For thirteen consecutive years, healthcare has been the most breached industry in the United States — surpassing financial services, retail, and government in the frequency, severity, and cost of data security incidents. The IBM Cost of a Data Breach Report has documented healthcare breach costs rising from $7.1 million per incident in 2020 to over $10 million in 2023 — the highest average breach cost of any industry, more than twice the cross-industry average. Healthcare organisations are not targeted despite their cybersecurity deficiencies. They are targeted because of them — and because the combination of high-value patient data, operational urgency, and historically underfunded security programmes makes healthcare a more profitable attack target than better-defended industries with less sensitive data.
Home health agencies sit at the intersection of every factor that makes healthcare the most targeted industry, compounded by the operational characteristics that make home health security specifically challenging: a distributed mobile workforce, a device fleet that includes personal smartphones and unmanaged tablets, clinical data that travels through patient home WiFi networks and vehicle environments, and administrative teams that lack the IT security resources available to hospital systems. Understanding why cybersecurity has become a patient safety issue — not merely a technology problem — is the foundation of making the right investment decisions to address it.
Healthcare Data: Why Attackers Prioritise It Above All Other Targets
The question of why healthcare is consistently the most attacked industry has a straightforward economic answer: healthcare data is the most valuable data category in criminal markets. A single complete medical record — containing the patient's full identity, medical history, insurance credentials, and billing information — sells for $20–$50 on criminal data marketplaces. A stolen credit card number sells for $1–$5 and can be cancelled within hours of theft. A stolen medical record cannot be cancelled. The damage it enables — medical identity theft, fraudulent prescription schemes, insurance fraud, and targeted social engineering of family members — persists for years after the initial breach.
For a home health agency serving 1,200 active patients, a complete breach of the patient database represents $24,000–$60,000 in criminal market value — before any ransom demand is made. That market value is the economic incentive that drives ransomware groups to invest weeks of reconnaissance and lateral movement in home health targets. The agency with weak security is not avoiding attention by being small. It is attracting attention by being a less-defended source of the same high-value data that larger healthcare organisations also hold.
The Specific Data Categories That Home Health Agencies Hold
Home health patient records contain a combination of data categories that is unusually valuable precisely because of the combination. Clinical records establish the patient's diagnosis, medication history, functional status, and care needs — information that enables fraudulent prescription schemes and targeted medical identity theft. Billing records contain Medicare and Medicaid beneficiary numbers, insurance provider information, and the provider's NPI and billing credentials — information that enables direct fraudulent billing under the agency's own credentials. Administrative records contain the patient's home address, family contact information, and daily visit schedule — information that enables physical access to the patient's home and targeted social engineering of family members. No other industry concentrates this combination of clinical, financial, and physical location data in a single record system.
Why Home Health Cybersecurity Is More Difficult Than Hospital Cybersecurity
Home health administrators sometimes assume that because their agency is smaller than a hospital, their cybersecurity challenge is proportionally simpler. This assumption misreads the relationship between organisational size and cybersecurity complexity. Home health cybersecurity is not simpler than hospital cybersecurity — it is differently complex in ways that make some security controls harder to implement, not easier.
The Perimeter Does Not Exist
A hospital operates within a defined physical and network perimeter. Clinical staff work in a controlled facility environment on managed devices connected to a managed network. Security controls — badge access, surveillance, managed WiFi, endpoint management — apply uniformly across a bounded environment that the security team controls. Home health agencies have no equivalent perimeter. The clinical environment is wherever the patient lives — which may be a rural farmhouse, an urban apartment, a residential care facility, or a transitional housing unit. The network the nurse connects to is whatever WiFi the patient has. The physical security of the documentation environment is whatever privacy the patient's living space provides. The security team controls none of it.
This absence of perimeter means that home health security must be achieved through controls that travel with the clinician and the data — endpoint security on every device, identity security on every account, and encryption on every data transmission — rather than through controls applied at a network boundary. That is a fundamentally different security architecture from what hospitals use, and it is one that requires deliberate design rather than adaptation of hospital security frameworks.
The Workforce Is Mobile and Uses Personal Devices
Hospital clinical staff work on hospital-issued computers and use hospital-managed applications. Home health clinical staff frequently use personal smartphones for EHR access, personal laptops for administrative work from home offices, and a combination of agency-issued and personal devices for clinical documentation. The security programme must extend to personal devices used for clinical purposes — through MDM container management that isolates work applications from personal ones — while respecting the personal nature of devices that staff also use for their private lives.
This personal device management challenge requires both technical solutions (MDM deployment) and relationship management (explaining to field nurses why the agency needs to manage the work container on their personal phone without accessing their personal content). Neither the technical solution nor the relationship management is required in a hospital environment where all clinical devices are agency-owned.
Lean Administrative Infrastructure With No IT Security Staff
Most home health agencies have no dedicated IT security staff. The individual responsible for HIPAA compliance is also the executive director, the HR director, or a clinical supervisor who has been given the compliance role alongside their primary job. The technology decisions that determine the agency's security posture are made by people whose primary expertise is clinical care delivery or healthcare administration, not cybersecurity. This is not a criticism — it is a structural reality of the home health operating model that requires a different approach to security programme management than what large organisations with dedicated security teams can implement.
Why Cybersecurity Is a Patient Safety Issue — Not Just a Compliance Issue
The framing of cybersecurity as a compliance obligation — something agencies do to satisfy HIPAA and avoid OCR penalties — misses the more fundamental reason that home health cybersecurity matters. A cyberattack that disrupts home health clinical operations is not merely a data protection failure. It is a patient care failure that directly affects the people receiving care.
Clinical Care During a Ransomware Event
When ransomware encrypts a home health agency's EHR, field nurses lose access to the information that guides clinical decision-making: the patient's current medication list, the physician's most recent orders, the care plan goals and interventions, the clinical history from prior visits, and any alerts or flags that indicate changes in the patient's condition. A wound care nurse who arrives at a patient's home without access to the wound assessment documentation from the prior visit is providing care with incomplete clinical information. A medication management nurse who cannot access the current medication order must contact the physician by phone to verbally confirm orders that should be accessible in the EHR — adding delay and introducing communication error risk into the medication safety process.
These are not administrative inconveniences. They are patient safety events. The clinical quality of care delivered during an EHR outage is measurably lower than the clinical quality of care delivered with full EHR access — and for patients in complex, rapidly changing clinical situations, that quality difference can have direct consequences for patient outcomes.
The HIPAA Framework: Cybersecurity as a Legal Patient Protection Obligation
The HIPAA Security Rule's requirement to protect the confidentiality, integrity, and availability of electronic protected health information is explicitly framed as a patient protection obligation — not merely a data protection obligation. The regulation exists because Congress determined that patients have a right to have their health information protected from unauthorised access, that unauthorised access to health information causes real harm to patients, and that healthcare organisations are responsible for implementing the technical and administrative safeguards that prevent that harm.
The 2026 HIPAA Security Rule mandatory update — which established MFA, behavioral EDR, biannual vulnerability scanning, and annual penetration testing as mandatory requirements — reflects OCR's determination that the security controls previously treated as optional safeguards have become the minimum standard of care for patient data protection. An agency that does not implement these controls in 2026 is not making a compliance decision — it is making a patient protection decision that falls below the legal minimum standard.
The Trust That Home Health Care Depends On
Home health care is built on a relationship of extraordinary trust. A home health nurse enters a patient's home, is present during the most vulnerable moments of a patient's illness or recovery, and receives confidences — about symptoms, fears, family dynamics, and end-of-life wishes — that the patient shares nowhere else. The patient trusts that this information will be protected with the same care that the nurse brings to the clinical relationship.
When a home health agency experiences a breach, that trust is violated — not abstractly, but specifically. The patient whose address, diagnosis, and visit schedule was exposed in a breach knows that an attacker potentially knows where she lives and when the nurse visits. The patient whose Medicare number was exfiltrated knows that her insurance credentials may be used fraudulently. The family member whose contact information was stolen knows that social engineering attacks using his family member's clinical information are now possible. These are specific, personal harms that the HIPAA Security Rule exists to prevent — and that the cybersecurity programme exists to deliver.
The Five Reasons Home Health Agencies Underinvest in Cybersecurity — and the Response to Each
"We are too small to be a target."
Ransomware groups do not select targets based on size — they select targets based on data value and defence weakness. A 75-person home health agency with 1,200 patients has data worth $24,000–$60,000 in criminal markets and defences that are typically weaker than any hospital. Small is not safe. Small is a different kind of target.
"We cannot afford it."
ShieldForce's complete managed security programme — 24/7 SOC monitoring, behavioral EDR, advanced email security, MDM, MFA enforcement, vulnerability scanning, penetration testing, and full HIPAA compliance documentation — costs $35/user/month. For a 50-person agency, that is $1,750/month, or $21,000/year. The average cost of a ransomware incident at a home health agency of that size is $154,000–$325,000. The prevention investment is 6–14% of the realistic incident cost.
"Our EHR handles security."
The EHR vendor handles the security of their application and infrastructure. They do not handle the security of the devices your nurses use to access the EHR, the email accounts that receive EHR notifications, the networks your nurses connect from, or the credentials your staff choose for their EHR logins. The majority of home health breaches originate in the environment around the EHR, not inside it.
"We have never had an incident."
The average ransomware dwell time in healthcare is 18–21 days. An organisation with no security monitoring has no way of knowing whether it has had an incident — only whether it has discovered one. The absence of detected incidents is not evidence of the absence of incidents.
"We will address it when we have more capacity."
The 2026 HIPAA Security Rule mandatory update is in effect now. MFA, behavioral EDR, biannual vulnerability scanning, and annual penetration testing are mandatory requirements today. There is no compliance grace period. Every day without these controls is a day of documented HIPAA non-compliance.
Cybersecurity is no longer something home health agencies can treat as a future priority. It is a current patient safety obligation, a current HIPAA legal requirement, and a current business survival consideration. The agencies that protect their patients, their staff, and their organisations are the ones that made the investment before they needed it. ShieldForce exists to make that investment accessible — at $35/user/month, with no IT department required, with core controls live within 72 hours. Start with a free assessment.
→ Schedule Your Free HIPAA Risk Assessment — shieldforce.io/hipaa-assessment
→ Explore Home Healthcare Cybersecurity — shieldforce.io/home-healthcare
→ View Transparent Pricing from $35/user/month — shieldforce.io/pricing-comparison