Is AI in Claims Review HIPAA-Compliant? What Enterprise Teams Need to Know

Handing patient health information (PHI) is a necessary part of claims. As a claims provider, customers and clients trust you with their sensitive health information. This health information can come with privacy concerns, and choosing a secure option is essential. Did you know that 49% of claims professionals identify compliance and regulatory risk as one of the top challenges of integrating AI? 

Ensuring that your Claims Documentation Platform (CDP) is HIPAA compliant is essential for safeguarding your reputation in the claims industry and within your organization. Here are some of the key questions to ask when choosing a claims documentation platform.

1. Is data encrypted in transit and at rest? How is this data encrypted?

Medical records contain sensitive PHI that requires careful protection. Cases like Dinerstein v. Google demonstrates the potential issues associated with data privacy and PHI; when companies like Google can collect so much data from its users that it risks re-identifying even de-identified patient info, knowing about data encryption is essential. Enterprise teams looking for a HIPAA-Compliant tool should choose one with AES-256 encryption, an advanced encryption standard adopted by the US government. 

2. When was the last SOC 2 audit conducted? Were there any findings? What was the reporting period?

A SOC 2 audit validates the security, availability, integrity, and privacy of a platform. The “SOC” in SOC 2 stands for Systems and Organization Controls; it is essentially a trust check that shows customers you can keep their data safe, make their data available, do what you say you will, and keep the process private. SOC 2 audits are typically annual, and the platform provider should be able to provide you with any findings from the prior years audits on request. 

3. Does the AI medical summary use actual text from documents or generate new content? How does the system prevent hallucinations?

Extractive summarization (words pulled verbatim from a source text) are useful in some scenarios, whereas abstractive summarization (generating new content) can be employed with safeguards like human oversight, role based access controls, and audit logs. It’s imperative to know which form of AI is being used when it comes to forming defensible outputs in high-stakes industries such as claims and legal.

4. How granular are access controls? Can permissions be configured at the user, group, and document level?

Not everyone needs access to every claim. PHI is sensitive, and one of the best controls on sensitive data is user controls and team permissioning – who can access a particular file, and when. Permissions should be in place to protect sensitive health information from being accessed when it should not be, right down to the document level. 

Key questions for your provider should include whether user activities are kept in detailed logs, how long (and how) these logs are retained, and what you need to do should you ever need access to them. You should also ask how data is segregated to protect PHI and how the data is hosted. Different countries and states have strict regulations around privacy, so it’s a good idea to keep on top of where yours is stored, and whether it complies with state law. 

5. Will the vendor sign a Business Associate Agreement (BAA)? Is their standard BAA suitable or will custom terms be required?

A Business Associate Agreement is required by law for HIPAA compliance. BAAs are legally binding and cover the persons or organizations who perform services involving PHI on the hospital, healthcare provider, or clearinghouse’s behalf. It ensures that the associate will take care of PHI on your behalf.

When you work with PHI, failure to safeguard critical information puts your reputation on the line. AI can save time, money, and busywork — but it’s best used when it can be applied in consistent, compliant, ways. 

To ask yourself all the appropriate questions on whether your claims documentation platform is HIPAA compliant and abides by the correct security protocols to keep your enterprise safe, download Wisedocs’ Buyer’s Guide today.