Most home health administrators think about cybersecurity in terms of HIPAA fines, ransomware payments, and data breach costs. These are real consequences — see What Does a HIPAA Breach Actually Cost a Home Health Agency? for the full breakdown — but they aren't the only financial exposure a cyber incident creates. For agencies participating in CMS Home Health Value-Based Purchasing, a cybersecurity incident that disrupts operations during a performance measurement period can damage reimbursement rates for an entire subsequent payment year. The connection between security posture and VBP performance score is direct, measurable, and almost entirely unaddressed in the home health cybersecurity literature.
How VBP Works and Why Operational Continuity Is Central to Performance
The CMS Home Health Value-Based Purchasing model adjusts Medicare payments based on an agency's performance on a set of quality measures relative to national and state benchmarks. High performers receive a payment increase. Low performers receive a payment reduction. The measures span functional outcomes (improvement in walking, bathing, and pain management), hospitalization and emergency department utilization rates, and HHCAHPS patient experience scores. All of these measures depend on something that a cybersecurity incident directly threatens: uninterrupted, well-documented, clinically effective care delivery. This is one reason cybersecurity has become a patient safety issue, not just an IT problem — VBP is simply where that connection shows up on the balance sheet.
The Three Ways a Cyber Incident Damages VBP Performance
Documentation Disruption and OASIS Accuracy
VBP functional outcome measures are derived from OASIS assessments — the standardized clinical assessment completed at admission, at specific recertification points, and at discharge. When an EHR is unavailable due to ransomware or a breach-related shutdown, OASIS assessments are completed on paper and entered retroactively when systems are restored. Retroactive data entry introduces errors, inconsistencies, and missing fields at rates that consistently exceed real-time documentation. Incomplete or inaccurate OASIS data directly affects the outcome measures that drive VBP scores — and the damage compounds across a measurement period that may span months.
Hospitalization Rates and the Care Coordination Disruption
The hospitalization and emergency department utilization measures are among the most heavily weighted in the VBP model — and they're directly affected by the quality of care coordination. Care coordination for a home health agency depends on real-time access to clinical information: physician alerts, medication reconciliation data, clinical flags that indicate a patient is deteriorating. When the EHR is unavailable, nurses in the field can't see those alerts. Coordinators can't see which patients have been visited or which are overdue. The clinical intelligence that allows early intervention — the intelligence that prevents hospitalizations — is unavailable during the outage and for the period of reduced clinical capacity that follows.
A meaningful increase in hospitalization rates among an agency's active patient census, occurring during and immediately after a significant EHR outage, is a pattern that shows up in VBP performance data with a 30–60 day lag — by which point the connection to the cyber incident is difficult to establish causally, but the financial consequence is real. This is exactly why response speed matters as much as prevention; see Incident Response for Home Health Agencies: The First 24 Hours for what containing an incident quickly actually looks like in practice.