Home health agency consolidation is accelerating. Private equity firms, regional health systems, and established agencies are acquiring smaller operators at a pace that has reshaped the industry over the past five years. For buyers, the standard due diligence process covers financials, regulatory compliance, clinical operations, and staff.
Cybersecurity due diligence is almost always an afterthought — or absent entirely.
This is an expensive mistake. An acquired agency's unresolved data breach, OCR investigation, or systemic HIPAA non-compliance becomes the acquirer's liability the moment the deal closes. Ransomware malware already present in the acquired agency's systems — in the reconnaissance phase of an attack that hasn't yet detonated — becomes a threat inside the acquirer's network the moment the networks are connected.
Cyber due diligence is not a technical formality. It is financial risk assessment.
What You Are Actually Buying
When you acquire a home health agency, you acquire:
The patient data. Potentially years of ePHI — patient records, care plans, diagnoses, billing histories. This data is both an asset (continuity of care for existing patients) and a liability (any past breach involving that data is now your responsibility).
The compliance posture. If the acquired agency has never completed a HIPAA risk analysis, has no security policies, and has not trained staff annually — those are your compliance gaps post-acquisition. OCR penalties for pre-acquisition non-compliance can follow the entity.
The technical environment. The acquired agency's devices, network infrastructure, EHR platform, and security tools (or lack thereof) either integrate cleanly with yours or create new attack surfaces. A network connection between your secure environment and their unmanaged network can introduce threats you have never seen before.
The vendor relationships. The acquired agency's billing company, clearinghouse, and technology vendors are now your business associates. Their BAAs, their security postures, and their existing compliance gaps are now your vendor risk.
The litigation and investigation history. Any pending OCR investigations, state regulatory actions, or civil litigation related to data breaches or HIPAA violations become your exposure post-acquisition.
The Cyber Due Diligence Checklist
Pre-Letter of Intent (Preliminary Assessment)
Before committing to a transaction, request from the seller:
- [ ] Whether any data breaches have been reported to HHS in the past five years (search the HHS breach portal for the agency's name)
- [ ] Whether any OCR investigations or state regulatory actions related to data security are pending
- [ ] The name of their current cybersecurity provider or IT vendor
- [ ] Whether they have a signed BAA with their EHR vendor and billing company
These four questions take less than 30 minutes to research and answer. They identify deal-breaking issues before you invest significant due diligence resources.
Post-LOI: Detailed Technical Assessment
Once exclusivity is established and you have NDA protection:
Documentation review:
- [ ] HIPAA Security Rule risk analysis (date, scope, currency)
- [ ] Written information security program / security policies
- [ ] Business associate agreements (complete list, all current)
- [ ] Staff security training records (past 24 months)
- [ ] Incident response plan
- [ ] Any prior breach investigation files
Technical environment assessment (conducted by your security team or ShieldForce):