A vendor page that claims compliance with the Health Insurance Portability and Accountability Act (HIPAA) could mean anything from full encryption with signed agreements to basic checkboxes someone added to a feature list. No government body certifies software as HIPAA-compliant, so any vendor using the phrase is describing its own security processes rather than holding a credential someone issued. Since that phrase isn’t backed by external verification, your organization stays responsible for what each vendor does with your data.
Checking a platform’s actual safeguards before you sign is how you protect yourself. This guide will help you perform that check by outlining the required HIPAA safeguards and the questions to ask a vendor to determine their compliance status.
What Is HIPAA-Compliant Case Management Software?
HIPAA-compliant case management software encrypts client records, restricts access by staff role, and logs every time someone opens a file. HIPAA requires those safeguards from any organization handling protected health information (PHI), which covers any health detail your team records about an identifiable person. That includes the diagnosis in a case note or a referral your case manager made to a behavioral health provider.
Your organization stays responsible for meeting HIPAA requirements, though the right case management platform helps you protect client information at every point your team handles it. It encrypts client information as your team collects and manages data and logs every time someone opens a file. Your staff then decide who gets access to what, which the platform enforces on every record.
How Does HIPAA Affect Social Work and Human Services?
Your team must meet HIPAA requirements any time they work on a case. A case manager handles protected health information when writing a note, calling a partner agency, opening a colleague’s file, or pulling a record for a supervisor. Each of those actions comes with HIPAA obligations:
- Documentation: HIPAA requires you to protect PHI from the moment a caseworker writes it down. A diagnosis recorded in a paper file sitting in a locked drawer meets that requirement only as long as the drawer stays locked, which is one reason caseworkers move away from paper-based records.
- Information sharing: HIPAA limits what you can disclose to the minimum a partner agency needs for the task at hand. A housing provider coordinating a placement needs different information than a behavioral health clinician treating the same client.
- Minimum necessary access: The same limit applies within your own organization as well. A caseworker in your employment program has no reason to open behavioral health notes, even if they work with your caseworkers who do.
- Accounting of disclosures: Clients have the right to request a list of everyone who accessed their information. A system with complete client records can log each view automatically, so you have the answer whenever a client or regulator asks.
What Makes Case Management Software HIPAA Compliant?
Case management software helps you stay HIPAA-compliant through safeguards like data encryption and role-based permissions. You can and should ask vendors to demonstrate the following features before you sign anything.
Data Encryption
Encryption scrambles client information so no one without the key can read it. Your platform should encrypt records at rest on the server and in transit between a caseworker’s computer and that server. Where your data is physically stored matters too, since a multi-tenant platform keeps your client data on servers shared with the vendor’s other customers, while a single-tenant setup gives your organization its own storage device.
Role-Based Access Controls
Permissions tie each staff member’s access to the job they do. An intake coordinator opens intake records without reaching clinical notes from your behavioral health program. Your administrator assigns those roles once and adjusts them as people change positions, which keeps passwords, permissions, and encryption working together as staff turns over.
Audit Logs and Activity Tracking
Your system should track who opened each record, what they changed, and when. HIPAA gives clients the right to ask who accessed their information, which is precisely what a log does. That same log lets your security officer see when someone viewed files outside their normal caseload.
Business Associate Agreements (BAA)
A vendor that handles PHI on your behalf becomes your business associate under HIPAA, which means you need a signed contract. The agreement commits your vendor to protecting PHI, reporting breaches to you, and holding its own subcontractors to the same terms. Before you commit to a specific partner, ask about the BA, since a vendor refusing to sign one indicates compliance issues, regardless of what the rest of the platform does.
Breach Response and Notification Protocols
Your vendor should tell you about a security incident quickly enough for you to meet your own notification deadlines. HIPAA gives covered entities 60 days to notify affected individuals after discovering a breach, and that clock includes any time your vendor takes to reach you. Ask how fast they commit to notifying you in writing.
How to Evaluate HIPAA-Compliant Case Management Software
A vendor’s compliance page tells you what the vendor wants you to know. The following seven questions and their answers help you look beyond the basic features in a case management system to determine the level of security it provides:
- How does the platform protect data at rest and in transit? A vendor should name the specific encryption standards, like Advanced Encryption Standard (AES-256) for stored records and Transport Layer Security (TLS) for data your team shares across devices.
- Can administrators control access based on user roles? Ask how granular those roles get and who at your organization assigns them.
- Does the system maintain appropriate audit and activity records? Find out how far back the logs go and whether your administrators can pull them without contacting support.
- Will the vendor sign a BAA when applicable? Covered entities can only work with vendors who sign a BAA, so confirm they’ll sign one before evaluating anything else.
- What security standards or certifications does the vendor maintain? An outside firm verifies the vendor’s claim through a SOC 2 Type II audit, while penetration testing goes a step further by having someone attempt a real break-in each year. Vulnerability scanning then tells you whether the vendor checks for new security flaws on a regular basis.
- How does the vendor approach incident response and breach notification? Ask for the commitment in writing with a timeframe attached.
- Can permissions and workflows support different programs and staff responsibilities? Configurable technologies let your organization adjust as requirements change.
Which Human Services Organizations Need HIPAA-Compliant Software?
HIPAA applies to your organization if you operate as a covered entity or as a business associate working on one’s behalf. Covered entities are health plans like Medicaid and private insurers, health care clearinghouses, and health care providers that transmit health information electronically for billing or similar transactions.
Human services nonprofits usually aren’t covered entities themselves, but many do deliver services under contract for county health departments, managed care organizations, and hospital systems that are. Signing one of those contracts makes your program subject to HIPAA as a business associate, even when your organization never bills for health care directly.
Your specific obligations depend on the information you handle and whether you’re a covered entity or a business associate. Confirm your status with counsel before you decide whether HIPAA applies to you. These four types of non-covered entities still have to follow HIPAA regulations:
- Social work and case management programs: A program billing Medicaid for case management services transmits health information electronically, which makes it subject to HIPAA. Case management software for these programs should account for that from the start.
- Behavioral health and health-adjacent programs: Organizations providing counseling, substance use treatment, or mental health services must comply with HIPAA. Substance use programs may also fall under 42 CFR Part 2 regulations, which are stricter than HIPAA.
- Government and community-based programs: A county human services department administering Medicaid-funded services handles PHI as part of daily operations. Both government agencies and community-based organizations contracting with them take on obligations through those arrangements.
- Multi-program organizations: A caseworker assigned to both a covered program and an uncovered program may handle PHI in only some of their cases. Software that automatically applies HIPAA safeguards to the cases that need them keeps your workers from having to sort that out themselves.
Casebook Supports HIPAA for Social Workers and Nonprofit Organizations
Casebook is HIPAA-compliant case management software for human services organizations. Your team can verify each of the safeguards described above before signing, which is how you can tell nonprofit case management software meets HIPAA requirements.
Here’s what Casebook brings to the table:
- HIPAA audits: Casebook undergoes periodic audits against the HIPAA security and privacy frameworks. Your organization can point to those when a funder or regulator asks how you vetted your vendor.
- Signed BAAs: Casebook enters into a Business Associate Agreement with covered entities on its Team and Enterprise plans. That agreement commits Casebook in writing to protecting your PHI and reporting any breach to you, with the same terms binding any subcontractor Casebook uses.
- SOC 2 Type 2 audits: An independent auditor examines Casebook’s security controls every year and issues a report on what they found. A Type 2 audit tests whether those controls worked over a period of months. The verification comes from an external source, so you know it’s unbiased.
- Encryption: FIPS 140-2 compliant encryption protects client records in storage and in transmission. A caseworker updating a note from a home visit sends that data over an encrypted connection, so an attacker who tries to intercept it will get nothing but scrambled characters. The same protection applies if the caseworker’s laptop gets stolen on the way back to the office.
- Role-based permissions: Least privilege applies by default, so an intake coordinator and a clinical supervisor see different parts of the same client record. Your administrators define those boundaries once and adjust them as staff change roles. Nobody depends on a caseworker remembering which files are off limits.
- Audit logging: Every view and edit gets recorded with a user and a timestamp. Your security officer can say who opened a record and when, which answers a client’s access request in minutes. The same log shows activity outside someone’s normal caseload for your organization’s security officer to review.
- Network security and testing: Casebook hosts client environments in AWS and requires two-factor authentication on client accounts. Yearly penetration testing puts the platform through simulated attacks, with regular vulnerability scanning covering the months in between.
- Incident response: Casebook follows a structured protocol to detect, contain, and recover from a security incident. Independent auditors assess that protocol during SOC 2 and HIPAA reviews. Casebook notifies your team quickly enough for you to meet your notification deadlines.
Protect Sensitive Client Data With the Right Case Management System
HIPAA compliance depends on both your organization and your software. Your team decides who gets access to what and how staff handles client information day to day, while your platform enforces those decisions on every record. Neither half works without the other.
That’s why it’s important to verify the encryption standard, the audit log retention period, the SOC 2 report, and the BAA before you commit to a platform. A compliance page is marketing copy the vendor wrote about itself, while those four documents come from auditors, contractors, and system settings you can check.
Casebook documents all four and has them independently audited every year. Book a demo, and we’ll bring them to the call.