Surveyors, auditors, and insurers all want the same thing: proof your patient data is protected. Start building that proof today.
Take our free 3-minute audit to score your hospice's survey readiness, volunteer offboarding speed, and dark web monitoring coverage.
The rules are moving. CMS has begun its first overhaul of the hospice Conditions of Participation in 20 years, and HHS has proposed making controls like MFA and encryption mandatory under HIPAA. Agencies that document now won't be scrambling later.
Volunteer access is your biggest gap. Volunteers often keep access they no longer need, and removing it manually can take hours or days.
Dark web monitoring buys you time. Early warning when patient data appears online means faster breach response and less regulatory exposure.
The ShieldForce 6-Pillar Hospice Security Framework™
Built around what CMS surveyors and HIPAA auditors expect today, and what the proposed HIPAA Security Rule update would require, from the moment a volunteer is granted access to the moment they're offboarded.
Volunteer Access Control
Role-based access for volunteers with documented justification for each access level. Volunteers should never have admin or superuser privileges.
Automated Volunteer Offboarding
When a volunteer leaves, their access to the EHR, email, patient portal, and all clinical systems is revoked automatically within minutes.
24/7 Dark Web Patient Data Monitoring
Continuous monitoring of dark web marketplaces, forums, and paste sites for hospice patient names, medical record numbers, and sensitive healthcare data.
Distributed Staff Endpoint Security
Every device used by staff and volunteers — workstations, phones, tablets — is protected with endpoint detection and response (EDR) and antivirus.
CMS CoP Survey Readiness
Documentation of all cybersecurity controls, policies, incident response procedures, and staff training records organized for CMS surveyor review.
EHR-Agnostic Access Governance
Monitor and control access across all EHR platforms your hospice uses, not just one. Unified logging and access revocation across platforms.
Hospice CMS CoP & Dark Web Audit Defense Calculator
Eight questions covering volunteer offboarding, dark web monitoring, CMS documentation, and EHR governance. Takes about three minutes.
Ready to map your controls to CMS requirements? Download the 50-point CMS Hospice Cybersecurity Audit Matrix.
General Healthcare MSP vs. ShieldForce
A general healthcare MSP provides basic IT support. It doesn't understand volunteer workflows, dark web threats, or what CMS surveyors actually check for.
| General Healthcare MSP | ShieldForce Hospice Program | |
|---|---|---|
| Volunteer offboarding | Manual, hours to days | Automatic, under 15 minutes |
| Dark web monitoring for patient data | Not offered | 24/7 monitoring with alerts |
| CMS CoP documentation & evidence | Manual assembly at audit time | Continuously maintained & audit-ready |
| EHR platform access monitoring | Often limited to one platform | All platforms unified in one system |
| Incident response & breach notification | Manual process | Automated detection & notification |
Common questions
Does CMS require cybersecurity for hospices?
Not by name. The hospice Conditions of Participation (42 CFR Part 418) don't include a cybersecurity section. They do require that clinical records stay protected, accurate, and available, and that you maintain a tested emergency preparedness plan. A ransomware attack that locks your EHR puts both at risk. Separately, HIPAA already requires a documented risk analysis and security safeguards. HHS has also proposed a major HIPAA Security Rule update that would make MFA, encryption, and regular testing mandatory. It isn't final yet, but the direction is clear. ShieldForce keeps your controls and documentation continuously ready, so you're prepared however the rules land.
How does dark web monitoring protect hospice patient data?
ShieldForce monitors dark web marketplaces and forums for hospice-related credentials, patient names, and medical record fragments. When patient data appears, we notify you immediately so you can respond to the breach.
Can volunteers be automatically offboarded from all systems?
Yes. When a volunteer's status changes in your volunteer management system, ShieldForce automatically revokes their access to the EHR, email, patient portal, and other systems within minutes.
What documentation does a CMS surveyor actually look for?
Surveyors check for: written security policies, incident response procedures, staff training records, access logs, and evidence of ongoing monitoring and testing. ShieldForce maintains all of this continuously, not just at survey time.
Know where your hospice stands before your next survey, audit, or insurance renewal.
Get your compliance score, download the CMS CoP control mapping, and learn how ShieldForce closes your gaps.