Thornshield for Healthcare
Healthcare operations, secured and under control.
A practice dedicated to the security and compliance of health businesses, from home health and hospice to staffing agencies and clinics. We protect patient data, control your documentation, keep your workforce compliant and keep you ready for every survey.
What we help you achieve
Protected PHI
Safeguards for patient data on every device, system and vendor that touches it.
Complete documentation
Records that are current, signed, findable and defensible in an audit.
A cleared workforce
Every clinician licensed, screened and current before they see a patient.
Survey confidence
Evidence organized and programs operating, any day a surveyor arrives.
Who we serve
Built for health businesses
Especially those that deliver care outside a hospital, where patient data, documentation and staff are spread across homes, cars and devices.
Home Health Agencies
Medicare-certified agencies managing OASIS, plans of care, visit documentation and a mobile clinical workforce.
Hospice & Palliative Care
Interdisciplinary teams working in patients' homes under strict documentation and certification requirements.
Home Care & Personal Care
Private duty and Medicaid personal care providers subject to EVV, caregiver screening and state licensing.
Healthcare Staffing
Agencies placing clinicians who must prove current licenses, certifications and health records for every shift.
Clinics & Practices
Outpatient practices, therapy groups and specialty clinics handling PHI across EHRs, portals and devices.
Behavioral Health
Providers protecting highly sensitive records, including substance use treatment records covered by 42 CFR Part 2.
Why healthcare is different
Your operations are your compliance risk
In healthcare, security and compliance failures rarely start in the server room. They start in everyday operations: a lost tablet, an expired license, an unsigned order, a vendor nobody vetted.
PHI leaves the building every day
Clinicians document on tablets and phones in patients' homes, in cars and over home Wi-Fi networks.
Documentation drives everything
Late, missing or unsigned documentation puts reimbursement, survey results and patient care at risk.
Credentials expire constantly
Licenses, CPR cards, TB tests and competencies across a large workforce, each with its own expiration date.
Surveys arrive unannounced
State and accreditation surveyors expect current, organized evidence on the day they walk in.
Healthcare services
Security and control for every part of health operations
The rules you answer to
Regulations and standards we work with
Health businesses answer to several regulators at once. We map your obligations so nothing falls between them.
HIPAA Privacy, Security & Breach Notification Rules
Safeguards for protected health information, required risk analysis, business associate agreements and breach reporting.
Medicare Conditions of Participation
42 CFR Part 484 for home health and Part 418 for hospice, including clinical records, QAPI, personnel and patient rights.
OASIS Data Collection
Accurate, timely and well-supported OASIS assessments, which drive both quality reporting and reimbursement.
Electronic Visit Verification (EVV)
Required by the 21st Century Cures Act for Medicaid personal care and home health services, with state-specific rules.
Exclusion Screening
Checking staff and contractors against the OIG LEIE, SAM.gov and state Medicaid exclusion lists.
Accreditation Standards
ACHC, CHAP and The Joint Commission standards, plus state licensing surveys and complaint investigations.
HITECH & State Privacy Laws
Increased HIPAA penalties, state breach-notification laws and medical privacy statutes that go further than HIPAA.
42 CFR Part 2
Additional confidentiality protections for substance use disorder treatment records.
Why Thornshield
A partner that understands health operations
Built for Care in the Field
Recommendations that work for clinicians in patients' homes, not just for staff in an office.
Security and Compliance Together
HIPAA safeguards, Conditions of Participation and IT security handled as one program.
Business Associate Ready
When our work involves PHI, we sign a BAA and handle data under the safeguards it requires.
Automation That Saves Hours
Where compliance work is repetitive, we automate it so your team can focus on patients.
Healthcare organizations can also use our facility monitoring, face recognition and beacon solutions for patient and staff safety.
Know where your agency stands
Start with a HIPAA Security Risk Analysis or a mock survey. You'll get a clear picture of your risks and a prioritized plan to address them.