Most home health agency administrators who need to address cybersecurity face the same problem: they know it is important, they are not sure where to start, and they have no IT staff to implement whatever they decide.
This 90-day roadmap is designed for exactly that situation. It is sequenced by priority — highest-impact items first — and clearly distinguishes between what a managed cybersecurity provider handles on your behalf and what requires your direct action as agency leadership.
By the end of 90 days, a home health agency that follows this roadmap will have the technical safeguards, documentation, and operational procedures required by the 2026 HIPAA Security Rule — and a defensible posture against ransomware, phishing, and BEC attacks.
Before Day 1: Choose a Healthcare-Specialized Managed Security Provider
The single most important decision in this roadmap comes before it starts: choose a managed cybersecurity provider that specializes in healthcare and specifically in home health.
A healthcare-specialized MSSP handles the technical implementation — EDR deployment, email security configuration, MFA enforcement, backup setup, vulnerability scanning — so you do not need IT staff to do it. They also provide the compliance documentation templates HIPAA requires and the 24/7 SOC monitoring your agency needs.
ShieldForce is built specifically for this scenario: home health agencies without IT departments that need HIPAA-ready cybersecurity without the complexity of enterprise security programs.
Week 1–2: Foundation and Triage
Day 1–3: HIPAA Risk Assessment
The starting point for every HIPAA compliance program is a risk analysis. This is not optional — it is the first thing OCR investigators request, and it is the document that defines what controls you need.
Your managed security provider conducts the risk assessment in collaboration with your operations leadership. The output is a prioritized list of risks with recommended controls. This document also serves as the foundation for your HIPAA Security Rule compliance program.
Action for agency leadership: Provide access to the systems and documentation the provider needs for the assessment. Designate a point of contact (this does not need to be a technical person — the compliance officer or operations director is appropriate).
Day 3–7: MFA Enforcement
MFA is the single highest-impact security control for stopping ransomware and BEC attacks. It is also required by the 2026 HIPAA Security Rule.
Your managed security provider configures MFA enforcement across Microsoft 365 or Google Workspace — all user accounts, no exceptions. This typically takes less than a day of technical work.
Action for agency leadership: Communicate to staff that MFA will be required. Staff will receive prompts to register their MFA method (typically Microsoft Authenticator or Google Authenticator on their phone). Plan for a brief help desk period as staff register.
Day 7–14: EDR Deployment
Behavioral endpoint detection and response is deployed on all agency-owned and field-staff personal devices (via MDM). This is a background agent that monitors device behavior for signs of malware, ransomware, and credential theft.
Action for agency leadership: Provide the device inventory. For BYOD personal devices, communicate to field staff that a lightweight security agent will be installed in a managed container — and that it does not monitor personal apps or data.
Week 3–4: Email Security and Data Protection
Email Security Configuration
Advanced email security — anti-phishing, anti-impersonation, Safe Links, Safe Attachments — is configured across your email platform. DMARC, DKIM, and SPF are set up to prevent domain spoofing.
Action for agency leadership: None required — this is managed by your provider. You may notice a brief delay in email delivery as the new filtering layers are activated.
Backup Activation
Automated daily backups are configured for your critical systems: EHR data exports, email (via Microsoft 365 backup), and cloud document storage. Backups are stored in immutable storage isolated from your production environment.