Backup For
Home Care & In-Home Care Agencies

The operational files a home care agency cannot afford to lose

A home care or in-home care agency runs almost entirely on paperwork and records that live on a small number of Windows computers in the office. There is no waiting room, no clinical facility, and often no second location, just an office PC or two coordinating a caregiver workforce that is out in the community all day. The categories below are the business records that keep caregivers matched to clients, hours tracked, and invoices sent. This page is about protecting those operational business files, not about the content of care itself.

• Caregiver rosters and contact information, the master list of every caregiver the agency employs or contracts, along with the phone numbers and addresses needed to reach someone on short notice when a shift needs to be covered
• Copies of caregiver credentials and certifications kept on file, such as background-check confirmations, training completion records, and certification copies, maintained here as ordinary personnel documentation the agency keeps for its own records
• Client service schedules and caregiver shift assignments, the day-by-day, client-by-client record of who is due at which home and when, covering standing weekly visits, one-off schedule changes, and last-minute substitutions
• Care plans and visit notes kept and used as operational scheduling and service-delivery records, meaning what tasks a shift covers and what was completed, treated here as the business paperwork that supports scheduling and billing rather than as clinical or medical documentation
• Caregiver timesheets and hours worked, the record used to run payroll accurately and to bill clients or their families for time actually delivered
• Payroll files and wage records for a caregiver workforce that is often part-time, per-visit, or made up of independent contractors, each with their own pay rate and schedule
• Billing records and private-pay invoicing, including invoices sent directly to clients or family members, payment history, and outstanding balances
• Client and family service agreements and contracts, the signed paperwork that sets the scope, rate, and terms of care for each individual client relationship
• Accounting records and QuickBooks or other accounting-software company files covering agency revenue, vendor payments, and tax records
• Office documents such as business licenses, insurance policies, vendor agreements, and whatever lives on the office manager's or owner's computer specifically, spreadsheets, saved reports, and working documents never copied anywhere else

A gap in any of these categories tends to surface at the worst possible moment: when a family calls asking why no caregiver showed up, when payroll is due and the timesheet file will not open, or when the one computer holding a departing office manager's working files is the one that just failed.

Why a home care agency's backup problem is different

Two things set a home care agency apart from most other small businesses, and both point back to the same office computer.

The workforce is distributed, the records are not. Caregivers are not sitting in the office. They are spread across a whole county, driving between clients' homes, working shifts that were assigned days or weeks earlier. The agency itself has no second office and often no second computer holding a duplicate of the schedule. That means the office PC coordinating dozens of caregivers across dozens of homes is a single point of failure for an operation that is physically spread across an entire service area. If that one machine goes down, there is no caregiver standing nearby who can simply look at their own copy of the plan, because the plan lives on that one computer.

Scheduling is the service. A home care agency's product, in a very literal sense, is getting the right caregiver to the right home at the right time. If the shift schedule is gone on a Monday morning, nobody in the office knows which caregiver is due at which client's home, which visits were already confirmed for the week, or which changes were made on Friday afternoon. Calls start coming in from clients and family members asking where the caregiver is, and the office has no master document to check against. A dentist who loses a day's schedule can rebuild it from patients who call to ask. A home care agency that loses its schedule has caregivers already on the road, already due somewhere, with no way to confirm where that is.

Where backup gaps hide in a home care agency

• One Windows PC carrying the entire schedule for a scattered workforce. Scheduling, payroll, billing, and the caregiver roster often run from a single computer in the office. If that machine fails, every caregiver assignment for the coming week goes with it unless a working backup already exists somewhere else.
• Scheduling or caregiver-management software mistaken for a backup. That software is where shifts get assigned every day, but the application itself is not the same thing as an independent backup you control. Whether it runs locally or in the vendor's cloud, anything you have exported or saved to the office PC needs its own backup, and your ability to restore a specific prior version of the schedule on your own timeline depends on your backup, not on the software vendor.
• The Monday morning schedule problem. A machine failure or a ransomware infection over a weekend, when the office is closed and nobody is watching it happen, can wipe out the schedule for a workforce that is about to start its week. Without a backup, the office is rebuilding shift assignments from memory and phone calls while caregivers are already due at homes across the county.
• Credential and certification copies scattered across email and one folder. Background-check confirmations and training records are frequently saved wherever they happened to land, an email attachment, a folder on one PC, with no second copy and no clear backup scope covering them.
• Timesheets and payroll data isolated on one machine. With a workforce that is part-time, per-visit, or made up of contractors, payroll data changes constantly. If it lives only on one computer, a failure right before a pay run leaves the agency unable to pay caregivers accurately or on time.
• An external drive left plugged in next to the office PC. A drive that stays connected to the same computer it protects can be lost to theft, failure, or ransomware at the same time as the original files.
• A sync folder deletion that propagates everywhere. OneDrive or Dropbox sync copies changes, including accidental deletions, to every connected device almost immediately. That is convenience, not backup.
• QuickBooks stored on only one machine. Intuit's own documentation recommends keeping company-file backups in a location separate from the original computer.
• Backup scope set once and never revisited. A new office computer, a new scheduling tool, or a caregiver-management export that starts saving to a different folder can quietly fall outside a backup plan that nobody has looked at since it was first set up.

What a complete backup plan looks like for a home care agency

The 3-2-1 rule is a practical framework promoted by CISA. Applied to a home care agency's caregiver roster, schedule, payroll, and billing files, here is what it looks like.

A backup checklist for home care and in-home care agencies

The steps below reflect CISA small-business backup principles and FTC small-business cybersecurity guidance, applied to the file environment of a working home care agency. This is a starting framework, not legal or regulatory advice.

• Map every machine that holds agency data. The scheduling computer, the payroll and billing computer if it is a different machine, and the office manager's or owner's laptop. Note what would be lost from each one if it failed today.
• Include the scheduling and caregiver-management data folder explicitly. Confirm where the software actually stores its files or exports on the Windows machine, and make sure that path, specifically, is covered rather than assumed to be handled automatically.
• Add credential and certification files as their own item. Background-check confirmations and training records should live in a known folder that is included in backup scope, not scattered across email and one computer.
• Cover timesheets, payroll, and billing files separately. These change constantly with a part-time and per-visit workforce and are easy to leave out of a backup plan built around the scheduling software alone.
• Include the QuickBooks data folder explicitly. Confirm the company-file path is actually covered rather than assuming it happens automatically.
• Keep enough version history to reach a clean copy. A schedule mistake, a ransomware event, or a quiet deletion is not always caught the same day. Decide how far back the agency would need to reach and confirm the backup actually goes that far.
• Encrypt backup data in transit and at rest, and set up alerts for failed or missed backup jobs so a gap does not go unnoticed until the moment the schedule is needed.
• Test restores on a regular schedule. A quarterly spot check, restoring last week's shift schedule and a payroll file from a past date, confirms the backup actually works before a real failure forces the question.

For a broader self-assessment of your current backup posture, see the small-business backup checklist.

Scheduling, caregiver-management, and accounting software: what backup actually covers

Ransomware and the home care office

The FTC and CISA both warn that small businesses are ransomware targets. A home care office fits the profile: the caregiver roster, the shift schedule, payroll, and billing records concentrated on one or two Windows machines, usually with no dedicated IT staff checking backup health day to day.

If ransomware reaches the office PC, the schedule, payroll files, and billing records can all be encrypted in the same event, often overnight or over a weekend when the office is closed and nobody notices until Monday morning. If the backup covering those files is a drive connected to the same computer or network, it can be encrypted right alongside them before anyone knows there is a problem.

CISA's #StopRansomware guidance points to offline and encrypted backup copies as the primary technical way to recover once files are encrypted. Backup does not prevent ransomware and does not eliminate downtime, but it determines whether the agency comes back to a working schedule and a complete payroll record, or starts the week trying to reconstruct caregiver assignments from memory while clients are calling to ask where their caregiver is.

Start Your Backup

How this is different from our counseling and therapy, and staffing and recruiting pages

We also publish pages for counseling and therapy practices and staffing and recruiting agencies. The differences are not cosmetic.

A counseling or therapy practice is built around a fixed location clients visit, or a scheduled telehealth session, with sessions delivered from an office or a clinician's own device. A home care agency has no equivalent fixed point of service. The caregiving happens across a whole county of client homes, and the agency's office exists mainly to coordinate that distributed work, not to deliver it. That is why the schedule itself, not a clinical record, is the operational center of gravity for this page.

A staffing or recruiting agency places workers with client businesses and its records center on candidates, placements, and often one-time or short-term assignments that end once a placement is made. A home care agency's caregiver-to-client relationships are ongoing, often for months or years, which means the schedule, the care plan used for service delivery, and the billing history need to stay accurate and recoverable for the life of that relationship, not just through a single placement event.