HIPAA Checklist for Home Care Agencies
A HIPAA checklist for home care agencies: risk analysis, policies, training, access, devices, BAAs, breach response, six-year records, with the rule for each.
By Caregiver Scheduling Team ·
If your home care agency is a HIPAA covered entity, usually because you bill Medicaid or insurers electronically, you need a documented risk analysis, written policies, workforce training, access controls, business associate agreements, a breach response plan, and six years of records proving it. Each item below names the rule that requires it. Not sure if HIPAA applies? Start with HIPAA for non-medical home care agencies.
Who is responsible for HIPAA at the agency?
A named privacy official and a named security official. In a small agency one person, often the owner, holds both roles.
| Item | Rule |
|---|---|
| ☐ Privacy official named and documented | 45 CFR 164.530(a) |
| ☐ Security official named and documented | 45 CFR 164.308(a)(2) |
| ☐ Written privacy and security policies | 45 CFR 164.530(i) and 164.316(a) |
| ☐ Notice of Privacy Practices given to clients and posted on your website | 45 CFR 164.520 |
| ☐ Sanctions policy for staff who break the rules | 45 CFR 164.530(e) and 164.308(a)(1)(ii)(C) |
How often do you need a HIPAA risk analysis?
Do one before you start, repeat it after any major change, and review it at least yearly. The Security Rule requires an “accurate and thorough” risk analysis plus a plan to fix what it finds (45 CFR 164.308(a)(1)). It sets no interval, so yearly is the common standard.
| Item | Rule |
|---|---|
| ☐ Written risk analysis listing where client information is stored, sent and accessed | 164.308(a)(1)(ii)(A) |
| ☐ Risk management plan with owners and dates | 164.308(a)(1)(ii)(B) |
| ☐ Data backup and disaster recovery plan | 164.308(a)(7) |
ONC’s free Security Risk Assessment Tool walks you through the questions.
What does HIPAA require for caregivers and office staff?
Training at hire and after any material policy change, access limited to each person’s own clients, and access removed the day someone leaves.
| Item | Rule |
|---|---|
| ☐ Privacy training for every new hire within a reasonable time, with sign-in records | 45 CFR 164.530(b) |
| ☐ Security awareness training and periodic reminders | 164.308(a)(5) |
| ☐ Caregivers see only their own clients (“minimum necessary”) | 45 CFR 164.502(b) |
| ☐ Each user has a unique login, no shared accounts | 45 CFR 164.312(a)(2)(i) |
| ☐ Termination procedure removes access when employment ends | 164.308(a)(3)(ii)(C) |
Yearly refreshers are not spelled out in the rule, but they are the easiest way to prove training happened.
What are the device and messaging rules?
Client information belongs in an encrypted app behind a passcode, not in group texts or personal email.
| Item | Rule |
|---|---|
| ☐ Passcodes and auto-lock on every phone and computer used for work | 45 CFR 164.310(b) and (c) |
| ☐ Encryption on laptops and in the apps you use | 164.312(a)(2)(iv) and (e)(2)(ii) |
| ☐ Lost or stolen device procedure | 164.310(d) |
Encryption is “addressable”: use it, or document why an equivalent measure is reasonable. If caregivers dictate visit notes, see AI caregiver notes and HIPAA.
Which vendors need a business associate agreement?
Every vendor that creates, receives, stores or sends client health information for you: scheduling and EVV software, billing services, cloud storage, answering services and shredders. Required contract terms are in 45 CFR 164.504(e).
| Item | Rule |
|---|---|
| ☐ Signed BAA with every vendor that handles client information | 164.308(b) and 164.504(e) |
| ☐ List of vendors with BAA dates | 164.316(b) |
| ☐ Process for clients to get copies of their records within 30 days | 45 CFR 164.524(b) |
| ☐ Signed authorization before sharing with family members where required | 164.508 |
What do you have to do after a breach?
Notify each affected client without unreasonable delay and within 60 calendar days of discovery (45 CFR 164.404). Breaches of 500 or more people go to HHS at the same time. Smaller ones go in a log and are reported to HHS within 60 days after year end (45 CFR 164.408).
| Item | Rule |
|---|---|
| ☐ Written breach response plan | 164.308(a)(6) |
| ☐ Breach log, including small incidents | 164.408(c) |
| ☐ Client notice letters within 60 days, in plain language | 164.404(b) and (c) |
How long do you keep HIPAA records?
Six years from the date a document was created or was last in effect, whichever is later. The Privacy Rule (164.530(j)(2)) and the Security Rule (164.316(b)(2)(i)) both set this period. It covers policies, training records, risk analyses, BAAs and sanctions. State rules for client files may run longer. See home care record retention, and put review dates on your compliance calendar.
What are the most common HIPAA gaps in home care?
Group texts about clients. Shared logins. Former caregivers still in the app. Paper care plans left in cars. No BAA with the scheduling vendor.
How Caregiver Scheduling handles this
Client information stays in the app instead of text threads. Caregivers see only their own visits, the office controls roles and removes access in one step, messaging is built in, and every change lands in an audit log. Data is encrypted in transit and at rest. $199/month for up to 10 caregivers or $299/month for up to 50, free for 30 days.
FAQ
Does a small home care agency need a HIPAA risk analysis? If it is a covered entity, yes. The rule has no small-business exemption.
How often is HIPAA training required? At hire and after any material policy change. Yearly refreshers are standard practice.
Do I need a BAA with my scheduling software? Yes, if it stores client health information and you are a covered entity.
How long do I keep HIPAA documents? Six years from creation or from when the document was last in effect.
This article is general information, not legal advice. Check your state’s privacy and record rules.