If you run a home care agency, you handle protected health information every day. Care plans, medication lists, visit notes, hospital discharge summaries, family contact details — all of it is PHI under HIPAA, and your obligation to protect it is real, audited, and increasingly expensive to get wrong.

The complication is that HIPAA compliance has become a vendor marketing buzzword. Every home care platform claims to be "HIPAA compliant." Most are partially right. Some are technically wrong. And the difference matters when the Office for Civil Rights shows up after a breach.

This post is the operator's guide we wish we'd had: what HIPAA actually requires of your agency, what your software needs to do (and not do), and the specific questions to ask a vendor before you sign.

What HIPAA Actually Requires of a Home Care Agency

Home care agencies are Covered Entities under HIPAA. That means you are directly responsible for the privacy and security of PHI you create, receive, transmit, or store. Your obligations fall into three rules:

The Privacy Rule — limits who can access PHI and for what purposes. Caregivers see what they need to deliver care. Schedulers see what they need to staff visits. Billing sees what they need to invoice. The principle is minimum necessary — every role gets the least access required to do its job.

The Security Rule — sets administrative, physical, and technical safeguards for electronic PHI. Encryption in transit and at rest. Access controls. Audit logs. Backup and disaster recovery. Workforce training. Incident response.

The Breach Notification Rule — if PHI is compromised, you have to notify affected individuals, HHS, and (depending on size) the media. The clock starts when the breach is discovered, not when it actually happened.

The good news: your software vendor can carry most of the technical burden. The hard truth: they can't carry the operational burden, and most of the actual fines come from operational failures.

What "HIPAA Compliant" Software Actually Means

A vendor calling their product "HIPAA compliant" should be able to back it with three things:

1. A signed Business Associate Agreement (BAA)

If a vendor processes PHI on your behalf, they're a Business Associate under HIPAA, and you are legally required to have a BAA in place before sending them any PHI. No BAA, no compliance — full stop.

This is where vendor marketing falls apart. Many platforms that advertise themselves as HIPAA-friendly only sign BAAs on their enterprise tier, often $5k–$25k+ per year above the published price. If you can't get a BAA in writing on the plan you're paying for, you can't legally use that vendor.

Ask before you commit: "Can you sign a BAA on this plan? Send me a draft." If the answer is "we'll need to talk to sales" or "that requires our enterprise tier," you have a problem.

2. Encryption in transit and at rest, with documentation

PHI moving between your caregiver's phone and your scheduling system has to be encrypted. PHI sitting in your vendor's database has to be encrypted. Your vendor should be able to tell you which TLS versions they support, what encryption they use for stored data, and where their key management lives.

If they answer with "we use industry-standard encryption" and can't say more, push harder. Vague answers from vendors usually mean vague answers from their auditors.

3. Access controls and audit logs you can actually use

Your agency needs to be able to answer: "Who accessed Mrs. Martinez's care plan in March?" Your software should be able to produce that report. If it can't, you're not audit-ready — which means you're not compliant.

Audit logs should capture: who, what, when, and from where. They should be tamper-evident. They should be retained for at least six years.

Where Vendors Oversell HIPAA Compliance

A few patterns to watch for:

"Hosted on HIPAA-compliant infrastructure" is not the same as compliant software. AWS, GCP, and Azure all offer HIPAA-eligible services under their BAAs. But their BAA covers their infrastructure, not whatever software your vendor built on top. A vendor running on GCP still has to sign their own BAA with you.

"SOC 2 Type II" is not HIPAA. SOC 2 is a useful audit framework. It's not the same as HIPAA. Many vendors lead with SOC 2 because it's the audit they already have; they may or may not have done the HIPAA-specific work.

"End-to-end encryption" is often inaccurate. True end-to-end encryption means even the vendor can't decrypt your data. Almost no SaaS platform actually does this — they need to decrypt to provide the product. What they usually mean is "encrypted in transit and at rest." Both are necessary; conflating them is misleading.

"HIPAA certified" doesn't exist. There is no government HIPAA certification. Any vendor claiming to be "HIPAA certified" is using marketing language that doesn't map to reality. Ask what audit they actually completed.

What Your Software Has to Do

Strip away the marketing and a HIPAA-fit home care platform should give you:

Capability	Why it matters
Signed BAA on your plan	Legally required before sending PHI
Role-based access (RBAC)	Enforces minimum necessary
Tamper-evident audit logs	Required for breach investigation and audits
Encryption in transit (TLS 1.2+) and at rest	Required by Security Rule technical safeguards
Automatic session timeouts	Reduces risk on shared devices
Multi-factor authentication for admins	Reduces credential-theft impact
Documented backup and recovery	Required by Security Rule contingency plan
Caregiver mobile app with secure auth	Field PHI protection
Data export on demand	Required for individual access requests under Privacy Rule

If a platform is missing one of these, you can probably work around it. If it's missing four or five, you're using the wrong platform.

The Operational Compliance Most Agencies Get Wrong

Most HIPAA fines come from operational failures, not software failures. The patterns we see most often in home care:

Lost or stolen unencrypted devices. A caregiver leaves their personal laptop with care notes in their car. The car is broken into. That's a breach. Solution: don't store PHI on personal devices; use a mobile app that keeps PHI server-side.

Email forwarding to personal accounts. A scheduler forwards a referral with PHI to their Gmail to read at home. That's a breach the moment it leaves your domain. Solution: training plus technical controls that block forwarding.

Verbal disclosure in inappropriate settings. Caregivers chatting about clients in coffee shops or with family members. HIPAA covers this too. Solution: training and a clear culture.

No incident response plan. Something goes wrong, and the agency owner figures it out as it happens. The 60-day breach notification clock is already running. Solution: a documented plan, drilled at least annually.

Workforce training that's a checkbox. "Watched a video and signed a form" doesn't equal training. Effective training is role-specific, repeated, and updated when your processes change.

The agencies that take HIPAA seriously treat it as an operational discipline, not a compliance theater exercise. The ones that don't usually find out the hard way.

A Realistic Compliance Stack for Independent Agencies

For an agency under ~50 caregivers, a realistic compliance stack looks like:

A purpose-built home care platform with a signed BAA — covers most of the technical safeguards out of the box
MDM or mobile policy for any field-issued devices
A documented Security Risk Analysis (required annually under the Security Rule)
A documented Incident Response Plan with named roles
Annual workforce training with role-specific content
A documented breach notification process
BAAs with every vendor that touches PHI — payroll, billing, telehealth, communications, accounting

Items 3, 4, and 6 are paperwork most small agencies don't have. They are also exactly what an OCR auditor will ask for first if you ever get a complaint. Get them done before you need them.

How to Ask Your Vendor the Right Questions

Before signing with any home care platform, ask:

"Can you sign a BAA on the plan I'm purchasing? Send me a draft today."
"What encryption do you use in transit and at rest? Specifics, not 'industry standard.'"
"What audit reports can you share? SOC 2? HITRUST? HIPAA gap analysis?"
"How are admin actions audited? Can I export those logs?"
"What happens to my data when I leave? Export format, retention period, deletion confirmation."
"Where is my data stored? Which sub-processors do you use?"
"What's your breach notification process to me, the customer?"

A vendor who can answer all seven precisely is taking compliance seriously. A vendor who pivots to marketing language on any of them is not.

Where Atlas Stands

We built Atlas Care Software with HIPAA in mind from the start. Specifics we're willing to put on paper:

Signed BAA on every paid plan, no enterprise upcharge
TLS 1.3 in transit, AES-256 at rest, key management via Google Cloud KMS
Tamper-evident audit logs with on-demand export
Identity Platform with MFA for admin accounts
All infrastructure on services covered by Google Cloud's BAA

We can't make your operational compliance happen for you — the Security Risk Analysis, the training, the incident response plan are still yours to own. But we can make sure the software layer doesn't become the weakest link.

If you want a copy of our BAA template before you commit, contact us — we'll send it the same day.

Atlas Care Software is built for HIPAA-aware home care agencies that want to spend their compliance energy on operations, not vendor wrangling.

HIPAA Compliance for Home Care Agencies — What You Actually Need vs What Vendors Will Sell You