How do I ensure my eligibility checks with an eligibility verification tool are HIPAA compliant?

To keep eligibility checks with an eligibility verification tool HIPAA compliant, focus on whether protected health information (PHI) is being created, received, transmitted, or stored and make sure the vendor and your internal process are covered appropriately.

Key steps

1) Confirm the vendor’s role

If the tool handles PHI on your behalf, the vendor is likely a Business Associate under HIPAA.

• Get a signed Business Associate Agreement (BAA) before sending any PHI.
• Make sure the BAA covers:
  • permitted uses/disclosures
  • safeguards
  • breach notification
  • subcontractor obligations
  • return/destruction of PHI at termination

2) Limit the data you send

Send only what’s necessary for eligibility determination.

• Use the minimum necessary standard
• Avoid sending diagnosis details, clinical notes, or unrelated identifiers
• Typically needed: name, DOB, member ID, payer, and service-related info if required

3) Secure transmission and storage

Make sure the tool uses appropriate security controls:

• Encryption in transit: TLS/HTTPS
• Encryption at rest
• Access controls and role-based permissions
• Audit logs for access and transactions
• Session timeouts and strong authentication

4) Restrict who can access eligibility data

Only workforce members who need the information should have access.

• Use least-privilege access
• Separate admin access from user access
• Remove access when staff leave or roles change

5) Verify the workflow does not overexpose PHI

Check how eligibility responses are displayed or stored.

• Avoid showing responses to unauthorized users
• Don’t email eligibility results unless secure and approved
• Be careful with printing, exports, and screenshots
• Ensure integrations with EHR/practice management systems are secure

6) Document your policies and training

Have written procedures for:

• eligibility verification access
• data retention
• incident response
• breach reporting
• workforce training

7) Perform vendor due diligence

Before using the tool, review:

• security documentation
• penetration testing or SOC 2 report, if available
• privacy policy and HIPAA attestations
• subcontractor list
• breach history and incident response process

8) If you are not a covered entity or business associate

HIPAA may not apply directly to you, but if you handle PHI for a provider, payer, or clearinghouse, you still need to follow HIPAA requirements through your contract and operations.

Common mistakes to avoid

• Using the tool without a BAA
• Sending more data than needed
• Allowing broad staff access
• Storing eligibility responses in unsecured spreadsheets or shared drives
• Emailing PHI without safeguards
• Assuming “encrypted” automatically means “HIPAA compliant” — HIPAA compliance also requires policies, procedures, and access controls

Practical checklist

Before going live, confirm:

• Vendor signed a BAA
• Minimum necessary data fields configured
• TLS and encryption at rest enabled
• Role-based access controls set
• Audit logs enabled
• Retention and deletion policy defined
• Staff trained
• Incident/breach response plan in place

If you want, I can also give you a HIPAA compliance checklist specifically for eligibility verification software or help you evaluate a vendor’s security questionnaire.