Website Security for UK Home Care and Domiciliary Care Agencies

Why Care Agencies Hold High-Risk Data

Home care and domiciliary care agencies hold some of the most sensitive personal data that exists — and about some of the most vulnerable people in the UK. Service user records contain full names, home addresses, GP details, medical diagnoses, medication schedules, next of kin contacts, financial details used for direct payment arrangements, and detailed care plans describing the most intimate aspects of daily life.

This is special category health data under UK GDPR, and it relates to individuals who may have limited capacity to advocate for themselves if their data is misused. A breach at a care agency is not an abstract corporate failure — it can directly enable physical harm, financial exploitation, and profound indignity for elderly or disabled people in their own homes.

The Care Quality Commission (CQC) regulates care agencies in England and considers information governance as part of its assessment framework. A data breach can trigger regulatory action beyond an ICO fine.

What Care Agency Systems Hold Online

**Staff recruitment and DBS portals** — Recruitment for care roles involves collecting extensive personal data about applicants, including criminal disclosure information through DBS checks. This data is highly sensitive and has its own legal protection.

**Carer scheduling and rota systems** — Cloud-based scheduling tools hold the addresses and care visit times for every service user, alongside details of which carer will attend. This schedule is extremely sensitive — it tells an attacker when a vulnerable person will be alone and when a carer will arrive.

**Care planning and handover platforms** — Digital care plans describe service users' health conditions, medication regimes, mobility limitations, dietary needs, and behavioural characteristics. If these platforms are accessed via a web interface and credentials are weak, every service user's care plan is exposed.

**Family portal access** — Many agencies offer family members a portal to view updates and care notes. If authentication controls on these portals are weak, one family member may be able to access another service user's records.

**Contact and enquiry forms** — Families making initial care enquiries often describe the care recipient's condition, diagnosis, and circumstances in detail. These submissions are health data from the moment they are sent.

The Specific Risks

**Weak credentials on scheduling and care planning software** — Care software used in the sector — systems like CarePlanner, Log my Care, or Nourish — is accessed by mobile carers using shared devices or personal phones. Weak or shared passwords, and the absence of multi-factor authentication, mean that a single compromised device exposes access to service user data.

**Unencrypted email as a data channel** — Care agencies routinely exchange care plans, medication administration records, and referral information by email. Standard email is not secure. Documents containing special category health data should not be sent without encryption.

**Outdated websites with stored enquiry data** — Agency websites often store contact form submissions — which include descriptions of care needs — in a CMS database. An outdated plugin or unpatched WordPress installation can give an attacker access to years of submissions.

**Staff data processed without adequate controls** — DBS check results are legally required to be handled carefully. Storing them in shared folders, inboxes, or an unprotected database breaches both UK GDPR and the specific legal framework governing criminal record data.

**Physical-digital crossover risk** — Service user addresses, care schedules, and carer routes represent a physical security risk if exposed. An attacker who can access scheduling data knows who is alone at home and when.

What the ICO and CQC Expect

The ICO has issued enforcement action against care organisations for inadequate data security. The bar for care providers is high because the data is special category and relates to vulnerable individuals.

The CQC's Key Lines of Enquiry include whether a care service is "well-led," which encompasses whether information governance arrangements are appropriate and whether the service demonstrates it handles data about service users securely and lawfully.

Protecting Care Agency Data

**Require MFA on all staff accounts** that access scheduling, care planning, or HR systems. A carer's phone being lost or stolen should not mean a service user's address and care schedule is compromised.

**Use role-based access controls** so carers can only see the service users on their roster, office staff can see only what they need to manage scheduling, and no account has broader access than necessary.

**Encrypt care plans and handover documents** that are shared digitally. If your scheduling platform does not support encrypted sharing, use a dedicated secure messaging tool rather than email for clinical communications.

**Run a security scan on your website** before publishing an online referral form. The form is collecting health data from the moment it goes live.

**Review your data processing agreements** with every software provider that touches service user data. Under UK GDPR, these agreements must be in place and must cover the specific processing activities involved.

Yrzo AI identifies the security vulnerabilities in care agency websites and client portals that leave service user data exposed, and delivers specific remediation steps that do not require technical expertise to implement.