Do Home Care Agencies in Minnesota Need a HIPAA Security Officer?

If your agency creates, receives, maintains, or transmits any electronic protected health information (ePHI), the answer is yes — federal law requires it. Here's what that actually means and what your options look like.

What Is a HIPAA Security Officer?

Under 45 CFR 164.308(a)(2), every covered entity must designate a Security Officer responsible for developing and implementing security policies and procedures. This is not optional and it is not a role you can leave unfilled.

Who Counts as a Covered Entity in MN Home Care?

Any agency that creates, receives, maintains, or transmits electronic protected health information (ePHI) — including documentation in EHR systems like PointClickCare, scheduling software, and billing platforms. If a caregiver logs a visit on a phone, if a coordinator emails a care plan, if a biller submits a claim electronically — you are a covered entity.

What Does a Security Officer Actually Do?

•Conduct or oversee the Security Risk Assessment (required by HHS)
•Develop and maintain security policies
•Train workforce on security procedures
•Manage BAAs with all Business Associates
•Respond to security incidents

Full-Time vs. Fractional Security Officer

Full-time hire

$75,000–$110,000/year salary + benefits, hiring pipeline, ongoing management.

Right fit for large multi-site operators — overkill for a 5–30 person home care agency.

Outsourced fractional

$750–$1,500/month — same coverage, fraction of the cost.

Designed specifically for small MN home care agencies that need real compliance without an FTE.

How Arsi Tech Group Helps

We serve as the outsourced Security Officer for MN home care agencies — running the Security Risk Assessment on the official HHS OCR Tool, drafting and managing BAAs with your EHR and billing vendors, configuring Microsoft 365 / Azure / Intune to meet HIPAA technical safeguards, and staying on-call for incidents.