The Complete Cybersecurity Guide for Nursing Homes and Skilled Nursing Facilities

This guide is written for nursing home administrators, compliance officers, and directors of nursing. It covers what HIPAA and CMS actually require, the specific risks that distinguish skilled nursing from other healthcare settings, and how to build a security program that works in a facility environment with connected medical devices.

Why Nursing Homes and SNFs Are a Cybersecurity Target

Nursing homes and skilled nursing facilities sit at the intersection of two trends that make them particularly attractive to cybercriminals: they hold a large volume of sensitive health data for a vulnerable population, and they operate a complex internal network that includes both traditional IT systems and a growing number of connected medical devices — nurse call systems, bed sensors, fall detection systems, infusion pumps, and patient monitoring equipment — that often lack enterprise-grade security controls.

The regulatory environment adds another dimension. Nursing homes operate under both HIPAA oversight and CMS Conditions of Participation. A cyber incident that disrupts operations can simultaneously trigger HIPAA's Breach Notification Rule and draw CMS survey scrutiny over facility management and resident care quality.

Five structural factors concentrate risk in nursing homes:

• Connected medical devices with minimal security. Nurse call systems, bed exit sensors, wandering detection, infusion pumps, and patient monitoring devices are often connected to the facility network but have no authentication requirements, no encryption, and no patch management. They are entry points for lateral movement attacks.
• Large volumes of highly sensitive data. Nursing home residents are among the most vulnerable healthcare patients. Their records include chronic disease management, cognitive assessment data, physical and occupational therapy records, behavioral health notes, and end-of-life care documentation — all ePHI requiring HIPAA protection.
• High staff turnover. Nursing homes experience some of the highest workforce turnover in healthcare. Frequent staff changes create access management challenges: accounts that are not promptly deprovisioned after termination are persistent vulnerabilities.
• Dual regulatory oversight. HIPAA and CMS both apply to nursing homes. A cyber incident that disrupts resident care can trigger both a HIPAA breach investigation and a CMS survey focused on whether the facility's systems were adequate to support safe care.
• Limited IT staffing. Most nursing homes do not have dedicated cybersecurity personnel. A single IT generalist may be responsible for EHR maintenance, device support, and network management across a multi-unit facility.

HIPAA and CMS Requirements for Nursing Homes

HIPAA Security Rule

The full HIPAA Security Rule applies to nursing homes as covered entities. Administrative safeguards require a documented security risk analysis, workforce training, formal access management procedures, and a tested incident response plan. Physical safeguards include workstation security policies, mobile device management, and facility access controls. Technical safeguards require unique user IDs for all staff, automatic logoff, audit logging of ePHI access, encryption, and emergency access procedures.

For nursing homes, the technical safeguard requiring integrity controls and audit logging carries particular weight when applied to medication administration records, which are both clinical safety documents and regulatory compliance records reviewed during CMS surveys.

CMS Conditions of Participation

CMS Conditions of Participation (42 CFR Part 483) require nursing facilities to maintain systems and infrastructure adequate to support safe resident care. While CMS does not have a standalone cybersecurity rule, surveyors assess whether the facility's operational systems — including IT — are adequate to support the care the facility is required to provide. A facility with a history of IT-related care disruptions or a known cybersecurity vulnerability that has not been addressed can receive citations under Facility Administration (F838-F842) or Environment (F920 series). CMS's broader Health and Human Services Cybersecurity framework also provides guidance that facilities are expected to demonstrate awareness of.

• Annual security risk analysis covering all systems and connected devices
• Network segmentation isolating IoT medical devices from clinical and admin systems
• Unique login credentials for all clinical and administrative staff
• Multi-factor authentication on EHR, email, and financial systems
• Formal access management: role-based permissions and prompt deprovisioning on termination
• Medication administration record access restricted to clinicians with direct care responsibility
• Audit logging of all ePHI access with regular review procedures
• Security awareness training for all workforce members with documented completion
• Written incident response plan covering both recovery and HIPAA breach notification
• Managed backup capable of restoring EHR and clinical records within hours
• BAAs signed with all vendors handling ePHI

IoT and Facility-Specific Cybersecurity Risks

The defining risk in nursing home cybersecurity is the connected medical device problem — and most general IT security vendors do not know how to address it.

IoT Medical Device Exposure

Modern nursing facilities connect dozens to hundreds of IoT devices to their internal network: nurse call systems, bed exit sensors, wandering detection systems, door access controls, infusion pumps, patient monitoring equipment, and environmental controls. These devices are designed for clinical function, not for security. They typically run older operating systems, receive infrequent security patches, have no authentication requirements, and cannot support endpoint security software. When they share a network segment with EHR workstations, a compromised IoT device becomes a direct entry point for lateral movement to clinical systems.

Network segmentation — creating separate network segments for IoT devices, clinical systems, and administrative systems, with firewall rules controlling traffic between them — is the foundational control. An attacker who compromises a nurse call controller on a segmented IoT network cannot reach the EHR on the clinical segment without traversing a firewall.

High-Turnover Access Management

Nursing homes experience among the highest workforce turnover rates in healthcare. Each departure creates an access management risk: if the terminated employee's accounts are not deprovisioned promptly across all systems — EHR, email, time and attendance, door access, facility management software — those credentials remain active indefinitely. Active credentials belonging to former employees are one of the most common entry points for healthcare data breaches. Nursing homes need a formal, checklist-based offboarding process that triggers immediate access deprovisioning across all systems the moment an employment relationship ends.

Medication Administration Record Integrity

Medication administration records (MARs) in nursing homes are both clinical safety documents and regulatory compliance records. They are reviewed during CMS surveys to verify that residents received prescribed medications at the correct doses and times. Unauthorized modifications to MAR data — whether for fraudulent billing purposes or through ransomware that corrupts clinical records — is simultaneously a HIPAA violation, a patient safety issue, and a CMS compliance failure. Access to MAR data must be restricted to clinicians with direct care responsibility, and all access and modification must be logged.

Shared Workstation Security

Nursing facilities typically operate shared workstations at nursing stations, in medication rooms, and at other clinical points — multiple staff members log in and out of the same physical computer throughout a shift. Shared workstations create audit logging problems when staff share credentials (which is both common and prohibited under HIPAA), and create malware exposure when any user visits an unsafe site or opens a malicious email. Each workstation must require unique individual credentials, must enforce automatic logoff after a defined period of inactivity, and must run endpoint protection software.

The Facility IoT & EHR Isolation Architecture™

ShieldForce applies its Facility IoT & EHR Isolation Architecture™ to nursing homes and skilled nursing facilities. This is the only ShieldForce framework specifically designed for a fixed-facility environment with connected medical devices, and it addresses the network architecture challenge that general IT security vendors typically overlook.

The Facility IoT & EHR Isolation Architecture™ covers four areas of specific focus for nursing homes:

Network Segmentation and IoT Isolation

ShieldForce assesses the facility's current network architecture and implements segmentation that creates separate network zones for IoT medical devices, clinical systems (EHR workstations and related clinical applications), administrative systems, and resident Wi-Fi. Firewall rules between zones are configured on a least-privilege basis: traffic flows only where it is operationally required, and all cross-segment traffic is logged for monitoring. IoT devices on the isolated segment cannot initiate connections to clinical or administrative systems.

Access Management and Termination Workflow

A formal, documented access management program with role-based permissions that limit each staff member's access to the systems and data their role actually requires. A termination checklist ensures that all accounts — EHR, email, facility management, door access — are deprovisioned immediately when an employment relationship ends. Access reviews are conducted quarterly to identify and remediate accounts with inappropriate permissions or that belong to staff who have left.

Shared Workstation Security

Endpoint protection software on all clinical and administrative workstations. Unique credential enforcement with automatic logoff policies. Email security controls applied to all workstations that have access to email, with phishing simulation and training for clinical staff who are not typically targeted by phishing training programs.

EHR-Aligned Audit Logging

Audit logging configuration aligned with the specific nursing home EHR platform in use — PointClickCare, MatrixCare, Netsmart, or others — to capture all ePHI access events at the individual user level. MAR access and modification events are logged separately and reviewed regularly. Audit log review is conducted on a defined schedule and anomalous access patterns generate alerts for investigation.

How to Choose a Cybersecurity Vendor for Your Nursing Home

1. Do they understand IoT device isolation? Ask specifically how they approach network segmentation for medical devices. A vendor who cannot explain VLAN segmentation and firewall rules between IoT and clinical network segments has never solved the core nursing home security problem.
2. Can they work with your specific EHR? Nursing home EHR platforms — PointClickCare, MatrixCare, Netsmart, American HealthTech — have specific access control and audit logging configurations. Ask whether the vendor has deployed security controls alongside your EHR platform specifically.
3. Do they have a formal termination workflow? High staff turnover is the nursing home norm. Ask how the vendor handles access deprovisioning when staff leave, and whether it integrates with your HR or payroll system.
4. Are they familiar with CMS survey requirements? A vendor who only knows HIPAA cannot help you document your cybersecurity program in terms a CMS surveyor will recognize. Ask whether they have experience with nursing facilities and CMS compliance documentation.
5. Will they sign a Business Associate Agreement? Any vendor with access to systems that contain resident ePHI must sign a BAA. Non-negotiable under HIPAA.

Frequently Asked Questions

About the Author