Article
HIPAA security risk assessments, in plain English
The HIPAA Security Rule requires a risk assessment. Here is what it covers, how often to do it, and where small practices usually fall short.
- PROTECT
6 min ·
INDUSTRY / HOME HEALTH
Your caregivers should be with patients, not on hold with the office.
Every day, a scheduler is matching caregivers to visits, a caregiver is checking in from a client's living room, and someone in the office is chasing a visit note that never came in. Cyber6 helps you fill shifts faster, turn visits into paid claims sooner, and keep caregiver phones and patient records secure.
AUTOMATEPROTECTEMPOWER
5 min read
home health scheduler at a desk with a caregiver map and shift board on screen
Example
Today's shift board
- Open visits this morning3 unfilled(Needs attention)
- Caregiver matched and notified2 filled in 6 min(OK)
- EVV check-in missing1 flagged(Gap)
- Visit-to-billsame day(OK)
WE GET IT
We know what your week looks like
- 01
A caregiver calls in sick at 6 AM
The scheduler works the phone tree manually, calling caregivers one by one, while the client's morning visit gets later and later.
- 02
A visit gets missed
A caregiver's car breaks down and nobody in the office knows until the client's family calls, worried, hours later.
- 03
Electronic visit verification doesn't match
A caregiver forgets to check in through the EVV system, and now the visit can't be billed to Medicaid until someone fixes the record.
- 04
Documentation piles up
Visit notes get written from memory at the end of a long shift, days after the visit, when details have already faded.
- 05
Visit-to-bill takes weeks
A visit that happened on the 3rd doesn't get billed until the end of the month, because documentation, verification, and coding all wait on each other.
- 06
Caregivers use personal phones
Client names, addresses, and care notes live in text messages and photos on a caregiver's personal phone, with no way to remove them if the phone is lost.
- 07
Turnover resets everything
A new caregiver has to relearn a client's routine, medications, and preferences, and the client feels the disruption.
- 08
Clients and families call for updates
Family members want to know how a visit went and can't always reach anyone who has the answer that day.
THE IMPACT
What it's costing you
Revenue delayed by weeks
Every day between a visit and a paid claim is cash you've earned but don't have, while payroll and expenses don't wait.
Missed visits and their fallout
A missed visit isn't just lost revenue. It's a client who didn't get care, and a family that loses trust.
Staff hours on the phone tree
Hours spent calling caregivers one by one to fill a shift are hours not spent matching the right caregiver to the right client.
Compliance exposure from EVV gaps
Medicaid-funded visits that don't verify correctly can be denied or clawed back, and repeated gaps draw regulator attention.
Data exposure from personal devices
Client information sitting unprotected on a caregiver's personal phone is a breach waiting for a lost or stolen device.
COMPLIANCE
Rules you have to follow
HIPAA (Privacy, Security, and Breach Notification Rules)
- What it is
- The federal law protecting patient health information.
- Who it applies to
- Home health agencies handling patient records and billing.
- What it expects of you
- Safeguards for records wherever they're accessed, including in the field, staff training, and breach notification.
- How Cyber6 helps
- We run your HIPAA risk assessment covering field devices as well as the office, and put the safeguards in place.
Electronic visit verification (EVV)
- What it is
- A federal requirement, implemented by each state, that Medicaid-funded personal care and home health visits be verified electronically: who provided the service, where, and when.
- Who it applies to
- Agencies billing Medicaid for personal care or home health services.
- What it expects of you
- Accurate, timely check-ins and check-outs that match the billed visit.
- How Cyber6 helps
- We connect your scheduling and EVV systems so check-ins happen reliably and mismatches get caught before billing, not after a denial.
State home health licensing
- What it is
- State-level requirements for operating a home health or home care agency.
- Who it applies to
- Licensed home health and home care agencies.
- What it expects of you
- Documented policies, caregiver training records, and client records kept securely.
- How Cyber6 helps
- We help keep your documentation and records audit-ready. [OWNER: confirm which state licensing requirements apply across the states Cyber6 serves.]
This is general information, not legal advice.
THE FIX
How Cyber6 helps
AUTOMATE
Fill the gaps automatically
- Get found
The right customers find you on Google, AI search, and social, in your own voice.
- Get customers
Every call, text, form, and quote turns into booked work.
- Serve customers
Customers hear from you at the right time, without your team chasing them.
Client and caregiver updates
Families get a short update after each visit, and caregivers get schedule changes by text as soon as they happen.
- Get paid
Money you've already earned comes in sooner, without awkward phone calls.
- Run the business
Less retyping and waiting, more time for the work that matters.
Scheduling and shift-fill messaging
An open shift automatically texts qualified, available caregivers nearby, and the first to accept gets the visit.
Visit-to-bill
Verified visits move to billing automatically, and mismatches get flagged the same day instead of at month end.
PROTECT
Protect what you're trusted with
- 01
Mobile device management for caregiver phones
Agency-managed phones or a secure app on personal phones keeps client information in a separate, protected space from the caregiver's personal apps and photos.
What this means for you: Client names, addresses, and notes stay where they belong, not scattered across text threads.
- 02
Remote wipe for lost or stolen devices
If a caregiver's phone is lost, the client information on it can be removed remotely, without touching their personal data.
What this means for you: A lost phone in a parking lot doesn't have to become a reportable breach.
- 03
Individual logins with a second step
Every caregiver and office staff member has their own login to scheduling and EVV systems, protected with .
What this means for you: You can see who accessed what, and a stolen password isn't enough to get in.
- 04
HIPAA risk assessment covering field work
A risk review that accounts for how care is actually delivered, in homes and cars, not just at a desk.
What this means for you: Your safeguards match how your caregivers really work.
EMPOWER
Train the people doing the work
Field caregivers
Mobile-friendly caregiver training
Short, phone-friendly modules on protecting client information, spotting phishing texts, and what to do if a device is lost.
Schedulers and billing staff
Office staff training on scheduling and EVV
How to handle EVV exceptions quickly and correctly, and how to spot fraud attempts aimed at payroll or client billing.
A DAY WITH CYBER6
A day in your agency with Cyber6
6:15 AMAUTOMATE
A caregiver calls in sick. The system texts three qualified caregivers nearby, and one accepts within minutes.
10:00 AMAUTOMATE
An EVV check-in doesn't match the schedule. The office gets an alert and fixes it before the visit reaches billing.
1:30 PMPROTECT
A caregiver's phone is left in a rideshare. Client information on it is wiped remotely within the hour.
5:00 PMAUTOMATE
Families of today's clients get a short text update on how the visit went, sent automatically from the visit notes.
YOUR TOOLS
Systems we commonly see
- WellSky
- Axxess
- HHAeXchange
- AlayaCare
We work alongside the systems you already use. We'll confirm what connects during your assessment.
QUESTIONS
Questions from home health
No. It handles the first round of outreach so your scheduler spends time on the exceptions that actually need a person.
We work alongside the major platforms and confirm exactly what connects during the assessment.
If it's set up with our device protection, we can remove client information remotely without touching the caregiver's personal data.
Yes. We connect scheduling and EVV so mismatches get caught same-day, before they turn into billing denials.
The caregiver-facing pieces are text messages and simple check-ins. Training is short and mobile-friendly.
Yes. We can handle security and automation alongside them or take over fully.
Nothing. It's a free review of your scheduling gaps and caregiver device security, with a written summary of what to fix first.
RESOURCES
Learn more
ArticleBusiness continuity plan basics: keep working when systems go down
Learn how a business continuity plan helps your small business stay operational during a crisis, focusing on people, processes, and communication.
- PROTECT
- EMPOWER
6 min ·
ArticleThe Change Healthcare outage: what one missing login step cost
The 2024 Change Healthcare attack showed how a single missing security step can disrupt an entire industry for weeks.
- PROTECT
6 min ·
WHO WE'VE WORKED WITH
- A statewide cybersecurity assessment program
- Credit unions
- A water and wastewater utility
- Housing organizations
- Nonprofits and churches
- Small businesses
- A health and wellness startup
Every result is measured against your own starting point.
How we prove it →PART OF ONE PARTNER
One partner for all three.
Protect · IT & Cybersecurity
IT and cybersecurity, managed around the clock.
You're here
Empower · Training for Businesses & Individuals
Training that builds skills for your team and your career.
Explore Empower
WHY CYBER6
Why businesses choose Cyber6.
One partner, not three vendors
The people automating your work also run and protect your IT and train your team, so nothing falls between companies.
Plain language and real people
You talk to people who explain things clearly, answer the phone, and tell you what they'd do in your place.
Measured against your own numbers
We record where you start before anything changes, then report results against that baseline.
Marquis Carroll, Founder & CEO. Marquis has spent years doing hands-on IT and security work through his own business, and runs a mentorship program that has helped people start careers in tech.
Our storyGETTING STARTED
Four steps from first call to results.
Explore
A relaxed 30-minute conversation about how your business runs and what's getting in the way. No cost, no pressure.
You get: honest answers on whether we can help.
Assess
We look at your systems, security, manual work, and training needs, and record your starting numbers.
You get: a plain-English picture of your risks and opportunities.
Set up
A prioritized plan and proposal, then a kickoff that introduces your team and sets up access safely.
You get: a shared timeline and who to call for what.
Enable
We roll out in phases, train your team, and walk you through your first results.
You get: your first plain-English report, measured with PROVE.
Let's look at your agency together.
A 30-minute call. No cost, no pressure, and honest answers.