Every home health agency administrator has had the conversation. The insurance broker recommends cyber coverage. The consultant says to upgrade security tools. The IT vendor quotes a managed service. And somewhere in the middle of all of it, someone says: "Can't we just use what we have?"
The answer, in most cases, is technically yes. And financially, catastrophically no.
Cheap cybersecurity for a home health agency, outdated antivirus, a shared firewall from the internet provider, and annual HIPAA training from a $19/month compliance portal, costs nothing until it costs everything. Understanding the real arithmetic of underinvestment is the most important financial conversation a home health agency administrator can have in 2026.
What "Cheap" Cybersecurity Actually Looks Like
The typical low-cost cybersecurity stack for a small home health agency looks something like this:
- Endpoint protection: Windows Defender, which is built in and free, or a basic consumer-grade antivirus subscription.
- Email security: The spam filter included with Microsoft 365 Business Basic.
- Backup: An external hard drive in the office, backed up weekly when someone remembers.
- Training: An annual online module that staff click through in eight minutes.
- Monitoring: None, unless someone notices something is wrong.
Total monthly cost: approximately $0-$50.
This stack is not nothing. Windows Defender catches known malware. The built-in spam filter blocks obvious phishing. The external drive backup provides some recovery capability if the drive is not encrypted alongside your systems in an attack.
What it does not provide is behavioral threat detection, 24/7 monitoring, email impersonation protection, immutable backup, incident response capability, or documented compliance evidence. These are not optional extras. They are the specific capabilities that determine whether a ransomware attack costs $15,000 or $500,000.
The Real Cost Comparison
Scenario A: Agency with Basic "Cheap" Security
A 60-person home health agency in New Jersey uses Windows Defender, basic spam filtering, and an external drive backup. Monthly security spend: $40.
A phishing email reaches the billing manager on a Thursday afternoon. She clicks a link impersonating a Medicare portal notification. Her Microsoft 365 credentials are captured. Over the next two weeks, the attacker monitors her email, reads billing communications, and maps the network. On a Saturday at 1 a.m., the ransomware deploys.
By Monday morning:
- EHR system locked.
- Scheduling system encrypted.
- Email inaccessible.
- External backup drive encrypted because it was connected to the network.
- Ransom demand: $85,000 in Bitcoin.
Costs incurred:
- Forensic incident response: $45,000.
- Legal counsel: $38,000.
- Patient notification for 4,200 patients: $63,000.
- Credit monitoring services: $52,500.
- Business interruption for 12 days: $36,000.
- System rebuild and IT remediation: $28,000.
- OCR resolution agreement: $62,000.
- Cyber insurance deductible: $25,000.
- Total: $349,500.
Annual cost of the cheap security approach: $480.
Annual cost of the breach: $349,500.
Scenario B: Agency with Managed Cybersecurity
The same agency, same size, same phishing email, but with ShieldForce's managed cybersecurity deployed.
The advanced email security platform flags the Medicare portal impersonation based on domain analysis. The email is quarantined before it reaches the billing manager's inbox. No click. No credential theft. No breach.
Annual cost of managed security for 60 users at $35 per user per month: $25,200.
Annual cost of the breach: $0.
The Five Hidden Costs of Cheap Security
Hidden Cost 1: The HIPAA Documentation Gap
HIPAA requires documented evidence of a security program: risk analysis, written policies, training records, vulnerability scan results, and an incident response plan. These documents cost almost nothing to produce when a managed security provider generates them as part of their service. They cost $15,000-$40,000 in consultant fees when you need them urgently because OCR is investigating.