Matrixcare is the market leader among home health and senior living EHR platforms for larger and enterprise-scale organisations. Its cloud architecture, clinical documentation depth, and billing integration are mature. It maintains SOC 2 Type 2 certification, provides a Business Associate Agreement, and operates a security programme consistent with the expectations of a major healthcare software company. When home health agencies that use Matrixcare call me following a security incident, the Matrixcare platform itself is never where the breach originated. The breach is always in the environment around Matrixcare — the devices, the email, the credentials, the networks that connect to the Matrixcare application from outside its secure perimeter.
This is not a criticism of Matrixcare. It reflects a truth about every cloud-based clinical application: the application boundary is where vendor security ends and agency security begins. The security work that a home health agency must do around Matrixcare is not different in kind from what it must do around any other EHR. But it is work that must be done — documented, implemented, and verified — before the agency can claim a complete HIPAA Security Rule compliance programme.
Understanding the Matrixcare Security Architecture
Matrixcare operates its application in a cloud environment with dedicated infrastructure for healthcare clients. The security controls within that environment — network security, database encryption, application authentication, access logging — are Matrixcare's responsibility under the BAA. The controls outside that environment — the devices that connect to Matrixcare, the email systems that receive Matrixcare notifications, the networks that carry Matrixcare traffic from the clinical user to the application, the credentials that clinical staff create for their Matrixcare logins — are the agency's responsibility.
A useful mental model: Matrixcare is a secure facility. Every security control inside that facility is well-managed. But every person who enters and exits that facility carries data with them on devices that leave the facility and travel through environments you cannot control. Securing the facility's interior does not secure what enters and leaves through the door.
The Four Security Layers Every Matrixcare Agency Must Build
Layer 1: Endpoint Security for All Matrixcare Access Devices
Pull up your Matrixcare active user list. Count the distinct device types accessing the platform: Windows laptops in the office, Mac laptops for clinical directors, iPads and Android tablets for field clinical staff, personal iPhones for the scheduling coordinator who checks the platform between visits. Each of these is an ePHI access point the agency must secure. The 2026 mandatory requirements — behavioral EDR, full disk encryption, MDM enrollment — apply to every one of them. An agency with 85 Matrixcare users may have 140 or more devices accessing the platform. Every one requires documented security control verification.