When an EHR or software vendor is breached, the home health or hospice agency usually remains responsible under HIPAA for notifying patients and regulators. The vendor must report the breach to you, but the risk is yours. Agencies reduce it with current business associate agreements, vendors in the annual risk analysis, multi-factor authentication and a tested downtime plan.
That isn't a hypothetical. In early November 2026, HIPAA Journal reported that an unauthorized party had gotten into the systems of Accumedic, an EHR vendor used by behavioral health practices in New York. The first access was in April. Patient data was likely taken in early June. Notification letters to patients of one affected clinic didn't start going out until October 30, nearly seven months after the vendor was first accessed.
Home health and hospice have seen the same pattern. Earlier this year, a single compromised clinical user account on the WellSky platform exposed information on 14,333 patients of Doctor's Choice Home Care in Texas, even though the agency's own systems were not affected. And a compromised login at Doctor Alliance, a platform many agencies use to exchange orders with physicians, affected Enhabit, BAYADA, AccentCare and several smaller agencies.
These agencies relied on the same kinds of cloud platforms nearly every home health, hospice and community health center depends on today. That's the point: if your patient data lives in a vendor's system, your security program has to reach that far too.
What happens to my agency when our EHR vendor has a data breach?
You may not hear about it right away, and when you do, the work lands on you. Here is what a vendor breach typically means for a home health, hospice or FQHC organization:
A delayed start. The vendor has to discover the breach, investigate it, and work out which customers and patients were affected before notifying you. In the Accumedic case, months passed between the first intrusion and patient letters.
Your name on the patient letter. Patients know you, not your software vendor. Even when the vendor handles the mailing, the notice usually names your agency, and patients call your office with questions.
Regulatory filings. Depending on how many patients are affected, you may need to report to the HHS Office for Civil Rights (OCR), notify state attorneys general and, for larger breaches, the media.
Possible service disruption. If the vendor takes systems offline to contain the attack, your clinicians may lose access to schedules, visit notes and orders. The University Hospitals incident in Cleveland, where digital systems and the patient portal were still offline more than two weeks after the October 22 incident, shows how long that can last. We covered the lessons in What Home Health and Hospice Leaders Should Learn From the University Hospitals Cyber Incident.
Patient trust and legal exposure. Breaches involving Social Security numbers and medical information often draw class-action investigations, whoever was the entry point.
For a day-by-day view of what follows a breach, see What Happens in the First 30 Days After a Home Health Data Breach.
Who is responsible under HIPAA when a vendor exposes patient data?
Both of you, in different ways. Any vendor that creates, receives, stores or transmits protected health information (PHI) for you is a business associate under HIPAA. That includes your EHR, billing service, physician-order platform, email provider and IT support company. HHS explains this in its business associate guidance.
Here is how responsibility splits, based on the HHS Breach Notification Rule:
The vendor (business associate) | Your agency (covered entity) | |
|---|---|---|
Notify | Must tell you without unreasonable delay, and no later than 60 days after discovering the breach | Must notify affected patients without unreasonable delay, and no later than 60 days after discovery |
Report to HHS | Supplies details on who was affected | Reports to OCR: within 60 days if 500 or more people are affected; in an annual report for smaller breaches |
Media | — | Required when more than 500 residents of a state are affected |
Liability | Directly liable for safeguarding PHI under the Security Rule | Remains ultimately responsible for patient notice, though it can hand the mailing to the vendor |
Two practical takeaways. First, the 60-day clock is the outer limit, not the target, and your business associate agreement can require faster notice. Second, before you share PHI with a vendor, HIPAA requires a written agreement in which the vendor commits to protecting it. If you don't have one on file for every vendor that touches PHI, that gap is worth closing before anything else.
FQHCs have one more step: our FQHC cybersecurity guide explains when a cyberattack that disrupts operations also needs to be reported to your HRSA Project Officer.
How can home health and hospice agencies reduce vendor risk?
You can't run your vendor's security, but you can control how much your agency depends on it and how quickly you find out when something goes wrong. These five steps map to requirements already in the HIPAA Security Rule.
1. Keep a list of every vendor that touches patient data
Most agencies can name their EHR. Fewer can name every other system that holds PHI: the physician-order portal, e-fax service, billing company, telehealth tool, scheduling app and Microsoft 365 or Google Workspace. Write the list down. For each vendor, note what data it holds, who at your agency can log in, and whether a signed business associate agreement is on file.
HIPAA tie-in: business associate contracts, 45 CFR 164.308(b).
2. Put your vendors into your annual risk analysis
The Security Rule requires a risk analysis, a documented review of where your electronic PHI lives and what could go wrong. Too often, that review stops at the office network and laptops. Your EHR and other cloud platforms belong in it. Ask each critical vendor for evidence of its own security, such as a SOC 2 report (an independent audit of a vendor's security controls).
HIPAA tie-in: risk analysis, 45 CFR 164.308(a)(1)(ii)(A). Our step-by-step HIPAA risk analysis guide walks through the process, and What Is a SOC 2 Report? explains what to look for.
3. Lock down every login to vendor platforms
The WellSky and Doctor Alliance incidents both began with one valid user account. Stolen or reused passwords remain one of the easiest ways in. For every vendor platform that supports it:
Turn on multi-factor authentication (MFA), a second check beyond the password, such as a code on a phone.
Give each clinician and staff member their own login. No shared accounts.
Remove access the same day someone leaves, including per diem staff and contractors.