SHIN-NY cybersecurity requirements do not scale based on agency size. A home health agency with 12 nurses and no IT department has the same CSPP, MFA, encryption, audit logging, and incident response obligations as a large multi-site agency with 200 staff and a full compliance department.
This creates a meaningful compliance burden for small agencies — organizations that are serving patients, managing payroll, and coordinating care with limited administrative bandwidth. Building a SHIN-NY compliance program from scratch without IT expertise or dedicated compliance staff feels overwhelming.
This guide provides a right-sized SHIN-NY compliance approach for small home health agencies — what to do first, what can be simplified, what cannot be reduced, and how to use available resources to close the gap efficiently.
What Cannot Be Reduced: The Non-Negotiable Requirements
Before discussing simplification, it is important to be clear about what SHIN-NY requires regardless of agency size:
CSPP document: Must exist, must be current, must cover all required content areas. There is no small-agency exemption to the CSPP requirement.
SCPA executed with the RHIO: Must be signed by an authorized executive. Must be renewed annually. No size-based waiver.
MFA on all SHIN-NY access: Every user accessing SHIN-NY-connected systems must use MFA. A 10-person agency has the same MFA requirement as a 200-person agency.
Encryption on all devices accessing SHIN-NY data: Every device, regardless of how small the agency. A three-device office still needs encrypted devices.
Audit logging with periodic review: Must exist, must be reviewed. The review can be done by the executive director or compliance-designated staff member — it does not require a dedicated IT analyst — but it must happen and be documented.
Annual staff training: Every staff member with SHIN-NY access must complete annual security awareness training. Documented.
These six requirements are irreducible. The complexity of implementing them, however, scales with the agency.
What Can Be Simplified for a Small Agency
Simplified CSPP
A CSPP for a 12-person home health agency with a single office location and a cloud-hosted EHR does not need to be as long or complex as a CSPP for a 150-person agency with multiple sites and a locally hosted server infrastructure. The sections of the CSPP can be shorter because:
- The scope of the risk assessment is narrower (fewer systems, fewer devices, fewer sites)
- The access control procedures are simpler (fewer roles, fewer permission levels)
- The vendor management section is more compact (typically one EHR vendor, one billing vendor)
- The network architecture section is straightforward (a single office network, a cloud EHR)
ShieldForce provides a small-agency CSPP template that is structured appropriately for agencies under 25 staff — covering all required content without unnecessary enterprise-level complexity.
Simplified Incident Response Plan
A small agency's incident response plan can use the tiered format described in our incident response planning guide with an even simpler Tier 1 runbook. For a 12-person agency, the incident response team may be the executive director alone, plus the managed security provider. The plan documents exactly that: who to call (the SOC number), what to do immediately (follow SOC guidance, call legal counsel), and what to document.
Simplified Access Review
For a small agency, the quarterly access review — checking that staff have appropriate access and former employees have been removed — may take 15 minutes. The executive director reviews the user list in the EHR and Microsoft 365 admin center. Documents the review date and any changes made. Done.