How to Prevent Credential Theft in Home Health and Hospice: 5 HIPAA Steps

Credential theft happens when an attacker steals or tricks a staff member into handing over a login, then uses it to reach email, the EHR or other systems holding patient data. Home health, hospice and FQHC leaders can close most of that door with five steps: multi-factor authentication everywhere PHI lives, verified help-desk resets, the same login rules for vendors and contractors, sign-in monitoring, and a documented risk analysis.

Most healthcare breaches don't start with a sophisticated hack. They start with a person who believed a phone call, clicked a convincing email, or shared a login that someone else later misused. That's good news for small agencies, because the defenses are practical and affordable.

This fall's breach notices make the pattern hard to miss. Below, we walk through what happened, why field-based care teams are especially exposed, what HIPAA expects, and the five steps that matter most.

How do attackers steal healthcare login credentials?

They rarely need to break in. They ask, trick or borrow their way in. Three recent incidents show three common routes.

Posing as IT. On August 24, 2026, someone impersonating a Marathon Health IT worker obtained an employee's login and used it to export data from a cloud-hosted application, according to the company's notice filed with the Massachusetts Attorney General. The access lasted only a few hours. The information involved may have included names, dates of birth, contact details and Social Security numbers.

A login at a vendor. Between June 5 and July 24, 2026, an unauthorized party used a clinical user account in WellSky's EHR to reach patient records of Doctor's Choice Home Care in Houston, HIPAA Journal reports. The agency's own systems were unaffected, yet 14,333 people were reported to OCR. Exposed data included Social Security numbers, clinical and treatment details, and insurance information.

Email accounts. Three Oaks Hospice in Texas found unauthorized access to a limited number of email accounts in August 2025. Per its patient notice and HIPAA Journal, affected individuals were notified in September 2026, and 36,622 people were reported to OCR.

Federal analysts have warned about the first route for some time. A 2024 HHS HC3 analyst note described callers posing as employees, using personal details gathered from public sources to pass identity checks, and persuading help desks to enroll a new phone for MFA.

Why are home health, hospice and FQHC teams especially exposed?

Because your clinicians work where your IT team can't see them. A nurse logs into the EHR from a patient's living room, on a tablet, over home Wi-Fi, between visits. That login is the only thing standing between an attacker and your entire census.

A few realities make this harder for smaller organizations:

• Cloud EHRs are reachable from anywhere. That's what makes them work for field care, and it's also why a stolen password works for an attacker too.

• Your data lives partly at your vendors. The Doctor's Choice incident shows an agency can be breached without its own network being touched.

• Lean teams answer their own help-desk calls. An office manager resetting a password under pressure is exactly who social engineers target.

• Contractors and per-diem staff come and go. Accounts that aren't closed promptly are easy to misuse.

None of this reflects carelessness. It's the normal shape of community-based care, and it's why login security deserves first place on your list.

Does HIPAA require multi-factor authentication?

Not by name, yet. Today's HIPAA Security Rule requires you to verify that anyone accessing ePHI is who they claim to be (Person or Entity Authentication, 45 CFR §164.312(d)), but it leaves the method to you. HHS proposed an update in January 2025 that would make MFA an explicit requirement. As of this writing that rule has not been finalized, and the federal regulatory agenda lists a possible final action no earlier than July 2027 (Patient Protect summary).

Waiting for the final rule is the wrong read. OCR already judges whether you identified this risk and addressed it. On October 29, 2026, OCR announced an $800,000 settlement with Lehigh Valley Health Network after a 2023 ransomware attack exposed data on 248,359 people. OCR alleged LVHN had not completed an accurate risk analysis or regularly reviewed system activity such as audit logs, and it imposed a three-year corrective action plan.

OCR's own recommendations in that announcement include using authentication, reviewing system activity regularly and repeating your risk analysis. In other words: the expectations are already here.

What are the five most important steps to prevent credential theft?

Each step below maps to a HIPAA Security Rule requirement, so the same work protects patients and strengthens your compliance record.

1. Turn on MFA everywhere PHI lives. Start with email, your EHR and any remote access. Where you can, choose app-based prompts with number matching or security keys over text-message codes, which are easier to intercept. HIPAA tie-in: Person or Entity Authentication, §164.312(d).

2. Verify before you reset. Never reset a password or enroll a new MFA device based on a phone call alone. Call the person back at the number already on file, or confirm through their supervisor. Train every staff member who handles these requests. HIPAA tie-in: Security Awareness and Training, §164.308(a)(5).

3. Hold vendors and contractors to the same rules. Ask your EHR and other vendors how they protect user accounts, and require MFA for anyone, staff or contractor, who logs into systems with your patients' data. Close accounts the day someone leaves. HIPAA tie-in: Business Associate Contracts, §164.308(b), and Workforce Security, §164.308(a)(3).

4. Watch sign-ins, not just servers. Turn on alerts for logins from unusual locations, new devices, or large downloads, and assign someone to review them. Marathon Health's access lasted only hours; fast detection is what limits the damage. HIPAA tie-in: Audit Controls, §164.312(b), and Information System Activity Review, §164.308(a)(1)(ii)(D).

5. Put stolen logins in your risk analysis, and write it down. Name credential theft as a risk, record the controls you've put in place, and revisit it at least yearly. This is the documentation OCR found lacking at Lehigh Valley. HIPAA tie-in: Risk Analysis, §164.308(a)(1)(ii)(A).

What should you do if a staff or vendor account is compromised?

Act in hours, not days. The first steps are the same whether the account belongs to your staff or a vendor:

1. Lock the account and end active sessions. Resetting the password alone may not log out an attacker who is already in.

2. Reset MFA enrollments on that account, and check whether any new devices were added recently.

3. Preserve the logs before anything is overwritten. You'll need them to understand what was accessed.

4. Notify the vendor immediately if the account is in their system, and ask what they're seeing on their side.

5. Start your breach assessment. HIPAA's Breach Notification Rule requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. Late notice was one of the issues OCR cited at Lehigh Valley.

If you don't have a written incident response plan that covers these steps, that's a good place to start this month.

The bottom line

One stolen login can expose an entire patient census, and attackers know small agencies are busy. The five steps above aren't expensive or complicated, but they do need an owner and a written record.

If you'd like a second set of eyes on your login security or your risk analysis, the ShieldForce team works with home health, hospice and FQHC organizations every day. Learn more on our home health, hospice and community health center pages.

Sources

• Marathon Health notice to the Massachusetts Attorney General

• HHS OCR: Lehigh Valley Health Network settlement, Oct 29, 2026

• HHS HC3 analyst note on help-desk social engineering (via AHA)

• HIPAA Journal: Doctor's Choice Home Care and Three Oaks Hospice breaches

• Three Oaks Hospice notice of data incident

• Patient Protect: 2026 HIPAA Security Rule status

This article is for informational purposes only and does not constitute legal advice. Consult qualified HIPAA counsel for guidance specific to your organization.