice cybersecurity work, I have never had a hospice administrator proactively raise the security of chaplaincy documentation as a priority. It is always my observation, not…
Read article
Hospital and health system discharge planning teams have become inadvertent cybersecurity assessors. In the wake of high-profile healthcare supply chain breaches — most consequentially the Change Healthcare incident that disrupted…
Read article
Hospice M&A activity has accelerated significantly over the past three years, driven by private equity consolidation, regional health system acquisitions, and the operational pressure that smaller independent hospices face competing…
Read article
The CMS Conditions of Participation require hospice agencies to provide bereavement services to surviving families for a period of no less than one year following the patient's death. This requirement…
Read article
In October 2024, a mid-size hospice organisation in the Mid-Atlantic region experienced a ransomware attack that rendered their EHR inaccessible for eleven days. During those eleven days, the hospice was…
Read article
Hospice compliance officers typically maintain two separate compliance frameworks in parallel: the CMS Conditions of Participation framework, which governs clinical quality, patient rights, and care delivery standards; and the HIPAA…
Read article
Brightree and MatrixCare serve significant portions of the hospice EHR market alongside Axxess — each with genuine clinical capability and legitimate security programmes at the application level. The pattern I…
Read article
The interdisciplinary group meeting is the clinical and ethical centre of hospice care — the regular gathering where physician, nurse, social worker, chaplain, aide, and bereavement coordinator review each patient's…
Read article
Hospice care is, at its core, about accompanying people through the most profound human experience — the dying process. The information that hospice organisations collect and manage to provide that…
Read article
New York's Value-Based Payment transformation is reshaping how home health agencies are compensated — moving from a pure fee-for-service model toward outcome-based arrangements that reward agencies for keeping patients healthy,…
Read article
RHIO compliance reviews are no longer a rare occurrence at SHIN-NY participating home health agencies. All four New York RHIOs have expanded their compliance review programmes in response to increasing…
Read article
The compliance-focused discussion of SHIN-NY sometimes obscures a more fundamental point: SHIN-NY participation exists to improve patient care, not to create compliance obligations. The security requirements that come with SHIN-NY…
Read article
New SHIN-NY participants consistently underestimate the documentation intensity of the onboarding process. The agencies I have seen complete onboarding smoothly — in 60 days or less — are the ones…
Read article
When a security incident potentially involves SHIN-NY health information exchange data, the notification obligations that arise are parallel to — not instead of — HIPAA notification obligations. This distinction matters…
Read article
A home health agency serving patients in both the Capital Region and the Finger Lakes region of New York may find itself participating in two separate RHIO networks — Hixny…
Read article
A home health administrator in Syracuse told me recently that her agency had passed its SHIN-NY renewal without any findings and was therefore confident in its HIPAA compliance. I did…
Read article
The Rochester RHIO serves Western New York including Monroe, Livingston, Ontario, Seneca, Wayne, and Yates counties — one of the most medically integrated regional health markets in New York State,…
Read article
HealtheConnections is the SHIN-NY RHIO serving Central New York — a region that includes Onondaga, Oswego, Madison, Cayuga, Cortland, Jefferson, Lewis, and surrounding counties. For home health agencies serving the…
Read article
Healthix is the largest New York RHIO by patient population, serving New York City's five boroughs, Long Island, and portions of the Hudson Valley. The breadth and complexity of the…
Read article
SHIN-NY's cybersecurity requirements for participating home health agencies have continued to evolve through 2025 and into 2026, driven by two parallel forces: the 2026 HIPAA Security Rule mandatory updates, which raised the baseline security standard that SHIN-NY compliance reviewers expect to see documented;
Read article
The decision to pay a ransomware demand is one of the most consequential choices a home health administrator will ever face — made under enormous time pressure, with incomplete information,…
Read article
Annual penetration testing became a mandatory HIPAA Security Rule requirement in 2026, and many home health administrators are encountering the requirement for the first time during their current compliance review…
Read article
SHIN-NY annual renewal is the compliance event that most New York home health agencies handle reactively — receiving the renewal notice from their RHIO and scrambling to update documentation that…
Read article
Email domain spoofing is one of the simplest attacks available to cybercriminals — and one of the most consistently underdefended vulnerabilities at home health agencies. Without DMARC, DKIM, and SPF…
Read article
Sophisticated ransomware groups do not select targets randomly. They spend days or weeks conducting open-source intelligence gathering — collecting publicly available information about potential targets to assess their data value,…
Read article
The credential theft data is consistent across every home health sector threat analysis I have reviewed: password reuse between work accounts and consumer websites is the most common credential exposure…
Read article
CMS CoP requirements include patient information protection provisions that connect directly to cybersecurity. Here is how a strong security program supports CoP readiness.
Read article
The conversation about "remote work cybersecurity" has been dominated for the past five years by the image of a corporate employee working from a home office — a professional at…
Read article
Home health staffing agencies act as both covered entities and business associates — creating HIPAA complexity that standard frameworks do not address. Here is the right security approach.
Read article
A remote access policy is both an OCR requirement and a practical security control. Here is how to write one that actually works for a distributed home health workforce.
Read article
The HIPAA minimum necessary standard is among OCR's most-cited violations. Here is what it means for EHR configuration and access policy at home health agencies.
Read article
Most home health staff text patient information daily. Here is what HIPAA says about texting, what is and is not permitted, and how to build a compliant messaging policy your team will follow.
Read article
Cyber insurance claim denial rates in healthcare are rising. Here is why claims fail — and the documentation home health agencies must maintain to win claims when it matters most.
Read article
Matrixcare secures its platform — not your endpoints, email, or staff behavior. Here is the security layer your agency must add to complete a HIPAA-compliant architecture around Matrixcare.
Read article
Homecare Homebase secures its application — but everything outside that boundary is your agency's responsibility. Here is the complete security layer every HCHB agency must build.
Read article
WellSky secures its application — but your devices, email, and networks are outside that boundary. Here is what every WellSky-using home health agency must build around the platform.
Read article
A 90-minute tabletop exercise reveals incident response gaps before a real attack exposes them. Here is how to run a realistic tabletop exercise for a home health agency leadership team.
Read article
Remote administrative staff access billing, scheduling, and EHR systems from home networks on personal devices. Here is the HIPAA security framework for home-based administrative roles.
Read article
Excessive permissions amplify breach damage. Here is how to conduct a HIPAA-required access review — and what to do about the excessive permissions most home health agencies discover.
Read article
SOC 2 Type 2 is the most meaningful vendor security credential. Here is what these reports contain, how to read them, and which home health vendors should be providing one.
Read article
Most home health staff do not know what to do after clicking a suspicious link. Here is the 6-step protocol every staff member should follow — and how to train your team on it.
Read article
Not all home health EHRs carry equal security. This HIPAA-focused comparison of Matrixcare, WellSky, Axxess, and HCHB covers what each provides — and what your agency must add.
Read article
HIPAA requires a documented sanctions policy for workforce members who violate privacy or security rules. Here is what it must include and how to apply it consistently.
Read article
A cyberattack does not pause patient care. Here is how home health agencies build continuity plans that keep nurses visiting patients during a cyber incident.
Read article
Password reuse is the top credential vulnerability in home healthcare. Here is the staged path from weak passwords to password managers to passkeys — and what each step means for HIPAA compliance.
Read article
HIPAA physical safeguards cover your office, server room, and field staff in patient homes. Here is where home health agencies most commonly fail physical security reviews.
Read article
Unpatched software is the second most exploited attack vector in healthcare. Here is how home health agencies implement automated patch management without disrupting care workflows.
Read article
Most home health agencies run on Microsoft 365 or Google Workspace with default configurations that leave critical HIPAA gaps. Here are the mandatory settings every agency must configure.
Read article
Complete HIPAA Security Rule 2026 compliance checklist for home health agencies, including mandatory updates, foundational cybersecurity guidance, and step-by-step implementation strategies for all administrative, technical, and physical safeguards.
Read article
The Ingram Micro ransomware attack demonstrated that restoring systems is no longer enough — because data was stolen before encryption. Here is what double-extortion means for home health agencies and how to defend against both threats simultaneously.
Read article
Home health nurses access patient records from patient homes, vehicles, and personal devices — environments no office perimeter can protect. Here is how ShieldForce delivers consistent security across every location your staff actually works.
Read article
Advanced persistent threats in healthcare maintain unauthorized access for 18–21 days before striking. Here is how APTs target home health agencies specifically — and the detection architecture that stops them before detonation.
Read article
Canopy Health detected a breach in July 2025 but did not notify patients until six months later. Every gap that extended that timeline exists at most home health agencies today. Here is the case study and the remediation
Read article