Many care companies have a small corporate team that works partly or fully from home: billing and accounts receivable, HR and payroll, compliance, regional clinical consultants, marketing and admissions support. These employees may never set foot in a nursing station, but they handle some of your most sensitive information, including resident records, insurance details and employee data.
A home office is not a locked building with a managed network. It is a spare bedroom with a router the employee bought years ago. A few clear standards can close most of the gap without turning your staff's homes into data centers.
Put the expectations in writing, keep it short and have employees acknowledge it. Cover who may work remotely, which devices are allowed, what data may be stored where, and what to do if something goes wrong. HIPAA's Security Rule expects covered entities and business associates to protect electronic protected health information wherever it is accessed, and workstation security and access control are part of that.
The best single decision is to issue company laptops and prohibit work on personal computers where sensitive data is involved. A managed device gives IT the ability to:
Enforce full-disk encryption, so a lost laptop is not a breach.
Install patches and security software automatically.
Require a strong sign-in and a screen lock.
Locate, lock or wipe the device if it is lost.
If personal devices must be used for a time, limit access to web-based tools, require multi-factor authentication and prohibit saving files locally.
Multi-factor authentication on email, the EHR and every system with sensitive data.
Unique passwords stored in a company-approved password manager.
No shared accounts, even between spouses or colleagues.
Automatic screen lock after a short period of inactivity.
You cannot manage an employee's home network, but you can set minimums.
Change the router's default administrator password.
Use WPA2 or WPA3 encryption with a strong Wi-Fi password.
Keep router firmware updated, and replace routers that the manufacturer no longer supports.
Keep work devices off guest or shared networks, and do not work from public Wi-Fi without a protected connection.
Consider a company-managed VPN or secure access service, where appropriate for the systems involved.
Some companies provide a standard, supported router or a stipend. That is optional, but it removes a great deal of guesswork.
Work in a private space where family members and visitors cannot see screens.
Lock the screen whenever leaving the desk.
Do not leave paper documents out. Use a locking drawer or cabinet for any printed records.
Avoid printing at home whenever possible. If printing is unavoidable, shred documents with a cross-cut shredder, or return them for secure disposal.
Be careful with calls, particularly when discussing residents. Smart speakers and voice assistants nearby may record conversations, so consider turning them off during work.
Store files in company-approved cloud storage, not on the desktop or in personal accounts.
Do not forward work email to personal accounts.
Do not use personal messaging apps for resident information.
Use encrypted email or a secure portal for sending sensitive files.
Disable or restrict USB storage on company laptops.
Remote staff are common targets for phishing, especially fake IT messages. Include them in regular training, and give them a simple way to report problems. A lost laptop, a clicked link or a suspicious call should be reported immediately, without fear of blame.
Remote employees need a way to reach IT and fast replacements for broken equipment. When someone leaves, collect devices promptly, disable accounts the same day and verify that no company data remains in personal storage.
Use device management tools to confirm encryption, updates and security software, rather than asking to inspect someone's home. Offer a brief self-assessment checklist each year covering router settings, workspace privacy and storage practices.
Your HIPAA security risk analysis should cover remote work: which staff, which data and which devices. Document your decisions, including any exceptions and the controls you put in place.
UnityCare IT helps care companies across Oklahoma, Texas and Arkansas set up managed laptops, multi-factor authentication and remote work policies that fit small corporate teams. If your remote staff are relying on personal computers or informal practices, we can help you move to a safer, supportable setup.
An outsourced IT department with proactive maintenance and one number to call.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172