Is Express Scripts PBM HIPAA Compliant? A Checklist to Verify

Understanding HIPAA Requirements

Before you can confirm whether Express Scripts is HIPAA compliant, ground your review in the core rules that govern Protected Health Information. HIPAA’s Privacy Rule defines permissible uses and disclosures of PHI, while the HIPAA Security Rule sets the baseline for administrative, physical, and technical safeguards for electronic PHI (ePHI). The Breach Notification Rule prescribes how and when affected parties must be notified after a qualifying incident.

Your verification should map Express Scripts’ documented controls to these requirements. Look for explicit references to data governance, access limitations, risk management, and breach handling that demonstrate mature Data Privacy Safeguards and Legal HIPAA Responsibilities.

Checklist

• Documented policies covering Privacy Rule, HIPAA Security Rule, and Breach Notification Rule.
• Enterprise risk analysis and routine risk management updates tied to PHI workflows.
• Defined “minimum necessary” access standards and role-based authorizations.
• Incident response playbooks with clear decision trees for breach determination and notice.

Reviewing Business Associate Agreements

As a Pharmacy Benefit Manager, Express Scripts typically operates as a Business Associate to covered entities. Your first-line evidence is a signed, current Business Associate Agreement that clearly states permitted uses of PHI, security expectations, and responsibilities across the relationship lifecycle.

What to verify in the BAA

• Scope of services and PHI types handled, including creation, receipt, maintenance, and transmission.
• Permitted uses/disclosures, minimum necessary standards, and prohibitions on secondary use.
• Subcontractor flow-down obligations ensuring equivalent protections and Technical Compliance Controls.
• Breach reporting timelines, cooperation duties, and documentation requirements.
• Right-to-audit clauses, termination rights, and secure return/destruction of PHI at contract end.

Red flags

• Vague breach-reporting language without concrete timeframes or escalation paths.
• Absence of subcontractor oversight or weak data return/destruction terms.
• Overbroad “permitted uses” that exceed the minimum necessary standard.

Assessing PHI Protection Measures

Evaluate how Express Scripts prevents, detects, and responds to risks that could compromise PHI. Request evidence of administrative controls (training, sanctions, risk assessments), physical safeguards (facility access, media handling), and technical safeguards (access control, audit, integrity, and transmission security).

Operational safeguards to confirm

• Enterprise risk assessment methodology and results addressing PHI-bearing systems and data flows.
• Workforce onboarding, annual HIPAA training, and role-based reinforcement for Data Privacy Safeguards.
• Media protection, device encryption, and secure disposal with auditable logs.
• Third-party oversight for downstream vendors handling PHI, including BAAs and monitoring.

Evaluating Compliance Certifications

Compliance Certifications do not equal HIPAA compliance, but they provide independent assurance that security controls are designed and operating effectively. Ask for current certificates and reports that map controls to HIPAA requirements and industry frameworks.

Evidence to request and interpret

• HITRUST CSF certification covering the PBM’s relevant environments and services.
• SOC 2 Type II report with HIPAA mapping or additional criteria relevant to privacy and security.
• ISO/IEC 27001 certification for the Information Security Management System governing PHI systems.
• Documented alignment to NIST CSF/800-53 controls; PCI DSS (for payment processes) as a complementary indicator.
• Report dates, scope boundaries, control exceptions, and management corrective actions.

Analyzing Legal Compliance History

Past performance is a predictor of current risk. Ask Express Scripts to disclose recent security incidents, breach notifications, corrective action plans, and material litigation related to PHI. Review how quickly issues were identified, remediated, and prevented from recurring.

Due diligence steps

• Require a written summary of reportable incidents and remediation over the past 3–6 years.
• Request copies or summaries of regulatory inquiries, settlements, or audits tied to HIPAA obligations.
• Corroborate disclosures with internal risk registers and leadership attestations.

Implementing HIPAA Compliance Processes

Compliance is not a one-time check—it is an operating rhythm shared by you and your PBM. Establish governance, clear ownership, and ongoing verification mechanisms to sustain compliance throughout the contract term.

Program elements to put in place

• Shared responsibility matrix mapping Legal HIPAA Responsibilities across privacy, security, and operations.
• Quarterly compliance reviews: incidents, metrics, audit findings, and remediation progress.
• Change management gates for new features or integrations touching PHI.
• Right-to-audit exercises and targeted control testing based on risk.
• Playbooks for incident response, breach notification, and communications with executives and members.

Verifying Technical Safeguards

Confirm that Technical Compliance Controls align to the HIPAA Security Rule’s technical standards and are proven in practice. Focus on identity, encryption, monitoring, resilience, and software assurance across all PBM platforms that store or transmit PHI.

Control areas to evidence

• Identity and access: SSO, MFA, least privilege, periodic access reviews, and privileged access management.
• Encryption: TLS 1.2+ in transit; strong, managed encryption at rest with centralized key management.
• Audit and monitoring: immutable logs, SIEM correlation, alerting SLAs, and regular audit log reviews.
• Application security: secure SDLC, code review, SAST/DAST, software composition analysis, and API security controls.
• Vulnerability and patching: routine scanning, risk-based patch SLAs, penetration tests, and remediation tracking.
• Data loss prevention and eDiscovery: outbound filtering, tokenization where feasible, and defensible retention.
• Resilience: backups, disaster recovery RTO/RPO for PHI systems, and tested tabletop exercises.

Artifacts to request

• Network and data flow diagrams highlighting PHI stores and transmission paths.
• Penetration test summaries, vulnerability trends, and confirmed remediation.
• Access review reports, key management procedures, and encryption inventories.
• Change control records for PHI-impacting systems and services.

Key takeaways

• A signed, detailed Business Associate Agreement plus strong PHI safeguards are foundational.
• Independent certifications, recent test results, and transparent incident histories strengthen assurance.
• Ongoing governance and verifiable technical controls are essential to maintain HIPAA compliance.

FAQs.

What is the role of Express Scripts as a Business Associate under HIPAA?

Express Scripts, acting as a Pharmacy Benefit Manager for covered entities, typically functions as a Business Associate. That role requires implementing HIPAA Privacy and Security safeguards, using/disclosing PHI only for permitted purposes, flowing down protections to subcontractors, reporting incidents, and supporting you in meeting your Legal HIPAA Responsibilities as defined in the Business Associate Agreement.

How does Express Scripts ensure protection of Protected Health Information?

Protection is demonstrated through layered controls: documented policies mapped to the HIPAA Security Rule, workforce training, risk assessments, encryption, access controls, logging and monitoring, vendor oversight, and tested incident response. Ask for concrete evidence—risk analyses, audit logs, penetration test summaries, and program metrics—that show these Data Privacy Safeguards operate effectively.

What certifications demonstrate Express Scripts' HIPAA compliance?

No certification alone proves HIPAA compliance, but independent assurance helps. Seek a current HITRUST CSF certification, a SOC 2 Type II report with HIPAA mapping, and/or ISO/IEC 27001 certification covering in-scope environments. Evaluate dates, scope, exceptions, and remediation to understand how well these Compliance Certifications support ongoing HIPAA obligations.