ShieldForce Pricing Explained: What $35/User/Month Includes for Home Health Agencies and Regulated SMBs

The managed security services market is notorious for pricing opacity. "Contact sales for pricing" conceals per-user rates that bear no relationship to the services delivered, add-on fees that transform an affordable base price into an expensive full deployment, and contract structures that lock clients into services they cannot audit. I built ShieldForce's pricing model as an explicit rejection of this approach — because home health agency administrators making security investment decisions deserve to know what they are paying for before they sign anything.

$35 per user per month. All-inclusive. No implementation fees. No after-hours surcharges. No required add-ons. No hidden costs that emerge at invoice review. What you see on the pricing page is what you pay. This article explains exactly what that price delivers, what it would cost to assemble the same components independently, and what it means for your cyber insurance programme — so that administrators evaluating ShieldForce against alternatives can make an informed comparison rather than a faith-based one.

What Is Included: The Complete Service Bundle

24/7 Security Operations Centre Monitoring

Round-the-clock monitoring of security telemetry from every enrolled endpoint, identity system, and email platform in your environment. ShieldForce SOC analysts — not automated systems, not tier-one helpdesk staff — review alerts, investigate anomalies, and respond to confirmed threats at any hour of any day. Healthcare-specific context applied to every alert: understanding of EHR architecture, HIPAA breach notification implications, and the clinical operational consequences of different response options.

Behavioral Endpoint Detection and Response

Enterprise-grade behavioral EDR deployed on every enrolled device — Windows laptops and desktops, Mac workstations, and mobile devices through the MDM-enforced agent. Behavioral detection that identifies malicious activity patterns (not just known malware signatures), continuous monitoring of process execution and network connections, and automated isolation of compromised endpoints when threat confirmation reaches the response threshold. This is specifically the behavioral EDR that the 2026 HIPAA mandatory requirement contemplates — not basic antivirus.

Advanced Email Security

DMARC, DKIM, and SPF configuration on your email domain, preventing spoofing of your agency's domain by external attackers. Safe Links with real-time URL rewriting and destination checking at click time. Safe Attachments with sandbox detonation before delivery. Anti-impersonation protection that detects emails mimicking your EHR vendor, Medicare, and internal executives. Data Loss Prevention policies that scan outbound email for unencrypted PHI patterns. This is the email security stack that transforms email from the leading breach vector to a managed, monitored channel.

Mobile Device Management and BYOD Container

MDM enrollment and management for all agency-owned devices and BYOD personal devices through the container model — enforcing encryption, screen lock, EDR agent presence, and patch currency; enabling remote wipe of the work container without accessing personal data; and providing the device compliance reports that HIPAA documentation requires and that cyber insurance underwriters request.

Immutable Cloud Backup with Tested Restoration

Offsite immutable backup of all critical data with a 35-day retention window covering the average ransomware dwell time. Object-lock immutability that cannot be overridden by any account including administrator accounts. Quarterly restoration testing with documented results. Recovery Time Objective targeting of 24–72 hours for full clinical system restoration. This is what makes "we won't pay the ransom" a viable position rather than an aspiration.

MFA Enforcement and Identity Management

Multi-factor authentication configured and enforced through conditional access policies — not made available, enforced. Number-matching authenticator configuration that eliminates MFA fatigue attacks. Access lifecycle management covering onboarding, role changes, and offboarding. Privileged account management with enhanced controls for administrator credentials.

Dark Web Monitoring

Continuous monitoring of criminal marketplaces, paste sites, and underground forums for staff credentials associated with your email domain. Immediate alert when a credential appears in a dark web exposure — with the response protocol activated before the credential can be exploited.

Biannual Vulnerability Scanning and Annual Penetration Testing

Both 2026 HIPAA mandatory requirements, both included in the base price. No separate purchase, no additional engagement required. Biannual vulnerability scans conducted and remediation findings reported within the standard service level. Annual penetration testing coordinated through a qualified external firm, with findings integrated into your risk analysis and remediation tracking.

Complete HIPAA Documentation Package

Annual HIPAA Security Rule risk analysis. Written information security programme with all required policies. Training records infrastructure. BAA management and inventory. Incident response plan with clinical downtime procedures. All delivered at onboarding, maintained throughout the engagement, and updated within 30 days of any material regulatory change. This is the documentation set that an OCR audit or HRSA site visit examines — produced and maintained as part of the base price, not as a separate professional services engagement.

What $35/User/Month Costs at Different Agency Sizes

Per-user pricing is straightforward — but seeing the real numbers for agencies in your size range makes the budget conversation concrete. "Users" means all staff with access to clinical systems, email, or agency devices — clinical staff, administrative staff, billing coordinators, and management.

For context: the average cost of a HIPAA breach for a home health agency in the 50–200 employee range — including breach notification, OCR investigation response, remediation, and business disruption — is $154,000 to $325,000. The ShieldForce programme for a 50-user agency costs $21,000 per year. The math on the risk-adjusted return is not subtle.

What It Would Cost to Build This Independently

The all-inclusive claim means nothing unless you can verify it against the alternative. The table below shows the market rate for each ShieldForce component if a home health agency attempted to procure them independently — using per-user pricing from major vendors in each category, estimated for a 50-user agency. These are not worst-case estimates. They are representative market rates for healthcare-compliant versions of each service.

The self-assembly total also excludes: the internal staff time required to manage eight separate vendor relationships, coordinate annual penetration testing, maintain HIPAA documentation currency, and respond to security incidents across disconnected platforms. That overhead — conservatively 10–15 hours per month for a 50-user agency — represents an additional cost not captured in the per-user rates above.

The Cyber Insurance Connection

Cyber insurance underwriters have materially changed their underwriting requirements for home health agencies since 2022. The days of obtaining meaningful cyber coverage with a basic firewall and antivirus programme are over. Current underwriting questionnaires from major healthcare cyber carriers — Chubb, AIG, Travelers, Beazley, and others — ask specifically about MFA enforcement, EDR deployment, backup immutability, and incident response plan documentation. Agencies that cannot confirm these controls either receive exclusions that limit coverage for the most common breach scenarios, or face premiums that are significantly higher than agencies with documented managed security programmes.

The ShieldForce programme is designed to satisfy the underwriting requirements of major healthcare cyber carriers. Every control that underwriters ask about is included: MFA documented and enforced, behavioral EDR deployed and monitored, immutable backup with tested restoration, written incident response plan, annual penetration testing. Health centres that complete the ShieldForce onboarding have a documented, verifiable security programme that underwriters can evaluate against their checklists — not a self-reported estimate.

Two financial implications worth modelling for your specific agency:

•       Premium reduction: agencies moving from no managed security programme to a documented programme with MFA, EDR, and immutable backup have reported cyber insurance premium reductions of 20–40% at renewal with major healthcare cyber carriers. For an agency paying $18,000/year in cyber premiums, a 30% reduction is $5,400 in annual savings — offsetting approximately 26% of a 50-user ShieldForce programme at list price.

•       Coverage expansion: agencies with documented managed security programmes are more likely to obtain ransomware coverage riders, higher coverage limits, and lower deductibles than agencies with gaps in the core underwriting checklist. The coverage you need most — ransomware, business interruption — is the coverage most restricted for under-protected agencies.

Ask your cyber insurance broker to run your current programme against the underwriting checklist before your next renewal. The gap report that comes back will tell you exactly what the ShieldForce programme adds in coverage terms.

What ShieldForce Does Not Cover

Transparent pricing requires a clear scope boundary. The following are outside the standard $35/user/month ShieldForce programme:

•       Physical security of office premises — door access, security cameras, physical server rooms. ShieldForce covers digital assets; physical security remains the agency's responsibility.

•       Clinical device procurement — ShieldForce manages the devices you own; it does not purchase, lease, or supply hardware.

•       EHR vendor management — ShieldForce works alongside your EHR (Homecare Homebase, WellSky, MatrixCare, Axxess, and others) and manages the security layer around it. The EHR vendor relationship, contract management, and EHR-specific support remain with your existing vendor.

•       Breach legal counsel and OCR representation — if an incident proceeds to OCR investigation, legal representation is provided by healthcare counsel retained separately. ShieldForce provides the documentation and incident support; attorney-client privilege requires separate legal engagement.

•       Cyber insurance premiums — ShieldForce reduces the cost and improves the coverage; the premium itself is a separate insurance expense.

•       Staff end-user devices not enrolled in the programme — ShieldForce manages enrolled devices. A staff member's personal device not enrolled in the MDM programme is outside the scope of the managed service.

No surprises. Everything not on this list is in the programme. If you have a question about whether a specific service or scenario is covered, ask before you sign — the answer will be direct.

The free assessment takes 45 minutes and produces a gap report that shows your current HIPAA Security Rule posture against the 2026 mandatory requirements. If ShieldForce is the right fit, you'll know exactly what you're getting and what it costs before any commitment. If it's not the right fit, you'll still have the gap report — which is worth having regardless.

→ See ShieldForce Full Pricing Comparison

→ Schedule Your FREE Comprehensive HIPAA Risk Assessment

→ Home Health Cybersecurity Services

→ Read: Password Security for Home Health Staff

→ Read: Business Email Compromise in Home Health