Nursing homes and skilled nursing facilities (SNFs) face a layer of regulatory scrutiny that most other healthcare verticals don't: CMS Conditions of Participation, enforced through a state survey process that can result in deficiency citations, mandatory plans of correction, and in serious cases, loss of Medicare and Medicaid certification. Cybersecurity has increasingly become part of what surveyors examine, directly or indirectly, as part of that process.
This article covers what CMS actually requires from a cybersecurity standpoint, how survey readiness connects to your technical controls, and the SNF-specific risks — med-cart workstations, IoT medical devices, around-the-clock shift coverage — that make nursing home cybersecurity meaningfully different from a typical healthcare office environment.
How CMS Requirements Connect to Cybersecurity
CMS Conditions of Participation don't use the word "cybersecurity" extensively, but several existing requirements intersect directly with it. The Emergency Preparedness rule requires facilities to plan for disruptions to normal operations — and a ransomware attack that takes down your EHR and nurse call systems is, functionally, exactly the kind of operational disruption that rule contemplates. Similarly, requirements around resident records, data integrity, and quality assurance all depend on the underlying systems being available, accurate, and protected from unauthorized access or tampering.
In practice, this means a nursing home's cybersecurity posture is not a separate compliance track running alongside CMS requirements — it's an input into whether several existing Conditions of Participation are actually being met.
What CMS Surveyors Actually Look For
State surveyors conducting a standard or complaint survey are not typically running technical security audits, but several of their standard review areas have a direct cybersecurity dimension:
- Emergency preparedness plan testing — does your facility's emergency plan address IT system outages specifically, including EHR downtime and nurse call system failure, not just power and natural disaster scenarios?
- Resident record accuracy and availability — can staff access accurate resident records reliably? Gaps caused by a prior unaddressed IT incident can surface as a documentation or care planning deficiency.
- Quality Assurance and Performance Improvement (QAPI) program scope — does your QAPI program track IT-related incidents and near-misses as part of its broader quality monitoring?
- Staff competency and training records — are staff trained on using clinical systems securely, including basic phishing awareness and password practices?
A facility that cannot demonstrate a tested plan for IT system disruption, or that has experienced an undocumented or poorly-handled prior incident, is exposed to findings that trace back to a cybersecurity gap even though the surveyor's checklist doesn't say "cybersecurity" anywhere on it.
Survey Readiness: Building the Paper Trail
Survey readiness for cybersecurity-adjacent requirements comes down to documentation discipline. Facilities should maintain:
- A documented, tested emergency preparedness plan that explicitly addresses IT and EHR downtime scenarios, with evidence of periodic tabletop exercises.
- Incident logs for any IT disruption, however minor, showing how it was identified, contained, and resolved.
- A current HIPAA risk analysis, since resident ePHI protection overlaps directly with several Conditions of Participation around record integrity.
- Staff training records showing security awareness training, not just clinical training, has been delivered and refreshed periodically.
- A documented device inventory for any networked clinical or nurse call equipment.
SNF-Specific Risk: Medication Cart Workstations
Medication cart (med-cart) workstations are a uniquely SNF risk. These mobile computing stations travel floor to floor, are often shared across multiple nursing staff per shift, and are frequently left logged in during active rounds because logging back in repeatedly during medication administration is operationally disruptive.
That operational reality creates a specific vulnerability: a med-cart left unattended and logged in gives anyone nearby — staff, visitors, or residents — direct access to the EHR and medication administration record. Mitigating this without disrupting workflow requires a layered approach: shorter but not disruptive auto-lock timeouts calibrated to actual med-pass duration, badge-tap or proximity-based re-authentication rather than full password re-entry, and physical positioning of carts that limits casual screen visibility during active use.
SNF-Specific Risk: IoT and Connected Medical Devices
Nursing homes increasingly rely on networked devices beyond traditional computers — nurse call systems, wander-management and resident monitoring systems, connected vital-sign monitors, and smart medication dispensing cabinets. Each of these is a potential network entry point, and many were designed by manufacturers prioritizing clinical function over security hardening, often running outdated firmware with no straightforward patching mechanism.
Effective IoT security for nursing homes centers on network segmentation — placing these devices on a separate network segment from EHR and administrative systems, so a compromised nurse call panel cannot be used as a stepping stone to resident records — combined with an inventory that tracks each device's firmware version and manufacturer support status, since many IoT devices in long-term use have already reached end-of-life support from their original vendor. This segmentation approach is the core of ShieldForce's Facility IoT & EHR Isolation Architecture™, built specifically for the mix of connected medical devices and shared workstations found in skilled nursing facilities.
24/7 Operations and Shift-Based Risk
Unlike many healthcare settings with defined business hours, nursing homes operate continuously, which means security incidents can occur and need response at any hour, across every shift. Overnight and weekend shifts often have less immediate access to IT support, which can create pressure to work around a security control — like a locked account or an expired password — rather than wait for help.
Facilities should ensure 24/7 access to at least basic IT security support, whether through an internal on-call rotation or a managed security provider, so staff on any shift have a clear, fast path to resolving an access issue without resorting to workarounds that create new risk.