HIPAA rules for deceased hospice patients do not end when the patient dies. Under 45 CFR 164.502(f), a hospice must keep protecting a decedent’s protected health information for 50 years following the date of death, and during those 50 years only…
Does HIPAA Apply to Home Care Agencies?
Whether HIPAA applies to home care agencies is decided by a two-part test, and most published guidance only runs the first half of it. That matters because the answer changes what an agency has to document, who can enforce against it,…
How to Meet California’s 30-Day Breach Notification Deadline
At 4:40 on a Friday afternoon, an office coordinator at a home care agency in the East Bay opens the shared drive to pull the weekend’s care plans and finds every file renamed. She calls the owner, who calls the person…
Cybersecurity for Home Care Agencies: What the Law Requires Even Without HIPAA
Cybersecurity for home care agencies is governed by California law and private contracts far more often than it is governed by HIPAA. Most private-pay agencies are not HIPAA covered entities, and a great deal of published guidance stops at that sentence….
Caregiver Technology Adoption in Home Care: What Actually Works in the Field
Home care agencies have no shortage of technology pitched to them. Scheduling platforms, AI-driven caregiver matching, remote monitoring, telehealth integrations, wearable sensors – the vendor list grows every year, and so does the marketing promising that the right app will solve…
Can You Outsource the HIPAA Security Officer Role to Your IT Provider?
Can you outsource the HIPAA security officer role along with the rest of your technology? It is the question that produces the longest pause when a surveyor asks a home health administrator to name the agency’s Security Official. Agencies that handed…
How to Build a HIPAA Shared Responsibility Matrix With Your IT Provider
A HIPAA shared responsibility matrix answers a question most home health agencies cannot answer on the spot: who owns each compliance function, the agency or the IT provider. Ask an administrator who approves the risk analysis and you will usually get…
Outsourcing HIPAA Compliance for Home Health Agencies: What You Can’t Hand Over
Outsourcing HIPAA compliance for home health agencies moves the work of compliance, not the accountability for it. An IT provider can implement the safeguards, run the monitoring, and produce the evidence. Your agency still answers for the decisions underneath all of…
Is a Stolen Encrypted Laptop a Reportable HIPAA Breach?
Is a stolen encrypted laptop a reportable HIPAA breach? Usually not under federal law, and that answer holds only if the agency can prove three specific things about the device after it is already gone. For a California home health agency…
How to Report a Medical Information Breach to CDPH in 15 Business Days
This guide explains why reporting a medical information breach to CDPH matters for a California licensed agency, how to work through the filing step by step on your own, and how IT Total Care builds the detection and evidence the filing…