HIPAA for Non-Medical Home Care Agencies: Does It Apply to You?

HIPAA applies to a non-medical home care agency if it is a health care provider that sends health information electronically in a standard transaction, such as an electronic Medicaid or insurance claim. That makes it a covered entity (45 CFR 160.103; HHS: covered entities). An agency that only bills families directly and never sends electronic claims is likely not a covered entity. Either way, client care information needs protecting under state privacy laws and your contracts.

Are you a covered entity?

Probably yes if you bill Medicaid or an insurer electronically, and probably not if you only invoice families. The definition turns on how the claim travels, not on whether you give medical care. A “health care provider” includes anyone who “furnishes, bills, or is paid for health care in the normal course of business,” and a provider becomes a covered entity by transmitting health information electronically in a covered transaction (45 CFR 160.103).

When in doubt, ask a healthcare attorney. Many agencies add Medicaid or VA clients later, so run HIPAA-ready practices from the start. See how to become a Medicaid home care provider.

What must covered agencies do?

Four things: follow the Privacy Rule, the Security Rule and the Breach Notification Rule, and sign agreements with vendors that touch client data.

Privacy Rule. Use and share client health information only for treatment, payment and health care operations, or with the client’s written authorization. Make “reasonable efforts to limit protected health information to the minimum necessary” for each use (45 CFR 164.502). Give clients a Notice of Privacy Practices.

Security Rule. Run and document a risk analysis, put safeguards in place to reduce the risks you find, train the whole workforce, review activity logs, apply sanctions for violations, and cut off access when someone leaves (45 CFR 164.308; HHS Security Rule). For a small agency the risk analysis is usually a few pages: where client data lives, who can reach it, and what could go wrong.

Breach Notification Rule. After a breach of unsecured health information, notify each affected client in writing “without unreasonable delay and in no case later than 60 calendar days after discovery” (45 CFR 164.404). Every breach is reported to HHS, and one involving more than 500 residents of a state also requires media notice (45 CFR 164.406).

Business associate agreements. Sign a BAA with every vendor that creates, stores or sends client health information for you: scheduling software, billing services, cloud storage, an answering service.

What if you are not a covered entity?

You still have duties, just not under HIPAA. State home care licensing rules usually require client confidentiality and a written client rights statement. State privacy and data breach laws apply to names, addresses and health details whatever your billing model. Your client service agreement promises confidentiality too. And if you subcontract to a covered home health agency or health plan, you are likely a business associate and bound by HIPAA through your contract.

The practical answer is the same: run the checklist below. It costs little and makes a later move into Medicaid painless. See the HIPAA checklist for home care.

Where do home care agencies leak information?

Phones, mostly. The common failures are small and daily, not hackers.

• Group texts with client names, addresses and conditions.
• Personal email for care notes or schedules.
• Paper care logs left in cars.
• Caregivers’ phones with no passcode, holding client photos or notes.
• Former caregivers who still have access to schedules or apps.
• Dictated notes in consumer voice apps that keep recordings. See AI caregiver notes and HIPAA.

What should every agency do?

Seven steps, whether or not HIPAA applies today.

1. Keep client information in one secure system, not in texts and spreadsheets.
2. Give caregivers access only to their own clients.
3. Turn off access the day a caregiver leaves.
4. Require a passcode on any phone used for work.
5. Train caregivers at hire and once a year on what they can share and with whom.
6. Get a BAA from software vendors that store client data.
7. Write down what to do if a phone is lost or a message goes to the wrong person.

How Caregiver Scheduling handles this

Client information stays in the app, so schedules and notes don’t need to go through text messages. Caregivers see their own visits, and the office controls roles and access. Messaging between the office and caregivers is built in. Every change is written to an audit log. Data is encrypted in transit and at rest. $199/month for up to 10 caregivers or $299/month for up to 50, free for 30 days.

FAQ

Is a non-medical home care agency a HIPAA covered entity? Only if it sends health information electronically in a standard transaction, like electronic claims. Private-pay-only agencies usually aren’t.

Do caregivers need HIPAA training? At covered agencies, yes. Workforce training is required by the Security Rule. At other agencies it is still good practice.

Can caregivers text the office about clients? Use a secure messaging tool rather than regular SMS, and limit details to what is needed for the visit.

How fast do I have to report a breach? Within 60 days of discovery, and sooner if practical. State breach laws may set shorter deadlines.

This article is general information, not legal advice. Check your state’s privacy and licensing rules.