Whether HIPAA applies to home care agencies is decided by a two-part test, and most published guidance only runs the first half of it. That matters because the answer changes what an agency has to document, who can enforce against it, and what happens after an incident. Below are the questions San Francisco Bay Area agencies ask most often about HIPAA coverage, answered against the regulation rather than against the general impression that anyone handling health information is covered.
1. Does HIPAA Apply to Home Care Agencies?
For most private-pay home care agencies, HIPAA does not apply. Coverage turns on whether the agency transmits health information electronically in connection with a HIPAA standard transaction, not on whether it handles health information at all. An agency can hold detailed client health records and still sit entirely outside HIPAA.
The reason is narrower than most guidance states. Becoming a covered entity requires clearing two separate questions, and the second one is where private-pay agencies fall out. Competitor content tends to answer the first question, find that the agency qualifies, and stop.
2. Is a Home Care Agency a Health Care Provider Under HIPAA?
Most home care agencies are health care providers under HIPAA’s definition, and this is the question agencies usually clear. “Health care” at 45 CFR 160.103 reaches care, services, and supplies related to an individual’s health, explicitly including maintenance care and any service or assessment concerning a person’s functional status.
Assistance with bathing, dressing, transfers, ambulation, and meal preparation fits that definition comfortably. Being a health care provider is not the same as being a covered entity, though, and that distinction is the whole substance of the question. The transaction test decides, and it is the test most published guidance skips.
3. What Counts as a HIPAA Standard Transaction?
Standard transactions are a defined list, not a general category of electronic activity. HHS has adopted formatting standards for a specific set of administrative and financial exchanges, and only those exchanges count toward coverage. An agency that never conducts one of them electronically does not meet the transaction prong.
The transactions for which HHS has adopted standards include:
- Health care claims or equivalent encounter information
- Eligibility inquiries and responses
- Health care claim status inquiries and responses
- Health care payment and remittance advice
- Enrollment and disenrollment in a health plan
- Health plan premium payments
- Referral certification and authorization
One qualifying transaction is enough. There is no volume threshold and no grace period. A single electronic eligibility inquiry makes the agency a covered entity from that point forward, and coverage then applies to all of the agency’s protected health information rather than only to the data in that one transaction.
4. Does Emailing a Physician’s Office Make a Home Care Agency a Covered Entity?
No. Emailing a physician’s office, a hospital discharge planner, or a family member is not a HIPAA standard transaction. HHS states directly that using electronic technology such as email does not by itself make a health care provider a covered entity, because the transmission has to be made in connection with a standard transaction.
This is where agencies are most often talked into the wrong conclusion. Sending care coordination notes electronically every day of the week does not create coverage. Submitting one electronic eligibility inquiry does. The technology is not the test.
5. Does Using a Billing Service or Clearinghouse Avoid HIPAA Coverage?
No. A billing service or clearinghouse that submits standard transactions electronically on your behalf still counts. HIPAA treats the transaction as the agency’s own when it is conducted on the agency’s behalf, so outsourcing the billing function does not move an agency outside coverage. The rule applies whether the provider transmits directly or uses a third party.
There is one boundary worth knowing. Where a downstream transaction is not conducted on the agency’s behalf, it does not pull the agency in. That makes the question to put to a billing vendor a specific one: are you submitting standard transactions on our behalf, and which ones.
6. Does Billing Medi-Cal or a Managed Care Plan Change the Answer?
Yes. Billing Medi-Cal or a Medi-Cal managed care plan electronically flips the answer for a previously private-pay agency. A single electronic claim or eligibility inquiry satisfies the transaction prong, and from that point the agency is a covered entity with the full set of HIPAA obligations attached to all of its protected health information.
In practice the change usually happens before anyone discusses it. An administrator at a Bay Area agency signs a Community Supports contract with a managed care plan, engages a billing service to handle submissions, and the agency’s coverage status changes somewhere in that sequence without a conversation.
Re-run the test whenever the agency adds a payer, a service line, or a billing vendor. Write the conclusion down with the date and the reasoning behind it. A determination nobody recorded is a determination the agency will have to make again, usually under pressure.
7. What Changes If an Agency Adds Home Health or Hospice Services?
Adding a Medicare-certified home health or hospice line makes the agency a covered entity for that line. Those services bill Medicare electronically, which satisfies the transaction prong outright, and the agency then holds ePHI, meaning electronic protected health information, inside platforms such as Axxess, WellSky, Homecare Homebase, KanTime, or MatrixCare.
Different rules, different liability, and a different regulator. IBM’s Cost of a Data Breach Report 2026, released July 29, 2026, put the average healthcare breach at $6.64 million, the highest of any sector studied. That figure describes healthcare as a whole rather than a forty-caregiver agency, and no small agency will see a loss at that scale, but it indicates the category of exposure a covered-entity line moves an organization into.
8. Can a Contract Pull a Non-Covered Home Care Agency Into HIPAA?
Yes. The business associate path runs independently of the covered entity test and arrives by contract rather than by license type or billing behavior. An agency that never conducts a standard transaction can still take on direct HIPAA obligations by signing a business associate agreement with a home health agency, hospice, or hospital.
Once that agreement is signed, its obligations are enforceable against the agency whether or not it would otherwise be covered. The document does the work, which is why it should be read before signature rather than after an incident. Our breakdown of HIPAA business associate agreements and what OCR actually enforces covers what those agreements commit a signer to.
9. If HIPAA Does Not Apply to Home Care Agencies, What Does?
California law does. The most common and most expensive error is concluding that HIPAA does not apply and stopping there, never reaching Civil Code section 1798.82 or section 1798.81.5. Both reach any business that holds personal information about a California resident, with no small-business exemption and no industry carve-out.
What applies to a non-covered home care agency in California:
- Section 1798.82 requires notice to affected California residents within 30 calendar days of discovering a breach, and medical information counts as a triggering data element when paired with a client’s name. See our guide on how to meet California’s 30-day breach notification deadline.
- Section 1798.81.5 requires reasonable security procedures and practices appropriate to the information held, and it operates before anything goes wrong rather than after.
- Contract terms from payers, referral partners, and franchisors commonly add multi-factor authentication, encryption, and incident reporting requirements that no statute would have imposed.
For the full picture of what reaches an agency and where the risk actually sits, see our overview of cybersecurity for home care agencies.
10. What Can an IT Partner Do About HIPAA Coverage, and What Can It Not?
An IT partner supplies controls, detection, and evidence. It cannot supply the legal determinations. A MSP cannot decide whether HIPAA reaches your agency and cannot make the breach determination that starts a notification clock. Agencies should expect an IT partner to help support compliance, not to hold it.
Five questions separate a provider who understands this landscape from one who will treat a home care agency like a medical practice:
- Do you understand that we may not be a HIPAA covered entity and still have California obligations?
- Can you give us a defensible discovery timestamp and a scope reconstruction inside 30 days?
- Will you read our payer and referral contracts for the security terms they impose?
- How do you enforce controls on caregiver-owned phones?
- Do you work with home care agencies specifically, or with medical practices generally?
“Nine times out of ten, when a new client asks us whether HIPAA applies, nobody has actually run the test. What they have is a memory of something a consultant said years ago before the last 10 major changes were made. From our experience the answer is usually no. But the useful part is having a partner who writes down why, with a date on it, so the next person who asks does not have to start over.”
Brendan Duebner, President of IT Total Care
Still Not Sure Whether HIPAA Applies to Your Home Care Agency?
IT Total Care works with home care, home health, and home hospice agencies across the Bay Area, and the agencies we meet are rarely wrong about HIPAA. They are usually just missing the part that comes after it: the California obligations, the contract terms already signed, and the evidence an incident would require. Learn more about our approach to healthcare IT.
Contact Us to talk through what your agency needs.
