How to Outsource Healthcare Call Center Support Without Violating HIPAA
Introduction
For the majority of patient interactions (from scheduling and billing inquiries to routing prescription refills and following up post-discharge), a clinician isn’t a necessity, which allows many functions to be outsourced. However, the PHI that can potentially be exposed in these arrangements makes a lot of healthcare providers reluctant to outsource. Healthcare organizations are not wrong in prioritizing data security. After all, HIPAA civil penalties can cost more than $2 million per violation, depending on the severity. But the hesitance towards outsourcing can actually cost healthcare organizations a lot in terms of overhead, speed of patient access, and the overall distraction that staff faces from the high volume of administrative tasks.
The true risk here isn’t in outsourcing as a whole, but in outsourcing to the wrong partners. Today, we’re taking a look at what HIPAA truly requires of outsourced healthcare call centers, what you need to look closely at before partnering with one, and some of the most common HIPAA mistakes that healthcare organizations tend to make when considering healthcare BPO partnerships.
Read Time: 9 minutes
Key Takeaways
- HIPAA doesn’t prohibit outsourcing, it sets standards for vendors: Outsourcing patient communications isn’t the risk, it’s choosing the wrong partner who doesn’t take HIPAA seriously. The right vendor will have a signed BAA, as well as administrative, physical, and technical safeguards in place to back it up.
- HIPAA compliance is an ongoing thing, not a one-time event: Healthcare organizations and their business associates are required to conduct annual training and audits, verify the training records of individual agents, and have a tested breach response plan in place to remain compliant with HIPAA.
- Evaluate vendors on compliance infrastructure, not just cost or location: Offshore and nearshore partners are fully capable of HIPAA compliance. Conversely, onshore vendors are just as prone to noncompliance. The location of a vendor isn’t a great way to judge compliance. Certifications like HITRUST, SOC 2 Type II, and ISO 27001 provide independent verification that a vendor truly has the safeguards in place to stay compliant.
Table of Contents
Why healthcare organizations are outsourcing patient communications
Many of the high-volume and time-sensitive tasks like billing support, scheduling, post-discharge outreach, and prescription refill requests are important, but as administrative functions, they are inefficient and expensive to staff internally. Simply by outsourcing these functions, healthcare organizations can vastly free up clinical staff to focus on the direct care of patients while significantly reducing operating costs.
That’s not to mention the additional capabilities that outsourcing can provide for healthcare organizations, such as multilingual support, extended hours, and greater volume capacity and scalability. Many of these functions and benefits are similar to — if not the same as — those that other industries gain from outsourcing partners. The key difference here, though, is the sensitivity of the data involved.
PHI is some of the most sensitive data the average person has, and the exposure of this data is an extreme violation of patient trust, let alone a crime that bares sever legal, financial, regulatory, and reputational consequences for organizations that violate HIPAA. The stakes here being higher than most other industries makes it all the more important to find a trustworthy outsourcing partner.
Can you outsource patient communications without violating HIPAA
Yes, but the correct safeguards are needed to prevent violations. HIPAA doesn’t prohibit healthcare call center outsourcing, but it does thoroughly define the compliance standards that any vendors are required to meet. That means that any third party who handles protected health information (PHI) on behalf of a healthcare organization is required to sign a Business Associate Agreement (BAA) and implement documented safeguards on the administrative, physical, and technical levels. Finally, third parties are required to train their agents on HIPAA requirements for outsourcing to be operationally and legally sound.
What HIPAA actually requires from an outsourced call center
HIPAA views any outsourcing vendor who accesses, stores, or transmits PHI on behalf of a covered healthcare organization as a “Business Associate”. This legal classification gives them the same obligations to HIPAA compliance as the healthcare organization that hires them, but it also means that their clients are still liable for the business associate’s compliance failures.
To be fully compliant under HIPAA, business associates must have three things:
- Signed BAA
- Documented safeguards
- Continuous agent training
The Business Associate Agreement (BAA)
Outsourcing vendors of healthcare organizations are legally required to have a Business Associate Agreement to remain HIPAA-compliant. Through the BAA, the vendor’s obligations regarding the use, disclosure, and breach notification of PHI are formally established, and they will be directly liable for any violations of the agreement that occur on their end.
However, a BAA alone doesn’t make a vendor inherently HIPAA-compliant. At the end of the day, a BAA is a legal document, not an operational one. In practice, that means that vendors who have signed a BAA have made a legally binding promise, and it’s then up to them to take the other necessary steps for HIPAA compliance.
The Three HIPAA Safeguard Categories
Healthcare-related outsourcing partners are required to put HIPAA safeguards in place to ensure data security and privacy. To be compliant, partners must have all 3 of the following:
- Administrative safeguards: Administrative safeguards include things like designating a privacy officer, carefully documenting PHI-handling policies, HIPAA training for all agents (including annual reviews), and an in-built secure process for removing access to PHI when agents change roles or leave the company.
- Physical safeguards: To physically safeguard PHI, partners can implement measures like controlled facility access, device management protocols for any remote staff, and clean desk policies that prohibit unsecured PHI.
- Technical safeguards: HIPAA-compliant partners also need technical safeguards, such as end-to-end encryption for calls and data, role-based access controls limiting the visibility of PHI to the minimum necessary data for each given task, audit logs, and secure call recording with defined retention and deletion schedules
Continuous agent training
All agents who have access to PHI are required by HIPAA to be trained on compliance standards, including:
- The Privacy Rule
- The Security Rule
- The “minimum necessary” standard
- Breach reporting protocols
The training must be an ongoing initiative with documented individual annual reviews, as well as independently verified individual completion records. As a healthcare org looking for an outsourcing partner, don’t just ask if the agents receive HIPAA training. Ask precisely how the training is tracked, how often it gets updated, and what the consequences are for failure to complete it. Without specific answers to those questions, it’s likely that a vendor has some serious compliance gaps, which leads to PHI exposure.
The biggest HIPAA mistakes healthcare orgs make when outsourcing
The types of HIPAA violations that tend to happen in outsourced call center relationships aren’t usually because the healthcare organization decided to cut corners. More often, it’s due to healthcare organizations neglecting to ask the right questions of potential vendors. Here are some of the most common (and expensive) mistakes that healthcare orgs tend to make when looking at vendors that can result in noncompliance.
- Choosing a vendor based on cost only: It’s understandable to look for a deal, but if that comes at the expense of a vendor who can demonstrate that they have reliable compliance infrastructure in place, that’s concerning. Be careful not to bargain your way into a HIPAA violation.
- Assuming that a vendor’s location determines compliance: Some healthcare orgs might assume that an onshore partner would be instantly compliant due to being in the same country, but that’s not the case. Onshore partners can be reckless, and offshore or nearshore partners are fully capable of HIPAA compliance. Pay attention to the vendor’s actual infrastructure, not just their location.
- Skipping agent-level training verification: Agents are required to be individually trained on the Security Rule, Privacy Rule, breach protocols, and the minimum necessary standard. If a potential vendor says that they have a “company training program” but isn’t able to show individual completion records should be suspect, since that means they have potential training gaps where PHI can leak.
- Failing to audit vendors annually: Protecting PHI that passes through outsourced contact centers isn’t a “one and done” check, but an ongoing obligation. For some vendors, their compliance status can gradually shift as they experience turnover or switch to new tech, so building annual compliance reviews into your contracts is a smart move.
- Not requiring a tested incident response plan: HHS requires notifications of breaches within 60 days. Any good vendor needs to have a documented and tested response plan that clearly defines timelines for breach notification.
What to ask a vendor before signing a healthcare outsourcing contract
Though not a complete list, this healthcare call center compliance checklist provides some informative questions that allow you to distinguish between potential partners who have legitimate compliance infrastructure and those that only have a BAA without the ability to deliver on it.
- Do you hold HIPAA/HITRUST certification, and can you provide current documentation?
- Are you compliant with ISO 27001 and SOC 2 Type II alongside HIPAA? Can you share your most recent audit reports?
- At the individual agent level, how is PHI access logged and audited?
- Do you have a documented breach response plan? What are your notification timelines?
- How often do you retrain your agents on HIPAA, and how do you verify individual completion?
- What are your physical security measures for remote agents who handle PHI?
Why ROI CX Solutions is the right partner
ROI CX Solutions is HITRUST certified for HIPAA compliance, as well as SOC 2 Type II and ISO 27001, which is more than many healthcare BPO providers can say for their regulatory compliance. That ensures that our PHI protection measures are verified independently using a variety of regulatory frameworks, not merely self-reported.
Each of our agents is trained in the specific workflows of healthcare outsourcing, such as revenue cycle management, insurance operations, and more. We don’t simply make a standard contact center and shoehorn healthcare-related features. We intentionally create a healthcare contact center from the ground up, built strictly around being effective and compliant in the relevant regulatory and patient experience standards.
If you are in search of HIPAA-compliant outsourced patient communications for your healthcare organization, ROI CX Solutions is here to help. See what we can do for your patient experience today.
