How to Structure your Home-Based Care agencies Google Workspace Environment to Protect Patient Data, Reduce Security Risk, and Stay HIPAA Compliant
Most home-based care agencies rely on Google Workspace every single day. Caregivers document visits, coordinators share schedules, billing staff manage financial records, and leadership tracks operational data, all through shared drives, Gmail, and collaborative documents. But what happens when that environment is not organized, properly secured, or regularly audited?
The short answer is that things get messy fast. Files end up in the wrong places. The wrong people have access to sensitive records. Former employees sometimes retain login credentials long after their last day. And for agencies handling protected health information (PHI), those gaps can have serious compliance and cybersecurity consequences.
This is not a technology problem that only large organizations face. It happens across home health, home hospice, and home care agencies of all sizes. The good news is that Google Workspace already includes the tools needed to create a well-organized, appropriately secured environment. What most agencies lack is a clear structure and the discipline to maintain it over time.
Why Google Workspace Organization Matters More Than Most Agencies Realize
When files and folders are disorganized, the ripple effects go beyond the frustration of not being able to find a document. In a home-based care environment, disorganization can slow down care coordination at critical moments, create duplicate records that lead to errors, and make compliance audits far more difficult than they need to be.
Some of the most common problems we see in agencies without a structured Google Workspace setup include:
- Client care plans, financial records, and HR files stored in individual employees’ My Drive accounts instead of shared organizational drives, meaning the agency loses access if that employee leaves
- Files shared using “Anyone with the link” settings, exposing sensitive documents to anyone who receives or forwards the URL
- No standardized folder naming conventions, forcing staff to search through dozens of folders to locate a document they need immediately
- Former employees or contractors who still have active Google accounts weeks or months after their departure
- Overly broad permissions where most staff can view, edit, or delete files they should not have access to at all
Each of these issues creates real risk. And for agencies governed by HIPAA, uncontrolled access to electronic protected health information (ePHI) is not just an operational inconvenience. It can constitute a Security Rule violation with financial and reputational consequences.
Shared Drives vs. My Drive: Why the Distinction Matters
One of the most important structural decisions any home-based care agency can make in Google Workspace is choosing to store organizational files in Shared Drives rather than individual employees’ My Drive folders.
The difference is significant. Files stored in My Drive are owned by the individual user. If that employee leaves the organization and their account is deleted or suspended, the agency can lose access to years of documentation, client records, and operational files. Shared Drives, by contrast, are owned by the organization. Files remain accessible regardless of employee turnover.
For home-based care agencies managing caregiver schedules, client documentation, billing records, and clinical notes, keeping organizational files in Shared Drives is a foundational step toward better data control and continuity.
Building a Folder Structure That Works Across Your Agency
Once files are housed in Shared Drives, the next step is creating a folder structure that is consistent, logical, and easy for staff to navigate without needing to guess where something belongs.
Effective folder structures in home-based care agencies typically organize content by function rather than by employee name or date. Common top-level categories include client records, clinical documentation, billing and financial records, HR and personnel files, operations, and leadership or compliance. Within each category, subfolders follow a consistent naming convention that staff can learn quickly and apply uniformly.
Naming conventions matter as much as structure. A folder called “Client Files 2024” provides far less clarity than one called “Client Records – Active” or “Client Records – Discharged 2024.” When everyone on the team uses the same naming approach, documents become findable, auditable, and far less likely to be duplicated or misfiled.
Access Control and the Principle of Least Privilege for Home-Based Care
A well-organized folder structure only reduces risk if access is assigned thoughtfully. One of the most effective principles for managing permissions in any healthcare environment is least privilege: staff should have access only to what they need to perform their specific role, nothing more.
In practice, this means a caregiver does not need access to HR files. A billing coordinator does not need access to clinical notes beyond what is required for billing purposes. And administrative staff who support scheduling should not have visibility into financial records.
Google Workspace makes this manageable through Google Groups. Rather than adding individual users to each Shared Drive or folder, agencies can create role-based groups such as caregivers, schedulers, billing, clinical, and leadership, and assign permissions at the group level. When a new employee is hired into a role, they are added to the apropriate group and inherit the correct access automatically. When they leave, removing them from the group revokes access across all associated resources at once.
Sensitive folders containing financial records, HR files, or ePHI should be restricted to a limited group of authorized users with explicit access, rather than inheriting broad permissions from a parent folder.
“Roughly half of the home-based care agencies who come to us have their Google Workspace setup incorrectly. Between confusing folder structures, inaccurate permissions, intermingling of personal and business Google accounts, and lack of clean-up this incorrect setup has a significant negative effect on the agency. Fortunately, by taking the time to correctly setup and regularly review their Google Workspace we see home care, home health, and home hospice agencies drastically improve their efficiency and provide better care.”
Brendan Duebner, President, IT Total Care
External Sharing Settings: A Risk Most Home-Based Care Agencies Overlook
Google Workspace’s default sharing settings allow users to share files and folders with people outside the organization. For a home-based care agency handling PHI and sensitive business data, those defaults present a real risk if left unaddressed.
Common external sharing risks include:
- Files set to “Anyone with the link can view” being forwarded outside intended recipients
- Shared Drive content being shared with personal Gmail accounts or outside vendors without oversight
- No visibility into what has been shared externally or with whom
Through the Google Workspace Admin Console, administrators can restrict external sharing for Shared Drives containing sensitive content, disable “Anyone with the link” settings organization-wide or by specific drives, and enable audit logging to track file access and sharing changes over time. These controls are not turned on by default, which means they require deliberate configuration.
Permission Audits: Why They Need to Be a Recurring Process
Even the best initial setup drifts over time. Employees change roles. Contractors complete projects and move on. Departments reorganize. Without a structured review process, access levels that were appropriate six months ago may no longer reflect the current team or current needs.
Permission audits are the mechanism for catching that drift before it becomes a security or compliance problem. A well-run audit reviews active user accounts, verifies that access levels still match current roles, and revokes any permissions that are no longer needed.
For home-based care agencies, permission audits should be conducted at minimum on a quarterly or biannual basis. They should also be triggered by significant events, such as a staff departure, a role change, or a departmental restructuring. Designating a specific person or team responsible for conducting and documenting these reviews is essential. Without clear ownership, audits tend to get deprioritized when operations get busy.
From a HIPAA and cyber insurance perspective, documented permission audits demonstrate that your agency is actively managing access to sensitive information rather than simply hoping nothing goes wrong. As cyber insurance applications increasingly ask about access control practices, having a documentted audit process can directly affect your coverage options and premiums.
Offboarding and Immediate Access Revocation
One of the most consistent security gaps we observe in home-based care agencies is the lag between an employee’s last day and the revocation of their system access. In some cases, accounts remain active for weeks. In others, access is never fully removed.
Every Google Workspace offboarding should include immediate suspension of the departing employee’s account, transfer of their Google Drive files to an appropriate owner within the organization, review and removal of any direct permissions they held on Shared Drives or individual folders, and removal from all Google Groups to eliminate inherited access.
Connecting the offboarding process to Google Workspace access management is not just a best practice. For agencies handling ePHI, it is a compliance requirement. A structured process that includes IT in every offboarding ensures nothing is overlooked, regardless of how quickly or unexpectedly a departure occurs.
How IT Total Care Helps Home-Based Care Agencies Get This Right
IT Total Care works with home-based care agencies throughout the San Francisco Bay Area to design, implement, and maintain Google Workspace environments built for security, compliance, and operational clarity.
Our approach includes:
- Designing a standardized, role-based Shared Drive structure tailored to your agency’s workflow and team structure
- Configuring Google Groups aligned to job roles so permissions are easy to manage, assign, and revoke
- Applying least-privilege access controls so staff only see what they need for their specific role
- Locking down sensitive folders containing financial, HR, and ePHI records with restricted, auditable access
- Configuring Google Workspace Admin Console settings including external sharing restrictions and audit logging
- Conducting scheduled permission audits and removing outdated or unnecessary access on your behalf
- Ensuring Google Workspace access is revoked immediately as part of every coordinated offboarding
- Documenting your folder structure and permission policies so the system stays organized as your team grows
A well-configured Google Workspace environment is one of the most practical things a home-based care agency can invest in. It makes staff more productive, reduces compliance exposure, and gives leadership visibility into how sensitive data is being accessed and managed.
Ready to Secure and Organize Your Google Workspace Environment?
IT Total Care helps home-based care agencies throughout the San Francisco Bay Area build secure, well-organized Google Workspace environments that support HIPAA compliance, protect patient data, and reduce operational risk. If your agency is ready to take control of its Google Workspace setup, our team is here to help.
Contact Us today to schedule a conversation about your agency’s Google Workspace environment and IT needs.
