There is a compliance gap hiding in plain sight at most home health agencies, and it lives in the space between agency policy and clinical reality.
The policy says: staff should only access patient records from secure, agency-managed devices on approved networks.
The reality is: nurses are accessing the EHR from personal iPhones on home Wi-Fi, confirming visit schedules via personal Gmail, and sending care updates through text messages because it's faster and more practical in the field.
This gap — between what the policy says and what happens in practice — is where HIPAA breaches originate. And it is specifically the gap that the proposed 2026 HIPAA Security Rule update targets with its proposed mandatory encryption and MFA requirements.
Why This Happens: The Operational Reality of Home Care
Home health care is delivered in patient homes, not in offices. Field staff are geographically distributed, often working alone, and expected to document care in real time during or immediately after each visit. The agency EHR may require a VPN to access from outside the office. Setting up a VPN on a smartphone while standing in a patient's living room is not conducive to efficient care delivery.
So staff work around it. Personal devices, personal email, text messages. These workarounds are not malicious — they are practical adaptations to a system that was not designed for the care environment.
The result is that patient data routinely flows through channels the agency cannot monitor, control, or wipe.
The Specific HIPAA Risks of BYOD in Home Health
Risk 1: Unencrypted Devices Holding ePHI
An iPhone or Android device that has been used to access an EHR, read a patient email, or view a care plan has ePHI on it — in cached data, screenshots, downloaded files, or email attachments. If that device is lost or stolen and is not encrypted and remotely wipeable, you have a potential reportable breach under HIPAA.
Risk 2: Unsecured Networks Intercepting Credentials
Home Wi-Fi networks vary enormously in security. A nurse's home network with a default router password is significantly more vulnerable than a corporate network. A "man in the middle" attack on an unsecured network can intercept login credentials for the agency EHR — credentials that may then be used to access patient records from a completely different location.
Risk 3: Unmanaged Devices Connecting Infected Systems to Agency Data
A personal device used for both personal and work purposes may have malware or adware installed from personal apps, downloads, or websites. When that device connects to agency systems, it potentially introduces threats into your environment.
Risk 4: No Control Over Data After Access
When an employee leaves your agency, you can disable their EHR login. But if they accessed patient records on their personal device, that data may remain on the device — in email, screenshots, or cached content — even after access is revoked. Without MDM, you cannot wipe agency data from a personal device.
The Right BYOD Framework for Home Health Agencies
The answer is not to ban personal devices — that is operationally unworkable. The answer is to implement a managed BYOD framework that secures agency data on personal devices without interfering with personal use.