Home Health Agency Cybersecurity Checklist: 35 Items by HIPAA Category

Most "cybersecurity checklist" articles are a flat list of 10 tips in no particular order. This one isn't. The 35 items below are organized the way HIPAA's Security Rule itself is organized — Administrative, Physical, and Technical safeguards — because that's how an auditor, an OCR investigator, or your own compliance officer will actually review your agency. Working through a flat, unordered list tells you whether you've thought of a few good ideas. Working through it by HIPAA category tells you whether you'd survive an actual audit.

If you're new to the subject, start with our home health cybersecurity guide, which covers the threats and requirements behind each item here in depth, or see the full home health cybersecurity platform ShieldForce provides to cover every item on this list as a managed service. This article is the companion checklist: shorter, numbered, and built to print or work through on a screen, one item at a time.

Administrative Safeguards

Administrative safeguards are the policies, procedures, and management decisions that govern how your agency protects patient data. They're the foundation OCR checks first, because a technical control without a policy behind it usually means nobody's actually accountable for it. An encrypted laptop with no documented policy on who's authorized to carry one, or what happens when they leave, is a control that exists by accident rather than by design — and accidental controls are exactly what fail the moment a specific person stops being around to maintain them.

This category is also where OCR investigations spend the most time, because it's where intent and documentation live. A surveyor can see that your endpoints are encrypted in about five minutes. Confirming that your risk analysis is current, that your workforce training records exist, and that your incident response plan has actually been tested takes considerably longer — and is where most agencies, even well-run ones, are weakest.

1. Conduct a formal, documented HIPAA risk analysis covering every system that creates, stores, or transmits ePHI, including field devices.
2. Update that risk analysis whenever you add a new EHR module, vendor, or remote-access tool — not just on an annual calendar date.
3. Assign a designated security officer responsible for HIPAA Security Rule compliance, even if the role is part-time.
4. Document a sanction policy for workforce members who violate security policies, and apply it consistently.
5. Review system activity logs on a defined schedule, not only after an incident has already occurred.
6. Maintain workforce clearance procedures so access to ePHI is granted based on role, not convenience.
7. Document access authorization procedures: who approves a new hire's system access, and on what basis.
8. Document access termination procedures, and confirm they're actually followed the same day a staff member or contractor leaves.
9. Enroll every workforce member — including part-time and contract caregivers — in documented security awareness training.
10. Run phishing simulations at least annually and track staff response rates as a real metric, not a formality.
11. Maintain a written security incident response plan naming who is notified, in what order, and within what timeframe.
12. Actually test that incident response plan with a drill, rather than leaving it filed and unrehearsed.
13. Maintain a documented contingency plan for operating during a system outage or ransomware event.
14. Sign a Business Associate Agreement (BAA) with every vendor that touches ePHI — EHR, email, backup, and scheduling platforms alike.
15. Schedule a periodic technical and non-technical evaluation of your security program, not just when something breaks.

Physical Safeguards

Home health agencies often assume physical safeguards don't apply to them because there's no central facility full of servers to lock down. That's exactly backwards — when your "facility" is every caregiver's car, home, and bag, physical safeguards matter more, not less, precisely because there's no single door to lock at the end of the day.

The landmark case illustrating this is still the Hospice of North Idaho's 2013 settlement: a single unencrypted laptop, taken home by a nurse and stolen from her car, became HHS OCR's first-ever HIPAA settlement for a breach affecting fewer than 500 patients. The $50,000 penalty wasn't for the theft itself — it was for the absence of exactly the kind of physical safeguards listed below.

16. Maintain a complete inventory of every laptop, tablet, and phone used to access patient data, including personally-owned devices used for work.
17. Document workstation use policies covering both office workstations and field devices.
18. Require full-disk encryption on every device before it's provisioned for work use, not as an optional setting someone has to remember to enable.
19. Document a remote-wipe and credential-revocation procedure for lost or stolen devices, and confirm it actually works before you need it.
20. Control physical access to any on-premises server or network equipment your agency maintains.
21. Document media disposal procedures for any device or storage media that's retired, including personally-owned devices that leave the fleet.
22. Maintain accountability records for hardware movement — who has which device, and when it was last verified.
23. Require that field devices are never left unattended and logged in, including in a car or a patient's home.

Technical Safeguards

These are the controls most people picture when they hear "cybersecurity" — but HIPAA's technical safeguards are specific requirements, not a vague mandate to "have good security." Each item below maps to a named provision in 45 CFR § 164.312, which means each one is independently checkable rather than a matter of opinion about whether your agency is secure "enough."

For a home health agency specifically, this category is also where generic IT vendors tend to fall shortest, because most of the items below assume a device that leaves the building every day rather than one that stays on a desk. A firewall protecting an office network does nothing for a caregiver's phone syncing patient data from a parking lot.

24. Assign every user a unique login credential — no shared accounts across clinical or administrative staff.
25. Enforce multi-factor authentication on every account that can access patient data, with no shared-login exceptions.
26. Document emergency access procedures so authorized staff can reach ePHI if a primary system or credential is unavailable, without bypassing audit logging.
27. Configure automatic logoff on idle sessions across every device and system.
28. Encrypt ePHI at rest on every device that stores it, field devices included.
29. Encrypt ePHI in transit, including email and any data synced to or from your EHR.
30. Maintain audit logs on every system that touches ePHI, covering access and activity, not just login events.
31. Deploy anti-ransomware endpoint protection with rollback capability, not antivirus alone.
32. Maintain tested, encrypted backups with a defined recovery time objective — and confirm you've actually tested restoring from them.
33. Restrict network access for field devices connecting over unmanaged home or public WiFi, using device-level controls rather than relying on the network's own security.
34. Review EHR platform security settings at least annually, not only at initial setup.
35. Confirm your cyber insurance policy's required controls match what you actually have in place, not what you assumed when you bought the policy.

Why 35 Items, Not 10

Shorter checklists get shared more, which is exactly why most of the ones you'll find online stop at 10 items. They're optimized for engagement, not for actually surviving an audit. A home health agency's real attack surface — field devices, home networks, EHR credentials, vendor relationships, and the paper trail proving all of it is managed — doesn't compress down to 10 bullet points without losing the items that actually matter in an investigation.

The three-category structure also mirrors how a cyber insurance underwriter reviews a renewal application, and how an OCR investigator structures a breach inquiry. Working through all 35 items isn't about completeness for its own sake; it's about matching the exact lens the people who'll eventually evaluate your agency are going to use.

How to Use This Checklist

Work through all three categories in order — administrative first, since a technical control with no policy behind it tends to erode the moment the person who set it up leaves the organization. A perfectly encrypted laptop is still a liability if nobody documented who's allowed to carry one, or what happens when that person's employment ends.

Be honest about partial credit. A backup that's never been tested for restoration doesn't count as done — it counts as an assumption you haven't verified. Training that happened once at hire three years ago doesn't count as ongoing; it counts as a gap waiting for an auditor or an attacker to find it first. The agencies that fail an OCR investigation almost never fail because they had zero controls. They fail because they had partial controls they believed were complete.

If you want a guided version of this same assessment with a scored report rather than a static list, our home health cybersecurity guide walks through the reasoning behind each category in more depth, or you can start with a free HIPAA risk assessment to see exactly where your agency's real gaps are before you commit to fixing anything.

Frequently Asked Questions

How many of these 35 items does a typical home health agency already have in place?

Most agencies we assess have strong physical safeguards but weaker administrative documentation — they're doing the right things operationally but haven't written down the policies that prove it. The gap that costs agencies the most in an actual OCR investigation is usually items 1 and 2: a risk analysis that either doesn't exist or hasn't been updated since the agency's systems changed. An agency can have excellent day-to-day habits and still fail an audit purely on missing paperwork.

Is this checklist specific to home health, or does it apply to any healthcare organization?

The underlying HIPAA Security Rule categories apply to any covered entity or business associate. What's specific to home health here is the framing — physical safeguards extending to field devices and caregiver vehicles, and technical safeguards accounting for unmanaged home WiFi, both reflect a mobile workforce rather than a fixed facility. A hospital security team can assume its network; a home health agency has to assume it doesn't control the network at all.

Do I need to complete every item before I'm considered HIPAA compliant?

There's no single checklist that makes an organization "compliant" — compliance is an ongoing risk management process, not a one-time certification you earn and keep forever. This checklist reflects the practical controls OCR and cyber insurance underwriters look for most often, so working through it honestly gets you close to that standard, but your actual documented risk analysis, specific to your agency's own systems, should drive what you specifically need beyond it.

What's the difference between this checklist and the one in the home health cybersecurity guide?

The home health cybersecurity guide's checklist is organized as a single quick self-audit alongside the full context — threats, HIPAA requirements, vendor selection, and cost. This article expands that same checklist into the three formal HIPAA Security Rule categories with more items per category, meant to be used on its own as a printable reference rather than read alongside the rest of the guide.

How often should this checklist be reviewed?

At minimum, revisit it whenever your agency changes EHR platforms, adds a new vendor, or onboards a new remote-access tool — any of which can quietly invalidate items you previously checked off without anyone noticing until an audit or an incident surfaces the gap. Absent a specific trigger like that, review it every six months as a baseline, which is also when we recommend refreshing any statistics or examples cited alongside it.