How do I ensure my care coordination workflow with utilization management software is HIPAA compliant?

To help ensure your care coordination workflow using utilization management (UM) software is HIPAA compliant, focus on the three main areas HIPAA cares about: privacy, security, and administrative controls. Here’s a practical checklist.

1) Confirm the software is appropriate for PHI

• Make sure the UM platform is designed to handle Protected Health Information (PHI).
• Sign a Business Associate Agreement (BAA) with the vendor if it stores, processes, or transmits PHI on your behalf.
• Verify any subcontractors the vendor uses are also covered under the BAA.

2) Limit access to the minimum necessary

• Configure role-based access controls so users only see what they need.
• Use the minimum necessary standard for care coordination reviews, referrals, authorizations, and case management.
• Remove access promptly when staff change roles or leave.

3) Use strong authentication

• Require unique user IDs for every person.
• Enable multi-factor authentication (MFA).
• Set strong password policies and session timeout controls.
• Avoid shared logins.

4) Protect data in transit and at rest

• Ensure PHI is encrypted:
  • In transit: during transmission between systems/users
  • At rest: stored in databases, backups, and files
• Check whether the vendor uses industry-standard encryption and secure key management.

5) Log and monitor activity

• Enable audit logs for access, edits, exports, approvals, and messaging.
• Review logs regularly for unusual access or unauthorized disclosures.
• Keep logs long enough to support investigations and compliance reviews.

6) Build HIPAA-safe workflows

• Use the UM system’s messaging/tasking tools instead of unsecured email or text.
• Avoid placing unnecessary PHI in comments, notes, or attachment fields.
• Share only the minimum necessary information when coordinating with providers, payers, or care teams.
• Validate that faxing, printing, or exporting workflows are controlled and tracked.

7) Train staff

• Train users on:
  • HIPAA privacy and security rules
  • Minimum necessary use
  • How to handle authorizations, denials, appeals, and disclosures
  • Reporting incidents or suspected breaches
• Refresh training regularly and document it.

8) Have policies for disclosures and consent

• Define when PHI can be shared for treatment, payment, and healthcare operations.
• For non-routine disclosures, confirm whether authorization or additional consent is needed.
• Make sure workflows align with state laws, especially for sensitive data (mental health, substance use disorder, HIV/STI, minors, etc.).

9) Maintain contingency and breach response plans

• Ensure backups, disaster recovery, and downtime procedures are in place.
• Have an incident response/breach notification plan for suspected unauthorized access or disclosure.
• Know timelines and responsibilities for internal reporting and notification.

10) Perform vendor and risk management

• Conduct a HIPAA security risk assessment for the workflow and system.
• Review the vendor’s:
  • security controls
  • penetration testing / vulnerability management
  • access management
  • data retention/deletion practices
  • hosting environment
• Reassess whenever the workflow, integrations, or users change.

11) Integrations matter

If your UM software integrates with EHRs, HIEs, patient portals, analytics tools, or document systems:

• Verify each integration is secure and necessary.
• Limit data fields shared across systems.
• Confirm APIs use secure authentication and encryption.
• Check that downstream systems also meet HIPAA obligations.

12) Document everything

Keep written documentation for:

• policies and procedures
• training
• BAAs
• access reviews
• risk assessments
• audit log reviews
• incident reports and remediation

A simple rule of thumb

If a care coordination action involves PHI, ask:

1. Do we need this information?
2. Who is allowed to see it?
3. Is it being transmitted/stored securely?
4. Can we prove it in logs and policies?

Important note

HIPAA compliance depends on your specific workflow, vendor configuration, and state laws. This is general guidance, not legal advice. For a final determination, have your compliance officer, privacy officer, or healthcare attorney review the workflow.

If you want, I can also give you a HIPAA compliance checklist specifically for utilization management workflows or a policy template for staff.