Two years ago, a Medicare Advantage plan cybersecurity assessment of a preferred home health provider was a rarity. Today it's becoming standard practice among the larger MA plans — Humana, UnitedHealthcare, Aetna, Cigna — as part of their network credentialing and preferred provider program management. The Change Healthcare breach in 2024, which disrupted claims processing for healthcare providers across the country through a single compromised supply chain partner, accelerated this shift dramatically. MA plans are no longer willing to accept "we are HIPAA compliant" as sufficient evidence that a provider's security posture doesn't represent a risk to the plan's data and operations.
What this means for home health agencies is that the security program that used to be evaluated solely by OCR — rarely, and only after a breach — is now being evaluated by the commercial partners whose preferred provider designation drives referral revenue. A failed or unsatisfactory MA plan security assessment can remove an agency from a preferred provider list, which can cost more in annual revenue than most HIPAA penalties. This is the same underlying dynamic covered in How Home Health Agencies Can Win More Hospital Referrals With Cybersecurity Certification — commercial partners, not just regulators, are increasingly the ones setting the bar. For agencies navigating New York's Medicaid managed care landscape at the same time, see Medicaid Managed Care and Cybersecurity: What NY Home Health Agencies Must Know for how that parallel payer-assessment process works.
What Medicare Advantage Plan Assessments Actually Examine
MA plan cybersecurity assessments range significantly in depth depending on the plan's sophistication and the nature of the provider relationship. The most common format is a vendor security questionnaire — typically a modified version of the SIG (Standardized Information Gathering questionnaire), the VSAQ (Vendor Security Assessment Questionnaire), or a proprietary questionnaire. These typically cover between 50 and 200 questions across the same domains as the HIPAA Security Rule: access control, encryption, network security, incident response, training, and vendor management.
For preferred provider arrangements involving data sharing — where the MA plan is sending patient attribution data to the agency or receiving clinical documentation from the agency — some plans conduct more rigorous assessments that include: a technical configuration review, a request for the agency's most recent HIPAA risk analysis, evidence of penetration testing, and a phone interview with the agency's Security Officer or an authorized representative.
The Documentation Package That Answers Assessment Questions
The home health agencies that complete MA plan security assessments quickly and successfully are the ones that maintain a standing compliance documentation file rather than building it in response to each assessment request. Here's what that file must contain:
Current HIPAA Security Rule risk analysis — completed within the past 12 months, with findings and remediation status documented
Written information security program — all required policies, including access control, incident response, remote access, acceptable use, and media disposal
Most recent vulnerability scan report — completed within the past six months, with findings and remediation actions documented