Across home health HIPAA compliance programs, the Acceptable Use Policy is one of the most commonly mishandled required documents — either missing entirely, written in language no field nurse could interpret, or so outdated it references technology the agency stopped using years ago. The AUP is often treated as the document you produce to check the compliance box — not as the governance instrument that actually shapes how your workforce interacts with patient data every day. Written correctly, an AUP does both. Written incorrectly — or not at all — it's a liability waiting to become an exhibit in an OCR investigation.
What HIPAA Requires and Why the AUP Matters
The HIPAA Security Rule requires covered entities to implement "policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information." The AUP is the primary vehicle through which this requirement is met at the workforce level. It defines the line between acceptable and unacceptable use of organizational systems and data — and that line must exist in writing before you can enforce it, before you can apply sanctions for violations, and before you can defend your security program to OCR.
The Eight Essential Sections of a Home Health AUP
Section 1: Scope — Who This Policy Applies To
The AUP must explicitly state that it applies to every workforce member — employees, contractors, volunteers, and vendors — who accesses organizational systems, devices, or data. In home health, this means clinical staff, the administrative team, the billing company, the scheduling software vendor's support personnel, and any volunteer who touches patient scheduling or communication. This is where many agencies fail: they write a policy for employees and forget that HIPAA defines "workforce" to include contractors and volunteers.
Section 2: Permitted Uses of Organizational Systems
This section defines what workforce members are authorized to do with agency systems, devices, and data. Permitted uses in a home health context include: documenting patient care in the EHR, communicating with clinical team members about patient care through agency-approved channels, accessing scheduling and billing systems for legitimate care coordination and administrative functions, and using agency-approved email for professional communication. Being explicit about what's permitted removes ambiguity and makes the prohibited uses section more enforceable.
Section 3: Prohibited Uses — The Non-Negotiables
This is the section that requires specificity. Generic prohibited use statements ("do not misuse company systems") are unenforceable. Specific prohibited use statements create clear, documentable standards:
Sharing login credentials with any other person for any system, for any reason, under any circumstances — including sharing with a colleague during a device emergency
Accessing patient records for any reason other than a direct care, administrative, or legitimate operational need related to that specific patient
Transmitting ePHI via personal email, personal text messaging, consumer messaging applications (WhatsApp, iMessage to personal numbers, Signal, Facebook Messenger), or any platform not designated by the agency as HIPAA-compliant — see HIPAA and Texting: Can Home Health Staff Text Patient Information? for the full policy language and compliant messaging platform options this prohibition should point staff toward
Storing ePHI on personal devices, personal cloud storage accounts, USB drives, or any storage medium not authorized and managed by the agency
Installing unapproved software or applications on agency-owned devices without IT authorization
Using agency-owned devices for personal activities that could expose the device to malware — including visiting personal social media, online gaming, or adult content sites