What the assessment actually delivers.
A written sovereignty-posture document organized to make the gaps visible and the remediation paths proportional to a private-duty agency's reality. Three to six pages on the short cycle (default); six to twelve pages on the long cycle. Named observations sourced to the agency's actual vendor stack and family-and-caregiver data flow, with a remediation order written for the agency owner who reads vendor terms between caregiver-recruitment cycles.
Lens 1: Family-side and caregiver-side data sovereignty in a non-Medicare, non-Medicaid frame.
What does the agency's CRM, marketing-funnel platform, payment processor, and AI overlay actually claim in current terms about the family's data and the caregiver's data? Can the agency export cleanly to migrate or sell? Where does the family-side marketing behavioral data live, and what would happen to it on vendor change-of-control? What is the caregiver's employment-record posture (the agency holds it, the payroll vendor holds it, the AI overlay summarizes it for the family portal)? This lens reads the agency's environment the way a thoughtful state attorney general enforcement attorney or a careful acquirer's diligence team would.
Lens 2: AI feature activation and consent-by-silence across a less-regulated stack.
Which AI features have the scheduling vendor, CRM, payment processor, and any AI overlay activated since the agency signed up? What did the most recent terms-of-service amendment authorize on family-communication drafting, caregiver shift-note summarization, marketing-funnel optimization, and family portal AI assistants? What does the family who hired the agency understand is happening with their data, and what is actually happening? The absence of HIPAA-style BAA discipline in much of the private-duty vendor stack makes this surface more exposed than the comparable LHCSA or HHA stack.
The deliverable is yours. Keep it, share it with your attorney ahead of a contract negotiation, use it in a renewal conversation with a vendor, or work the remediation in-house.
The threat surface, named for private-duty home care.
Four exposures sized for private-duty home care agencies operating outside the Medicare and Medicaid regulatory air cover. None of these are hypothetical. All of them are showing up in current state attorney general enforcement actions, consumer-protection class actions, state privacy law enforcement, and the home care trade press.
Threat 1: Vendor lock-in without regulatory air cover means the agency has even less leverage at renewal.
Without the regulatory mandates that constrain how vendors can treat Medicare-certified HHAs or NY LHCSAs, private-duty vendors face fewer rules about how they structure terms, what data they license to themselves, and what AI features they activate by default. The agency signed standard contracts at the moment of growth. The vendor's renewal letter reflects the absence of an outside regulator who would push back. Migration costs are structurally similar to LHCSA and Medicare-certified HHA cases; the agency's leverage at renewal is structurally lower.
Sources: vendor terms of service for major private-duty scheduling and CRM platforms 2024-2025 (verify current language at assessment time); Gartner SaaS Spend Management research 2025; Sterling's anti-lock-in doctrine (REFERENCE_anti-lock-in-doctrine.md).
Threat 2: State privacy law convergence applies to family contact data, caregiver employment data, and visit records. State AG is the enforcer.
Maryland MODPA, California CPRA, New York SHIELD Act, and roughly seventeen other state privacy laws apply to most private-duty agencies in the $2M+ revenue band. Family contact data, payment data, behavioral data from the marketing funnel, caregiver employment data, and visit records are all in scope. The HIPAA frame may or may not apply (depending on the agency's structure and services); the state privacy law frame definitely applies. The state attorney general is the enforcer. Trades and private services have not historically been priority targets, but the floor keeps rising.
Sources: IAPP US State Privacy Tracker 2026; Maryland MODPA; California CPRA enforcement actions Q4 2025 to Q1 2026; New York SHIELD Act; state-by-state privacy law tracker (verify current state-of-play at assessment time).
Threat 3: DOL wage-and-hour exposure applies even without Medicaid funding.
The 2013 DOL Home Care Rule extended FLSA minimum-wage and overtime protection to most home care workers regardless of payer source. Private-duty caregivers are covered. NY's 13-hour live-in case law applies to NY- based private-duty agencies. Plaintiff's counsel reads the same trade press LHCSA owners read; the only difference for private-duty is that the agency doesn't have a Medicaid payer in the room when the case lands. Scheduling vendor, time-tracking vendor, and payroll vendor each hold a slice of the audit trail. The agency that can produce a clean, cross-vendor-reconciled record is much harder to settle against.
Sources: 29 CFR 552 (DOL Home Care Rule); Andryeyeva v. New York Health Care Inc., 33 NY3d 152 (2019); Moreno v. Future Care Health Services, 173 AD3d 700 (2019); FLSA (29 USC 201 et seq.); state wage-and-hour statutes (varies by jurisdiction).
Threat 4: Family-side marketing data and behavioral data accumulate, and elder-abuse and consumer-protection class actions read it.
Private-duty agencies typically accumulate substantial family-side marketing data over time: the contact form data, the consultation history, the email behavioral data from drip campaigns, the family-portal usage patterns. When something goes wrong (a caregiver-related incident, a billing dispute, an alleged elder-abuse claim), plaintiff's counsel will read all of it in discovery. The vendor stack determines whether the agency can produce a clean, organized story or whether the discovery production looks chaotic and incomplete. The state attorney general's consumer-protection enforcement reads the same data when complaints reach a certain threshold.
Sources: state attorney general consumer-protection enforcement records (varies by jurisdiction); elder abuse and exploitation case law and statutes (varies by state); FTC enforcement actions on consumer-protection theories applicable to home care 2022-2025; trade press coverage of private-duty home care plaintiff-side litigation 2023-2025.
The short cycle, default for private-duty.
Private-duty agencies default to the short cycle because the regulatory complexity is lower than Medicare-certified or LHCSA cases. Long cycle is available for larger agencies, multi-state agencies, or agencies preparing for a sale.
- Short cycle (about two hours of your time, roughly one week elapsed). Thirty-minute discovery call. Homework on your side: vendor list, marketing-funnel description, the specific question you want answered. One sixty-minute evaluation session. A three-to-six page written posture document delivered within five business days.
- Long cycle (about ten business days, acquirer- diligence-shaped deliverable). For larger agencies ($10M+ revenue), multi-state operations, or agencies preparing for a sale, succession, or strategic acquisition. Forty-five-minute discovery call; six-to-twelve page written document.
Who this is for.
Private-duty home care agencies (non-Medicare, non- Medicaid) in the $1M to $30M annual revenue band with 20 to 300 caregivers and a family-side customer base that pays out of pocket or through long-term-care insurance.
- Independent owner-operated private-duty agencies (20-75 caregivers) with one founder, single-state operations, and a clear local geography.
- Established multi-location private-duty agencies (75-300 caregivers) with multiple offices, a separate ops and marketing function, and accumulated family-side marketing data.
- Franchise-operated private-duty agencies (typically 50-200 caregivers per franchise) with franchise-network-mandated vendor stacks and franchise terms layered on the vendor terms.
- Private-duty agencies that also operate a LHCSA, a Medicare-certified HHA, or both running on multiple vendor platforms across service lines (also fit the LHCSA or Medicare-certified HHA assessment).
- Private-duty agencies preparing for a sale, succession, or strategic acquisition where vendor-stack posture and family-data quality shape the multiple.
- Private-duty agencies in active consumer-protection or elder-abuse litigation where the vendor data trail is in active discovery.
Adjacent private-duty and care-adjacent structures
- Caregiver-registry agencies (where the agency matches families with caregivers but the caregiver is technically the family's employer) with a structurally different employment-relationship picture but similar data flow.
- Concierge home health agencies serving high-net-worth families with bespoke service models, often with custom vendor builds and elevated family-data sensitivity.
- Long-term-care insurance coordination services with LTCI-payer-side data flow on top of family-side data.
- Veteran-focused home care agencies with VA payer relationships and the VA HIPAA frame layered on top of private-duty operations.
- Solo or small partnership private-duty firms under $1M revenue for whom the home care hub assessment may be sized correctly.
Why us.
Sterling Solutions is a Westchester-based small firm. We do not run on venture capital. We have published values (success.build/ethos) and a written anti-lock-in doctrine.
We are not a private-duty scheduling vendor or CRM vendor. We are not pitching one. The assessment is not a stalking horse for a migration engagement. If the conclusion is "your stack is defensible with three documentation gaps closed," that is the conclusion. We have no commission structure with any vendor.
The family is paying out of pocket because they trust your agency more than the alternatives. That trust is the asset the agency is actually selling. The vendor stack a private-duty agency operates should reflect that trust, not extract from it. The absence of Medicare or Medicaid regulatory air cover means the sovereignty posture is the agency's own choice and the agency's own competitive position. The same anti-lock-in doctrine that protects member sovereignty for the mutual carriers we work with and protects client confidentiality for the attorneys we work with protects family-paying-out-of-pocket trust here, in a less-regulated setting where the agency has more freedom to choose how it operates and more responsibility for the choice.
What this page is not.
This is not a pitch for a six-figure modernization engagement.
This is not legal advice. Sterling Solutions is a technology firm, not a law firm. Private-duty agencies typically need a business attorney (consumer-protection and contract matters) and employment counsel (wage-and- hour, contractor classification). We are happy to coordinate.
This is not a marketing audit or a CRM-strategy consulting engagement. The family-side marketing data is part of the sovereignty surface, but the assessment is about the data-handling posture, not about how to grow the marketing funnel.
Tire-kickers, briefly.
The evaluation is honest work. Bring the owner who actually makes the vendor decisions, and bring a real intent to read what we deliver. Curiosity is fine. Performative curiosity is not what this offer is for.
One discovery call.
Thirty minutes for the short cycle (default for private-duty), forty-five for the long cycle. The vendor stack, the family-side marketing data, the caregiver employment posture, and the AI feature activation your agency carries today are going to be the subject of the next renewal, the next consumer- protection complaint, the next plaintiff's discovery request, or the next sale conversation whether or not you have a written posture document on the shelf.
Heads-up on the booking page: the booking widget shows 30-minute slots. For the short cycle (default), thirty minutes is the right length. For the long cycle, once you pick a time we will extend it to forty-five minutes on our end if the surrounding slots are open. If the adjustment does not work for you, email [email protected].
success.build/risk/home-care/private-duty · [email protected] · short cycle default; scope-selectable on the call