Why does HITRUST matter more when you outsource patient access?

HITRUST has more utility for outsourced patient access partners than something like a scheduling tool, since service teams have more access to patient data on a regular basis. Patient access agents interface with protected health information (PHI) on a daily basis, whether it’s to read patient charts, process referrals, verify insurance statuses, or any number of patient access tasks. ROI CX Solutions provides HITRUST CSF-certified patient access outsourcing, backed by both a SOC 2 Type II report and an ISO 27001 certification, allowing peace of mind for you and your patients.

How much patient data does a patient access team handle?

Patient access teams handle far more patient data than software does. Every day, patient access agents encounter PHI from a variety of sources, including:

  • Clinical notes on referrals
  • Demographics
  • Insurance credentials
  • Live conversations with patients
  • Payment details

Why is a people-based risk different from a software risk?

A software risk lives within the system that houses it. While there is still vulnerability and risk in that environment, it tends to be more predictable, and there is less human interaction with it on a regular basis. Service teams introduce a variety of human access points (between logins, physical workstations, phone calls, and handoffs to other staff) where it is exposed to human eyes or human error can cause a breach.

What does HITRUST measure that HIPAA alone doesn’t?

HIPAA sets the mandatory legal requirements that all businesses that handle PHI are required to follow, while HITRUST is a third-party that provides a voluntary, but detailed, testable control framework for improving organizations’ security and compliance protocols. HITRUST also provides certifications to show that organizations have been independently audited and verified for HIPAA compliance.

HITRUST evaluates controls based on their maturity, not just their mere presence. It scores controls through their documentation, implementation, testing, and how well they have been managed over time.

There are 3 HITRUST certification levels, depending on the needs of an organization based on its size and risk profile:

  • HITRUST Essentials, 1-year (e1): The entry-level certification, best for lower-risk, smaller organizations. It ensures the organization has met the baseline cybersecurity practices by looking at 44 different controls.
  • HITRUST Implemented, 1-year (i1): Mid-level certification, good for organizations that are interested in upgrading their security measures or developing their third-party risk management. HITRUST i1 looks at 187 controls, including those at level e1.
  • HITRUST Risk-based, 2-year (r2): Highest level certification, best for larger organizations with higher risk profiles, looking to obtain a high level of data security. It looks at 2,000 controls, including those at lower levels. The framework of r2 is also mapped onto other prominent standards, including GDPR, SOC 2, and NIST CSF.

Certified, compliant, or mapped: what’s the difference?

Only certification includes an independent assessment and a letter of certification from HITRUST.

In this context, certified means that an organization has been independently evaluated by a certifying body, like HITRUST, providing third-party assurance that the organization reaches a certain standard of data security. Compliant implies something mandatory, like HIPAA, so HIPAA compliance simply means that the organization follows the federal law outlined in HIPAA.

Finally, if an organization’s standards are mapped onto HITRUST standards, this is a claim that their standards follow what is prescribed by HITRUST, but they have not gone through the certification process and received third-party assurance of their claim.

What should you ask any outsourced partner about security?

  • Which certifications do you hold, at what level, and when do they expire?
  • Can we see the letter or report?
  • What’s in scope?
  • Are your agents covered, or only your software?

Want to learn more about ROI CX Solutions’ security credentials? Talk to our team today!

Contact us today

FAQs

Is ROI CX Solutions HITRUST certified?

Yes. ROI CX Solutions is HITRUST certified.

What’s the difference between HITRUST certified and HITRUST compliant?

“HITRUST certified” is the correct term, and compliance is not the appropriate word in this context. HITRUST provides optional certifications. “Compliance” implies a mandatory requirement like HIPAA. When an organization has been assessed by HITRUST to be up to a certain standard, they are HITRUST certified. When an organization follows the federal law laid out by HIPAA, they are HIPAA compliant.