The FTC Safeguards Rule isn't the first regulation that comes to mind for home health administrators thinking about data security. It's primarily associated with financial institutions — banks, mortgage lenders, auto dealerships, credit unions. Yet the 2023 amendments to the Safeguards Rule significantly broadened the definition of "financial institution" under the Gramm-Leach-Bliley Act in ways that may capture certain home health agency activities. This is an area worth understanding clearly before assuming an agency is out of scope — because being wrong about scope is a compliance exposure that adds to HIPAA risk rather than replacing it.
What the FTC Safeguards Rule Is and Who It Covers
The FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act, requires "financial institutions" to implement an information security program protecting "customer financial information." The 2023 amendments (effective June 9, 2023) expanded the definition of activities that qualify an organization as a financial institution to include entities "significantly engaged" in financial activities, including activities "incidental to financial operations." The FTC has interpreted this broadly to include organizations that provide financial planning services, process consumer financing, or handle billing and payment processing in ways that go beyond standard commercial billing.
The Scope Question for Home Health Agencies
The direct HIPAA-covered activities of a home health agency — clinical care delivery, care documentation, Medicare and Medicaid billing — are generally not the activities that trigger Safeguards Rule coverage. However, certain activities that some home health agencies engage in may bring them within scope:
Patient financing arrangements — home health agencies that offer payment plans, financing arrangements, or that partner with consumer financing companies for patient out-of-pocket balances may qualify as engaged in financial activities under the expanded definition
Subsidiary or affiliated financial services — agencies affiliated with organizations providing financial services, including certain PACE programs, may inherit Safeguards Rule obligations through the affiliated entity relationship
Third-party billing with consumer data — agencies whose billing operations collect and process consumer financial data (credit card numbers, bank account information for payment collection) may have Safeguards Rule exposure for the financial data specifically, separate from HIPAA coverage of the clinical data
What the Safeguards Rule Requires If You're in Scope
The 2023 amended Safeguards Rule requirements closely parallel the 2026 HIPAA Security Rule updates — which is both fortunate and deliberate, as the FTC explicitly aligned the Safeguards Rule with NIST cybersecurity framework guidance that also underpins the HIPAA update. The core requirements: a written information security program, a designated Qualified Individual responsible for overseeing the program (analogous to the HIPAA Security Officer), a risk assessment, implementation of safeguards to manage identified risks, regular testing and monitoring of safeguards, and an incident response plan.
The technical requirements include: encryption of customer financial information in transit and at rest, MFA for any individual accessing customer financial information, penetration testing and vulnerability assessments on a regular schedule, and audit logs of access to customer financial information. These requirements are substantively similar to the 2026 HIPAA mandatory technical safeguards — meaning an organization with a strong HIPAA compliance program satisfies most Safeguards Rule technical requirements with minimal additional work.
A Separate Notification Obligation Most Agencies Don't Know About
The 2023 amendments also added a distinct breach notification requirement that's easy to miss because it runs alongside, not instead of, HIPAA's own notification rules. Covered institutions must report a "notification event" — defined as unauthorized acquisition of unencrypted customer information involving at least 500 customers — directly to the FTC within 30 days, separate from and in addition to any HIPAA breach notification obligations to HHS OCR and affected patients. For an agency determined to be in scope, this means an incident involving patient financial data could trigger two parallel notification tracks — HIPAA's process (see HIPAA Breach Notification: A Step-by-Step Guide for that timeline) and the FTC's, on a shorter 30-day clock, to a different agency entirely.