HIPAA applies to a home health agency that bills or checks eligibility electronically. That makes it a covered entity. In the field, that means encrypted devices and no patient details by regular text. Patients get a chance to object before staff talk with family. Aides get trained, and every vendor that handles patient data signs a Business Associate Agreement.
At 7:15 on a weekday morning a home health nurse loads a tablet, a printed route sheet with six names and six addresses, and a folder of signed orders into the passenger seat of a Honda. The Honda stops for coffee. The tablet stays on the seat. That car is now a branch office of a covered entity.
The HHS Office for Civil Rights (OCR) has priced this failure before. Its enforcement listing shows a $3 million settlement over a failure to encrypt mobile devices (November 2019) and a $1,040,000 settlement over an unencrypted stolen laptop (July 2020). Neither entity was a home health agency. The failure they paid for, protected health information on a device that left the building, is the one home health agencies live with every shift.
HIPAA for Home Health Agencies: Why the Rules Follow the Visit
The test is in the definitions at 45 CFR 160.103. A covered entity includes "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." The covered transactions are listed in the same section, and the first one on the list is "health care claims or equivalent encounter information."
Medicare requires home health agencies to send claims electronically. There are a few exceptions, such as an agency with fewer than 25 full-time-equivalent employees (42 CFR 424.32(d)). Sending a claim electronically is the transaction.
That makes the agency a covered entity, subject to the Privacy Rule, the Security Rule, and the Breach Notification Rule in full. Medicaid billing, Medicare Advantage billing, and electronic eligibility checks each trigger the same result on their own. A private-duty agency that is truly private-pay-only has to run the test honestly: one electronic claim, one electronic eligibility inquiry, or one electronic prior authorization request, and the agency is covered. More on the definition is in what is a covered entity under HIPAA.
One more definition matters here. 160.103 defines workforce as "employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid." A per-visit aide, a contract therapist, and a nurse placed by a staffing company are all workforce while the agency directs their work. The agency owns their training, their access, and their mistakes.
What P.H.I. Looks Like in Home Health
P.H.I. (Protected Health Information) is individually identifiable health information in any form: electronic, paper, or spoken. In a home health agency it lives in places a hospital never has to think about.
- OASIS assessments. The Outcome and Assessment Information Set is the standardized assessment Medicare-certified agencies complete and submit to CMS at start of care, resumption of care, follow-up, transfer, and discharge. CMS lists the OASIS-E2 instrument as effective April 1, 2026. Every OASIS is a dense P.H.I. record: diagnoses, functional status, medications, living situation, and caregiver details.
- Plans of care and physician orders. The plan of care, face-to-face documentation, and interim orders, which still arrive by fax and sit in a tray until someone scans them.
- Visit notes and wound photos. Point-of-care documentation, and wound photographs that end up in a clinician's personal camera roll when the agency app is slow.
- Electronic Visit Verification (EVV) records. Clock-in and clock-out data tied to a patient's home address, which state Medicaid programs require for Medicaid-funded home health and personal care visits. A patient's street address is one of the 18 identifiers, so an EVV log is P.H.I. even without a diagnosis attached.
- Route sheets and schedules. A printed daily schedule is a list of names, addresses, and visit types, and a breach waiting for a broken car window.
- The home folder. The aide care plan, medication list, and visit log kept in the patient's home, readable by anyone who opens it.
Common Violations in Home Health Settings
Unencrypted devices in vehicles. The two settlements above are the pattern: a device holding ePHI (electronic P.H.I.) leaves the office, is lost or stolen, and was not encrypted. Encryption is an Addressable specification under 45 CFR 164.312(a)(2)(iv). Under 164.306(d)(3), "addressable" means the agency must use it if it is reasonable and appropriate; if not, the agency must write down why and use an equal alternative if one is reasonable and appropriate. For a fleet of tablets that ride in cars, it is hard to name an equal alternative. Full-disk encryption plus remote wipe is the baseline, and the day-one response when a device goes missing is in the lost device incident guide.
Texting between aides and schedulers. "Mrs. R fell again, BP 88/50, going to ER" sent by standard SMS from a personal phone is a disclosure over an unsecured channel, stored on two carriers and two handsets the agency does not control. The rules and the workable alternatives are in the HIPAA texting guide.
The daughter in the kitchen. 45 CFR 164.510(b) permits disclosure to "a family member, other relative, or a close personal friend of the individual" of the information "directly relevant to such person's involvement with the individual's health care," when the patient agrees, does not object after being given the chance, or when the clinician "reasonably infers from the circumstances" that the patient does not object. The violation is skipping the chance to object: discussing the wound or the prognosis in front of whoever is home without asking the patient first.
Shared logins and dead accounts. Home health turnover is high, and access removal lags. 164.312(a)(2)(i) requires a unique user ID for every person, and 164.308(a)(3)(ii)(C) calls for procedures to terminate access when employment ends. An aide who left in March and can still open the scheduling app in June is an open door.
Missing Business Associate Agreements. The EVV vendor, the outsourced coder, the cloud fax service, and the tablet IT company are each a business associate under 160.103, and each needs a B.A.A. (Business Associate Agreement) before the first byte moves.
Building the Program
Start with a risk analysis that includes the cars. The Security Rule sets the bar:
Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.
For a home health agency, "accurate and thorough" means the analysis lists the tablets, the personal phones that run the EVV app, the home Wi-Fi networks clinicians connect through, and the paper that travels. An analysis that only covers the office server is not accurate. The method is in the risk assessment guide.
Write the field into the policies. The workstation use standard at 164.310(b) requires policies covering "the physical attributes of the surroundings of a specific workstation or class of workstation." The class of workstation here is "tablet in a vehicle or a patient's home." The device and media controls standard at 164.310(d) governs "the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility." The policy should say: encrypted device, carried in or locked in the trunk, never on a seat; no paper P.H.I. left in a vehicle overnight; wound photos only in the agency app; personal phones only with mobile device management installed. The remote-work version of the same rules is in HIPAA remote work rules.
Train the aide before the first visit. The Privacy Rule at 164.530(b)(2)(i)(B) requires training for each new workforce member "within a reasonable period of time after the person joins," and the Security Rule at 164.308(a)(5) requires a security awareness program for the whole workforce, "including management." For home health, training has to be concrete: what to say when a relative asks a question, where the route sheet goes, what to do in the first hour after a tablet disappears. Document who was trained, on what, and when, and keep that record for six years per 164.530(j)(2).
A Florida mental health franchise office I worked with had no written policies, half-done training, and a state auditor due in days. It was audit-ready in under a week and passed that audit.
Plan for the EHR being down in the field. 164.308(a)(7) requires a contingency plan with data backup, disaster recovery, and emergency mode operation plans. In home health, emergency mode means clinicians keep visiting while the system is unreachable, so downtime visit forms belong in every bag. The plan has five components, and all three Required ones have to be written down.
Vendor B.A.A. Checklist for Home Health Agencies
The business associate definition at 160.103 covers any person who, on the agency's behalf, "creates, receives, maintains, or transmits protected health information" for a regulated function, "including claims processing or administration ... billing, benefit management, practice management." The agency's obligation, under 164.308(b) and 164.502(e), is a written contract before the vendor touches P.H.I.
| Vendor category | Typical examples | B.A.A. required? |
|---|---|---|
| Agency management and EHR platform | Homecare Homebase, WellSky, Axxess, MatrixCare | Yes |
| EVV vendor | HHAeXchange, Sandata, or the EVV module inside the EHR | Yes for the agency's own EVV vendor. If the state Medicaid program supplies the EVV system, confirm the arrangement with the state program. |
| Outsourced coding, OASIS review, or billing | Any third-party coding or revenue cycle firm | Yes. Billing services are named in the definition. |
| Clearinghouse | The claims clearinghouse between the agency and payers | Yes. A covered entity may be a business associate of another covered entity (160.103). |
| Cloud fax and secure messaging | Any e-fax or clinician messaging service | Yes |
| IT managed services and device management | The MSP that images and manages the tablets | Yes |
| Answering service or after-hours triage line | Any service that takes patient calls for the agency | Yes |
| Shredding and record storage | Any document destruction or off-site storage company | Yes |
| Staffing agency | Nurse and aide staffing firms | Depends. A placed clinician under the agency's direct control is workforce. A firm is a business associate if it creates, receives, keeps, or sends P.H.I. for the agency, such as patient assignment records. Decide, then document. |
| Referring hospital, physician, DME supplier, pharmacy | Providers the agency exchanges information with for treatment | No. 160.103 excludes "a health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual." |
| Route or mileage app | Any navigation or mileage tracker | Only if patient names or addresses are entered into it. If so, yes, or stop entering them. |
The agreement itself must carry the terms in 164.504(e)(2) and 164.314(a)(2), including breach reporting and return or destruction of P.H.I. at termination.
In one single-location practice I worked with, several vendors handled P.H.I. with no B.A.A. We got every missing B.A.A. signed and set up a vendor review the practice can repeat.
The Proposed Security Rule Update (Proposed, Not Final)
HHS published a Notice of Proposed Rulemaking on January 6, 2025. It is proposed, not final, and OCR is not enforcing it. It would make encryption required, require multifactor authentication, and add a written asset inventory. Status: HIPAA Security Rule delayed to 2027.
Build the asset inventory now. An agency that cannot list every tablet and phone holding ePHI cannot do the risk analysis the current rule already requires.
FAQ
Are home health agencies covered entities under HIPAA?
Yes, if the agency transmits health information electronically in a covered transaction such as a claim. Medicare requires electronic claims, with a few exceptions (42 CFR 424.32(d)), so an agency that bills electronically is a covered entity under 45 CFR 160.103.
Can a home health nurse discuss the patient's condition with family members in the home?
Yes, within limits. 45 CFR 164.510(b) permits sharing information directly relevant to a family member's involvement in the patient's care, once the patient agrees or is given the chance to object.
Do home health aides need HIPAA training?
Yes. Aides are workforce members under 160.103. 164.530(b) requires training within a reasonable period after joining, documented and kept for six years, and 164.308(a)(5) requires security awareness training for the whole workforce.
Does a home health agency need a BAA with its EVV vendor?
Yes. An EVV vendor maintains patient names, addresses, and visit data on the agency's behalf, which makes it a business associate under 160.103. It needs a contract meeting 164.504(e) and 164.314(a) before it handles that data.
A home health agency does not need a hospital-sized program. It needs a risk analysis that includes the cars, a device rule everyone follows, and a vendor list with a signed B.A.A. behind every name. One Guy Consulting's Full-Scope plan includes a Security Risk Assessment tool, policy and procedure templates, staff training, and vendor management with digital B.A.A.s. It also includes 4 hours a month of 1:1 implementation calls with Chuck. Start with a free 30-minute intro call. No obligation, no pressure.
One Guy Consulting in 37 seconds
Sources
- 45 CFR 160.103 (definitions)
- 45 CFR 164.308 (administrative safeguards)
- 45 CFR 164.310 (physical safeguards)
- 45 CFR 164.312 (technical safeguards)
- 45 CFR 164.510 (family involvement)
- 45 CFR 164.530 (training, documentation)
- CMS: OASIS Data Sets
- HHS OCR: Resolution Agreements
- Federal Register: Security Rule NPRM
Related Reading
Try three One Guy Consulting 3D staff training courses free →