Compliance
Skilled nursing and home health are HIPAA covered entities; assisted living often handles PHI too. What senior-care operators must protect, the proposed Security Rule changes, and the controls that keep residents and revenue safe.
If your organization provides skilled nursing, home health, or hospice care, you are a HIPAA covered entity and the Security Rule already applies to you. Assisted living and independent living communities are covered when they provide and electronically bill for health services — and even when they're not the covered entity themselves, they handle residents' protected health information (PHI) and operate under business-associate agreements. Either way, safeguarding resident data isn't optional. This guide covers what's required, what's changing, and the controls that actually protect residents and revenue.
The line trips up a lot of operators, so be precise about it. Under HHS rules, a health-care provider is a HIPAA covered entity when it transmits health information electronically in connection with a standard transaction — billing, for example (HHS: Covered Entities).
The practical takeaway: if resident PHI flows through your community, the obligation to protect it reaches you — as a covered entity, a business associate, or both.
The Security Rule requires administrative, physical, and technical safeguards for electronic PHI (HHS: Security Rule). The load-bearing pieces for a senior-care operator:
The HHS Office for Civil Rights proposed an update to the HIPAA Security Rule that would make several long-recommended controls explicitly mandatory — including multi-factor authentication, encryption of ePHI, and regular vulnerability scanning. It was announced Dec 27, 2024 and published in the Federal Register on Jan 6, 2025 (HHS; Federal Register); the comment period closed March 7, 2025, and it is not finalized as of publication — so don't treat the specifics as settled law. But the direction is unmistakable: the "addressable" wiggle room around MFA and encryption is closing. Treat MFA, encryption, and tested backups as the floor now, and you're ahead of the final text either way.
Three forces converge. The data is valuable — full health and identity records on a vulnerable population. Care can't pause — an EHR outage during a med pass is a patient-safety event, which is exactly the leverage ransomware crews want. And many communities run lean IT. Healthcare has carried the highest average data-breach cost of any sector for 14 consecutive years — $7.42M per breach in IBM's 2025 report (IBM Cost of a Data Breach) — and ransomware showed up in 48% of breaches in Verizon's 2026 DBIR (Verizon DBIR).
There's a second exposure unique to this vertical: residents are prime targets for financial fraud. The FBI's IC3 Elder Fraud Report tracked $4.885 billion in losses reported by Americans over 60 in 2024 (FBI IC3). A breach of resident data feeds directly into that pipeline — which is part of the duty of care, not just an IT metric.
Mapped to what the Security Rule expects and what carriers ask for:
Start with the HIPAA risk analysis, because it both satisfies the rule and tells you where the gaps are. The Cyber Insurance Readiness Sprint runs that analysis and produces the documentation HHS and cyber carriers expect — in a fixed-scope, seven-business-day engagement. See the Senior Care security page for how the program runs across a community or agency.
Skilled nursing, home health, and hospice are HIPAA covered entities; assisted living handles PHI and signs BAAs even when it isn't. The Security Rule already requires a risk analysis, access controls, incident response, and contingency planning — and the proposed 2025 update is about to make MFA and encryption explicit. Put detection on every endpoint and the EHR, turn on MFA, keep tested backups, and train the staff. In senior care, a breach isn't just a fine — it's a safety event for the people in your care.
Need to prove HIPAA readiness for your community? Book a senior-care security assessment.
Last updated
June 17, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
It depends on what the community does. Skilled nursing facilities, home health agencies, and hospices are HIPAA covered entities because they provide health care and bill electronically. Assisted living and independent living communities are covered when they provide and electronically bill for health services. Even when a community isn't itself the covered entity, it routinely handles residents' protected health information and sits under business-associate agreements with the providers it works with — so the safeguarding obligation reaches it either way.
The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic protected health information — including a risk analysis, access controls, audit controls, and a plan to detect and respond to security incidents. In practice that means knowing where resident PHI lives, controlling who can reach it, monitoring for intrusions, and being able to recover from ransomware without losing records.
The HHS Office for Civil Rights published a proposed update to the HIPAA Security Rule in early 2025 that would make several long-recommended controls explicitly mandatory — such as multi-factor authentication, encryption, and regular vulnerability scanning. It is a proposed rule, not yet final, but it signals where enforcement expectations are heading. Senior-care operators should treat MFA, encryption, and tested backups as the floor regardless of the final text.
Resident health records are valuable, care can't pause during an outage, and many communities run lean IT — a combination attackers favor. A ransomware hit that locks the EHR or medication records is a patient-safety event, not just an IT problem, which raises the pressure to pay. That's exactly why detection, response, and tested recovery matter most here.
Related reading
No — HIPAA doesn't cover pets, and there's no federal law requiring vets to safeguard animal health records. But veterinary practices still run on payment data and cloud software that ransomware loves. The real risk, and what to do about it.
Read articleWhat dental cyber insurance actually covers in 2026, the underwriting questionnaire controls carriers review, and how to pass the application without overspending.
Read articleA plain-English guide to using the free HHS and ASTP/ONC Security Risk Assessment Tool for HIPAA Security Rule work, including what the tool does well, where small practices get stuck, and when outside help is worth it.
Read article