Adult day centers can handle sensitive information throughout the participant day—from assessments and medication records to care plans, attendance, family updates, authorizations, and billing. But one point should come first: HIPAA does not automatically apply to every adult day center. Whether the HIPAA Rules apply depends on the organization's activities and whether it qualifies as a covered entity or business associate. This adult day care HIPAA compliance guide explains how to think about that question, what safeguards matter, when a Business Associate Agreement may be needed, and what to review when choosing software. This guide is educational and does not replace legal advice. Centers should also review applicable state, Medicaid, payer, licensing, and contractual requirements.
Does HIPAA Apply to Adult Day Care?
Not every adult day program is automatically subject to HIPAA simply because it serves older adults or people with disabilities. HIPAA applies to covered entities and business associates. According to HHS guidance on covered entities and business associates, a health care provider generally becomes a HIPAA covered entity when it electronically transmits health information in connection with a transaction for which HHS has adopted a standard, such as certain claims or eligibility transactions. That means an Adult Day Health Care provider that delivers health care and conducts covered electronic transactions may have different HIPAA obligations from a purely social adult day program.
- Determine whether the center furnishes, bills for, or receives payment for health care
- Review whether the center conducts HIPAA-standard electronic transactions
- Determine whether the center handles PHI on behalf of another covered entity
- Review Medicaid, managed-care, payer, and partner contracts for additional privacy obligations
Do not rely only on the program's name. Adult day care, Adult Day Health Care, and Social Adult Day Care programs can operate under different regulatory, clinical, and billing structures.
What Information Can Be PHI in an Adult Day Center?
Protected Health Information, or PHI, generally means individually identifiable health information protected by HIPAA when it is maintained or transmitted by a covered entity or business associate. Electronic PHI, or ePHI, is protected information maintained or transmitted electronically. In an adult day setting, potentially sensitive information can appear throughout daily operations.
| Adult Day Workflow | Information That May Be Involved |
|---|---|
| Enrollment | Participant details, emergency contacts, demographics, and health history |
| Assessment | Diagnoses, limitations, risks, functional needs, and care needs |
| Care planning | Goals, interventions, physician information, and service needs |
| Medication | Medication lists, doses, refusals, and MAR records |
| Attendance | Participant identity, dates of service, and service times |
| Family communication | Health, care, activity, or service updates |
| Billing | Member identifiers, service codes, units, dates, and claims |
For a broader breakdown of the records adult day programs commonly maintain, see our guide to adult day care documentation requirements.
Adult Day Care HIPAA Compliance Checklist
For organizations subject to HIPAA, an effective adult day care HIPAA checklist should connect regulatory requirements to the way information actually moves through the center. The goal is not simply to have policies on file—it is to make sure daily workflows support those policies.
1. Determine Your HIPAA Status
Document why your organization is—or is not—a HIPAA covered entity or business associate. Revisit that determination when services, billing arrangements, payer relationships, ownership, or technology change.
2. Identify Where PHI and ePHI Are Stored
Do not review only your primary software. Sensitive information may also exist on staff devices, email accounts, downloaded reports, shared drives, billing platforms, paper files, cloud storage, and vendor systems.
- Desktop and laptop computers
- Check-in tablets
- Staff phones
- Email accounts
- Cloud storage and shared drives
- Paper records and scanned documents
- Billing and claims platforms
- Downloaded spreadsheets and reports
- Backups and vendor systems
3. Conduct a Security Risk Analysis
The HIPAA Security Rule requires regulated entities to assess risks and vulnerabilities affecting ePHI. For an adult day center, practical risks may include shared accounts, unattended devices, former employees retaining access, excessive permissions, phishing, insecure downloads, weak authentication, or sensitive information sent through inappropriate channels. Risk analysis should be revisited when important systems, workflows, vendors, or threats change.
4. Control Workforce Access
Staff should have access appropriate to their responsibilities. A biller, nurse, activity coordinator, administrator, and front-desk employee may not need the same information. Individual user accounts and appropriate role-based permissions also make activity histories more useful when the center needs to determine who performed an action.
5. Train Staff and Protect Devices
Technology cannot compensate for weak workforce practices. Training should cover logging in and out, verifying recipients before sharing information, handling printouts, using personal devices, downloading records, responding to suspicious messages, and reporting potential incidents. Physical safeguards matter too: reception computers, nursing stations, tablets, printers, medication devices, and paper records should not unnecessarily expose sensitive information.
6. Use Appropriate Technical Safeguards
The HIPAA Security Rule addresses access controls, audit controls, integrity, authentication, and transmission security. When reviewing a system, ask whether each staff member can have an individual account, whether permissions can be limited, whether important actions are logged, how information is protected during transmission, and how former staff access is removed. If attendance is part of your compliance review, adult day care attendance software can help keep timestamps, staff attribution, and correction history together.
7. Prepare for Incidents and Downtime
Your center should know what happens if a device is lost, an account is compromised, someone opens a phishing email, a vendor experiences downtime, or information is sent to the wrong recipient. Security incident response, backups, disaster recovery, and contingency procedures should be established before a problem occurs.
When Does Adult Day Care Software Need a Business Associate Agreement?
A business associate agreement for adult day care software may be required when a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity. A BAA is different from a general privacy policy or a marketing statement that software is HIPAA compliant. HHS explains in its business associate guidance that business associate relationships require appropriate written arrangements defining permitted uses and disclosures, safeguards, incident responsibilities, and related obligations.
| Vendor Question | Why It Matters |
|---|---|
| Will you sign a BAA when required? | Establishes written responsibilities for PHI |
| What PHI do you handle? | Clarifies the vendor's role and data exposure |
| Which subcontractors may handle PHI? | PHI may flow beyond the primary vendor |
| How are security incidents reported? | Clarifies response and notification responsibilities |
| How are user permissions controlled? | Helps reduce unnecessary access |
| What activity is logged? | Supports accountability and investigation |
| How can we retrieve our data? | Supports continuity and vendor transition |
A BAA should be one part of vendor due diligence—not the entire evaluation. If you are comparing platforms more broadly, our guide on how to choose adult day care software covers the wider buying process.
HIPAA Security Rule for Adult Day Care
The current HIPAA Security Rule requires regulated entities to use reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI. These safeguards work together: strong software cannot solve a shared-password problem, while strong policies cannot protect information if staff regularly download records to unmanaged devices.
| Safeguard Type | Adult Day Center Example |
|---|---|
| Administrative | Risk analysis, policies, workforce training, access management, and incident procedures |
| Physical | Workstation security, protected paper records, device controls, and facility access |
| Technical | Access controls, audit controls, authentication, integrity protections, and transmission security |
Encryption and MFA: What Is Required in 2026?
Encryption
Under the current Security Rule, encryption is an addressable implementation specification. HHS explains in its encryption guidance that addressable does not mean optional without analysis. A regulated entity must determine whether encryption is reasonable and appropriate based on its risk assessment and document its decision. Modern platforms using encryption in transit and at rest can provide an important safeguard, but encryption is only one part of a broader security program.
Multi-Factor Authentication
The current Security Rule requires authentication safeguards. HHS has also proposed significant updates to the Security Rule, including broader multi-factor authentication requirements with limited exceptions. However, those changes remain proposed as of September 2026, and HHS states that the current Security Rule remains in effect during rulemaking. Centers should distinguish between current legal requirements and proposed HIPAA Security Rule changes while still considering modern security practices during vendor selection.
What Should You Check in Adult Day Care Software?
Do not stop at asking a vendor, "Are you HIPAA compliant?" Ask how the product supports your center's actual privacy and security responsibilities.
- A Business Associate Agreement when required
- Individual staff user accounts
- Role-based or appropriate access controls
- Strong authentication options
- Audit and activity history
- Record-integrity safeguards
- Encryption and secure transmission
- Backup and recovery procedures
- Timely user offboarding
- Incident-response procedures
- Clear data export and portability
- Appropriate subcontractor controls
A software vendor can support adult day care HIPAA compliance, but software does not make the center compliant by itself. The organization remains responsible for its own risk analysis, policies, workforce practices, access decisions, training, and other applicable obligations.
Common HIPAA Mistakes Adult Day Centers Should Avoid
- Assuming a software purchase makes the center HIPAA compliant
- Allowing multiple staff members to share one account
- Giving every employee the same level of access
- Leaving former employee accounts active
- Sending participant information without verifying the recipient
- Ignoring files downloaded from otherwise secure systems
- Treating a signed BAA as the entire compliance program
- Treating proposed HIPAA requirements as if they are already final
HIPAA may also overlap with Medicaid, licensing, payer, documentation, and state requirements. During a broader compliance review, use an adult day care audit checklist to evaluate the full record trail instead of assuming one compliance framework covers everything.
How Adult Day Genie Supports Secure Adult Day Care Workflows
Adult Day Genie is designed specifically for center-based adult day programs. The platform provides a HIPAA Business Associate Agreement with every center and uses safeguards including encryption in transit and at rest and access controls. Attendance, participant records, care documentation, medication records, authorized family updates, reports, and optional Medicaid billing can remain within one connected workflow rather than being spread across unrelated spreadsheets and systems.
These capabilities can support stronger privacy, security, documentation, and review-readiness practices. They do not replace each center's responsibility to determine which requirements apply, maintain appropriate policies, train its workforce, manage access, and address identified risks.
Adult Day Care HIPAA Compliance FAQs
Does HIPAA apply to every adult day care center?
No. HIPAA applies to covered entities and business associates. Whether an adult day center qualifies depends on its activities and relationships, including whether it is a health care provider conducting HIPAA-standard electronic transactions.
What are the main adult day care HIPAA requirements?
For regulated organizations, important requirements include protecting PHI and ePHI, conducting security risk analysis, managing workforce access, implementing appropriate safeguards, training staff, preparing for incidents, maintaining required documentation, and using BAAs when required.
Does adult day care software need a BAA?
A BAA may be required when the software vendor acts as a business associate by creating, receiving, maintaining, or transmitting PHI on behalf of a covered entity.
Is encryption required under HIPAA?
Under the current Security Rule, encryption is an addressable implementation specification. A regulated entity must evaluate whether encryption is reasonable and appropriate based on its risk analysis and document its decision.
Is MFA required by HIPAA in 2026?
The current Security Rule requires authentication safeguards. HHS has proposed broader MFA requirements with limited exceptions, but those changes remain proposed and the current Security Rule remains in effect.
Does HIPAA require medical records to be kept for six years?
No. HIPAA does not establish a general six-year medical-record retention period. Certain HIPAA compliance documentation must be retained for specified periods, while medical-record retention may be governed by other federal, state, payer, or program requirements.
Build Privacy and Security Into the Daily Workflow
Adult day care HIPAA compliance is easier to manage when privacy and security are part of normal operations rather than something reviewed only after a problem occurs. Determine whether HIPAA applies to your organization, identify where sensitive information lives, control access, review vendors and BAAs, train staff, and make sure important actions can be understood later.
If your center is still managing attendance, participant records, care documentation, medication records, family communication, and billing across disconnected tools, Adult Day Genie can show you how those workflows can work together in one adult-day-specific platform. See Adult Day Genie plans and book a walkthrough.