Security for Home Care: protecting clinical data where the perimeter does not exist

Why home care is a target unlike any other healthcare sector

A hospital has walls. It has a network perimeter, a locked data center, a team concentrated in the same building and an IT team that sees every connected machine. Home-based care is the opposite of that. Clinical data is born in the living room of an elderly patient's home, is typed on a tablet resting on an improvised hospital bed, travels in a car through city traffic and only then reaches the center. The perimeter, in home care, simply does not exist — it has dissolved into dozens or hundreds of devices scattered across the city, each one carrying a piece of the medical record of the most vulnerable patients there are.

This characteristic completely changes the risk calculation. In the traditional model, you protect the center and trust that the data stays there. In home care, the data is permanently at the edge, in motion, in the hands of nursing professionals and caregivers whose priority — rightly so — is the patient, not the cyber hygiene of the device. The tablet that records the evolution of a wound or the administration of a controlled medication is the same one that can be stolen in a car break-in, forgotten at a diner or lent to the employee's child to watch a video.

Add to this a commercial reality: the health operators that contract home-based care services are increasingly demanding about the security maturity of their providers. A leaked incident does not just mean an ANPD sanction and reputational damage — it means losing contracts that sustain the entire operation. Security, in home care, has stopped being a cost and has become a condition of commercial eligibility.

The real attack surface of a home care operation

To defend home care, you first need to see the attack surface as an attacker sees it — not as an organizational chart, but as a map of doors. It is distributed across four connected fronts: the field devices, the collection application, the operations center and the people. Each front has its own typical flaws, and most real incidents are born at the intersection between them.

Field devices and the collection application

Tablets and phones outside the perimeter accumulate risks: absence of encryption or a PIN, an outdated operating system, personal apps alongside the clinical app, connection to untrusted Wi-Fi networks and the physical risk of loss or theft. The collection app worsens the picture because, in order to operate offline, it caches data locally — and that is where the problems live: cache in plaintext, without expiration, persistent after logout. On the server, poorly protected APIs allow broken authorization (BOLA), in which changing an identifier returns another patient's medical record.

The operations center and the people

The center consolidates medical records, schedules and billing; a ransomware attack here does not leak data, it stops the operation — and we are talking about patients in continuous care. Exposed servers, nonexistent segmentation, untested backups and access without MFA are the invitation. The distributed team, which rarely sets foot in an office and communicates through messaging apps, is the ideal phishing target: fake schedule notices, fake app updates, fake HR announcements. Without MFA and without training, a single stolen credential opens the door to the backend.

Compromise of mobile devices: the number one vector

If there were a single risk to prioritize in home care, it would be the compromise of mobile devices in the field. Not because it is the most sophisticated, but because it is the most frequent, the most mundane and the one that most easily escapes management's radar. A tablet does not need to be hacked by a criminal group to become a leak — a car break-in, a bag theft or forgetfulness is enough. The attacker, in this case, is opportunity.

The defense against this vector is almost entirely preventive and revolves around one question: when this device leaves my control, what does it deliver? If the answer is intact disk encryption, a strong PIN that resists attempts, an encrypted clinical cache and the ability to trigger a remote wipe before someone breaks the lock screen, then a lost device is a hardware loss, not a data incident. If the answer is an unlocked device with medical records in an open cache, it is a crisis.

This is where mobile device management (MDM/EMM) comes in as non-negotiable infrastructure. It gives the company what it does not have today: a live inventory of each device, automatic enforcement of encryption and lock policies, controlled distribution of the clinical app, detection of rooted/jailbroken or outdated devices, and the remote wipe button that turns a theft into a footnote. In BYOD scenarios, containerization isolates the corporate environment from the personal one, allowing only company data to be wiped.

Leakage of medical records and geolocation: the harm the LGPD punishes heavily

Not every leaked piece of data weighs the same. The LGPD classifies health data as sensitive personal data (art. 11), which raises the standard of care required and the size of the liability when something goes wrong. In home care, the leak combines two especially delicate ingredients: the patient's clinical condition and their geolocation. Together, they reveal not just that someone is ill — they reveal where this vulnerable person lives, at what times they are alone and when they receive visits. It is information that protects or exposes a life.

That is why the processing of geolocation in home care requires discipline. The LGPD's minimization principle asks that only what is necessary for the purpose be collected. Confirming that the visit occurred at the right address is legitimate; maintaining a continuous and perpetual tracking of patients' and professionals' location creates an enormous liability that, if leaked, would expose entire routines. High-risk processing like this calls for a Data Protection Impact Assessment (RIPD) that documents the necessity and the safeguards.

When the leak happens, article 48 of the LGPD comes into play: incidents that may cause relevant risk or harm to the data subjects must be reported to the ANPD and to those affected. The difference between a controlled notification and a crisis lies in the ability to delimit the scope precisely and demonstrate diligence. It is the difference between telling the ANPD that 14 specific medical records leaked, contained in less than an hour, with clear controls, and saying that you do not know what leaked or how many patients were affected.

Ransomware in the center: when stopping the system means stopping the care

The three previous risks deal with confidentiality — data that leaks. Ransomware in the operations center attacks availability, and in home care this has a particular ethical weight. When the center is encrypted, it is not just a system that stops: it is the visit schedule that disappears, it is the medical record that becomes inaccessible at the very moment the nurse needs to know the correct dosage, it is the continuous care of fragile patients that is interrupted. Availability, here, is patient safety.

Modern ransomware groups operate in double extortion: first they exfiltrate the data, then they encrypt the systems, and they charge both for the decryption key and for the promise not to publish the stolen medical records. A health operator dealing with the sensitive data of hundreds of patients is a high-value target: the pressure to pay is immense because both the operation and the reputation are held hostage.

The defense against ransomware in the center is a combination of resilience and detection. Resilience: network segmentation so that an infection at one point does not spread, hardening of the medical-record servers, the least-privilege principle in access, and the tested immutable backup. Detection: the SOC 24x7 that perceives lateral movement and mass encryption in the first minutes, triggers the response and isolates the machines before the damage is complete.

How Decripte works: from the free assessment to complete shielding

Decripte's approach to home care is deliberately sequential and self-service: first you see the problem without spending anything, then you decide what to shield. It all starts with the free Threat Management assessment at decripte.com.br/intelligence-center, which maps the external exposure of your operation — employees' credentials leaked in public breaches, assets and systems exposed on the internet, an attack surface you may not have known you had. It is the initial X-ray, at no cost and no commitment.

With the assessment in hand, the structuring advances on the sector's critical points. Decripte assesses the exposure of the field devices, deploys mobile device management (MDM/EMM) with encryption, remote wipe and inventory, and submits the home collection app to a security assessment in the OWASP MASVS and API Security standard — looking exactly at insecure cache, broken authorization and authentication flaws. It is the central angle: home care loses tablets with patient data, and Decripte closes that door.

On top of this foundation, continuous monitoring comes in with the SOC 24x7, observing access to medical records, credential use, fleet compliance and signs of ransomware in the center, without interruption. And when something slips through — because no defense is perfect — Incident Response takes over with a containment SLA of one hour or less, containing the damage and delimiting the scope. In parallel, the Compliance program organizes the house from the perspective of the LGPD in healthcare, from mapping flows to the notification plan.

LGPD compliance in home-based care: turning an obligation into an advantage

For a home care operator, LGPD compliance has stopped being an abstract legal exercise and has become a market prerequisite. Health operators, plans and the patient themselves expect evidence that the provider handles sensitive data seriously. The good news is that data protection maturity, well built, becomes a commercial differentiator — the argument that wins the contract against a competitor that still keeps medical records in an uncontrolled spreadsheet.

Decripte structures compliance from what actually happens in the operation. It maps the flows of sensitive data — where the medical record is born, where it travels, where it rests and who accesses it. It defines the adequate legal basis for the processing of health data under article 11. It establishes retention and disposal policies so that data does not accumulate indefinitely. It handles geolocation with the care it requires, including an RIPD. And it assembles the incident response plan that satisfies article 48 before it is needed.

It is worth being precise about what the LGPD actually requires, without inventing numbers or rigid deadlines where the law does not set them. Article 48 speaks of communication within a reasonable timeframe, regulated by the ANPD, and not a fixed number in the text itself. What it requires clearly is the communication of incidents with relevant risk, the qualified processing of sensitive data and accountability. The correct posture is to be prepared to notify with a precise scope and demonstrable diligence, which is exactly what Decripte's incident response delivers.

Anatomy of a real case: the stolen tablet that almost became a national crisis

How Decripte responds to an incident in home care

Decripte's incident response combines the physical world (lost device) and the digital (leakage, ransomware) in a single flow, with a containment SLA of one hour or less. These are the typical steps when a home-based care operation activates us.

1. Activation and immediate triage: the response channel receives the alert (reported theft, SOC alert, suspected leak) and classifies the severity in minutes, mobilizing the right team.
2. Containment within 1 hour: remote wipe of the affected device, revocation of the logged-in credentials, session expiration and isolation of the endpoint or the compromised machine from the backend.
3. Investigation and scope delimitation: log analysis to determine exactly which data was exposed, how many data subjects were affected and whether there was exfiltration from the backend or only from the local device.
4. Eradication of the root causes: removal of the attacker's access, closing of the breach (insecure cache, weak credential, vulnerable API) and correction of the configuration that allowed the incident.
5. Recovery of the operation: restoration from intact backups when there is ransomware, revalidation of the device fleet and return to care without interruption of patient care.
6. Support for regulatory notification: production of the technical report that grounds the communication to the ANPD and the data subjects in accordance with article 48 of the LGPD, demonstrating diligence and containment.
7. Post-incident and shielding: complete report, lessons learned, deployment or reinforcement of MDM, SOC and controls, and creation of a runbook for future activation by the team itself.
8. Continuous monitoring: integration of the learning into the SOC 24x7 to detect the next attempt through the same vector earlier.

How Decripte structures the security of a home care operation

Responding to incidents is necessary, but the goal is to avoid them. Decripte structures the security of home-based care into pillars that cover the endpoint outside the perimeter, the app, the center and the human factor — turning a distributed and exposed operation into a managed and monitored fleet.

Recommended plans for Home Care and Home-Based Care

Frequently asked questions

Sector terms

MDM / EMM

Mobile Device Management / Enterprise Mobility Management. Set of technologies to manage the fleet of corporate mobile devices: mandatory encryption, PIN, remote wipe, inventory, app distribution and separation between work and personal space in BYOD scenarios.

Selective remote wipe

Command that remotely erases only the corporate data and apps of a lost, stolen or departed-employee device, without touching the user's personal data. A central measure to contain leakage on field endpoints.

BOLA (Broken Object Level Authorization)

Flaw listed in the OWASP API Security Top 10 in which the server trusts the identifier sent by the client without verifying whether the user has the right to access that object. In home care, it would allow a professional to pull the medical record of a patient outside their caseload by changing IDs.

Sensitive personal data

LGPD category (art. 11) that includes health data. It requires a qualified legal basis and an elevated standard of care. Home care medical records, prescriptions and clinical photos fall under it, as does geolocation cross-referenced with the patient's health condition.

RIPD

Personal Data Protection Impact Assessment. Document provided for in the LGPD to describe high-risk processing and the mitigation measures. Recommended when handling patients' geolocation combined with health data.

OWASP MASVS

Mobile Application Security Verification Standard, from OWASP. Reference standard for assessing the security of mobile applications, covering local storage, encryption, authentication, network communication and resistance to tampering — the basis for shielding the home collection app.