HIPAA Compliance for Home Care Agencies: The Complete 2026 Guide

HIPAA isn't just for hospitals. If your home care agency collects, stores, or transmits protected health information (PHI) — and you absolutely do — you're a covered entity subject to full HIPAA compliance.

I've seen agencies hit with five-figure fines for violations that could have been prevented with proper policies and a few hours of staff training. Let's make sure that doesn't happen to you.

What Is PHI in Home Care?

Protected Health Information includes any individually identifiable health information, such as:

  • Client names, addresses, dates of birth, Social Security numbers
  • Medical diagnoses, care plans, and treatment records
  • Billing records and insurance information
  • Visit notes, assessments, and physician orders
  • Photos, voice recordings, or any electronic health data

If your caregivers text about clients, store care plans on personal devices, or discuss client conditions in public — those are all potential HIPAA violations.

The Three HIPAA Rules You Must Follow

1. The Privacy Rule

Controls how PHI can be used and disclosed. Key requirements: - Provide a Notice of Privacy Practices (NPP) to every client at intake - Get written authorization before sharing PHI for non-routine purposes - Apply the minimum necessary standard — only access the PHI needed for the job - Allow clients to access their own records within 30 days of request - Designate a Privacy Officer responsible for policy implementation

2. The Security Rule

Protects electronic PHI (ePHI) with three types of safeguards:

Administrative Safeguards: - Conduct annual risk assessments - Implement workforce training on security procedures - Establish access management — who can access what data - Create contingency plans for data backup and disaster recovery

Physical Safeguards: - Secure workstations and devices containing ePHI - Control physical access to areas where ePHI is stored - Implement policies for device disposal (wipe drives before discarding)

Technical Safeguards: - Implement access controls (unique user IDs, passwords) - Use encryption for ePHI in transit and at rest - Maintain audit logs of who accesses ePHI - Implement automatic logoff on workstations

3. The Breach Notification Rule

If a breach of unsecured PHI occurs: - Notify affected individuals within 60 days - If 500+ people affected, notify HHS and local media within 60 days - If fewer than 500, report to HHS annually - Document the breach, investigation, and corrective actions

HIPAA Policies Your Agency Must Have

At minimum, your policy manual should include:

  1. Notice of Privacy Practices — template and distribution procedure
  2. Privacy Officer & Security Officer designations
  3. Staff training policy — HIPAA training at hire and annually, with documentation
  4. Business Associate Agreement (BAA) policy — every vendor touching PHI must sign a BAA
  5. Access control policy — who can access what PHI, and under what circumstances
  6. Breach notification policy — step-by-step response procedures
  7. Device and media management — rules for mobile devices, laptops, USB drives
  8. Secure communications policy — approved methods for transmitting PHI
  9. Record retention and disposal — how long to keep records, how to destroy them securely
  10. Risk assessment schedule and documentation

Common HIPAA Violations in Home Care

Violation Typical Fine
No risk assessment conducted $10,000–$50,000
Missing Business Associate Agreements $10,000–$50,000
No staff training documentation $1,000–$25,000
Texting PHI on personal phones without encryption $10,000–$50,000
Lost/stolen device with unencrypted ePHI $50,000–$1,500,000
Failing to provide access to records $10,000–$50,000
Improper disposal of records containing PHI $10,000–$50,000

Practical Steps to Get Compliant

  1. Appoint your Privacy and Security Officers — this can be the owner in a small agency
  2. Conduct a risk assessment — identify where PHI lives, how it's protected, and where gaps exist
  3. Draft your HIPAA policies — or use a professional template set
  4. Sign BAAs with every vendor — your EHR, billing company, cloud storage, shredding service, etc.
  5. Train all staff — document with sign-in sheets and keep records for 6 years
  6. Secure your systems — encryption, passwords, access controls, automatic logoff
  7. Create a breach response plan — know exactly what to do before a breach happens

Don't Go It Alone

HIPAA compliance is complex, but it doesn't have to be overwhelming. Our Agency in a Box package includes complete HIPAA policy manuals, risk assessment templates, BAA templates, and staff training materials — all customized to your state's requirements.

Book a Free Clarity Call to discuss your HIPAA compliance needs.

🎥 Watch our free training: Join our next live webinar to learn the exact steps to launch your home care agency.

🔗 More from the Home Care Agency Blueprint Network