Does HIPAA apply to a home care agency?

Whether an agency is a covered entity depends on the services it provides and how it bills, and that determination is worth getting from counsel rather than assuming either way.

The practical exposure is similar regardless. A home care agency holds health information, addresses, schedules showing when a client is alone, and frequently financial and identity information about a population that is a preferred target for fraud. Notification obligations under HIPAA are triggered by a breach itself rather than by any resulting harm, so the cost arrives whether or not anyone is defrauded, and it scales with record count.

Two things to check on a cyber policy beyond the headline limit: whether business interruption covers the loss when a scheduling or records system is unavailable, and whether vendor and business associate exposure is covered, since most healthcare breaches originate with a third party.