Vendor Risk Management and HIPAA Compliance for Dual Eligible Special Needs Plans

Dual Eligible Special Needs Plans (D-SNPs) rely on vendors to support care coordination, claims, member services, data exchange, and other plan operations. Managing those relationships means looking beyond a vendor’s security questionnaire: you also need to understand what information it handles, what role it performs, and how state Medicaid agency contract requirements affect the work.

HIPAA requirements depend on the parties’ roles and activities. A vendor that performs services involving protected health information (PHI) on a plan’s behalf may be a business associate, while other vendors or providers may not be. The D-SNP should also distinguish federal requirements from additional safeguards and oversight practices it sets through its contracts.

What vendor risks do D-SNPs need to manage?

Start by mapping each vendor’s services, data access, systems, and subcontractors. Assess both privacy and security risks and operational risks that could interfere with Medicare and Medicaid coordination, such as inaccurate member data, missed handoffs, delayed notices, or an outage that interrupts care-management services.

For vendors that create, receive, maintain, or transmit electronic PHI on behalf of a covered entity, the HIPAA Security Rule requires an accurate and thorough risk analysis and appropriate risk-management measures. Review the vendor’s safeguards in light of the information it handles and the harm that a loss of confidentiality, integrity, or availability could cause. See 45 CFR § 164.308 and HHS guidance on risk analysis and risk management.

Depending on the service and risk, a D-SNP’s vendor review may examine:

• What PHI and other sensitive information the vendor can access, and whether access is limited to what the service requires.
• How the vendor controls user access, authenticates users, records system activity, and protects information in transit.
• How the vendor detects and reports security incidents, responds to service disruptions, and restores operations.
• Whether downstream subcontractors handle PHI and what contractual safeguards apply to them.
• Whether service levels, data quality, reporting, and continuity plans support the D-SNP’s care coordination and program obligations.

These review practices help a plan manage risk; they are not all separate HIPAA-mandated assessment steps. HIPAA requires covered entities and business associates to meet applicable safeguards and contract requirements, but the particular review methods a D-SNP uses should reflect its risks, contracts, and state obligations.

Which vendors qualify as HIPAA business associates?

A vendor generally qualifies as a business associate when it is not part of the covered entity’s workforce and performs a function or service on the covered entity’s behalf that involves creating, receiving, maintaining, or transmitting PHI. Examples can include claims processors, care-management vendors, call-center operators, and cloud-service providers handling PHI for a plan. The service and relationship—not the vendor’s label—determine whether the relationship meets HIPAA’s definition. See HHS’s Business Associates guidance.

A supplier that does not use or disclose PHI to perform its service may not be a business associate. HIPAA also generally does not require a BAA just because one covered health care provider discloses PHI to another provider for treatment. A provider or health plan acting on its own behalf is not automatically the plan’s business associate simply because it exchanges information or submits a claim.

When a vendor is a business associate, the covered entity must have a written business associate agreement or other written arrangement that meets HIPAA requirements before allowing the vendor to handle PHI on its behalf. Use the same role-based analysis for each subcontractor in the vendor’s service chain.

What safeguards belong in a D-SNP business associate agreement?

A HIPAA business associate agreement should define what the vendor may and must do with PHI and require the vendor to protect it. Under 45 CFR § 164.504(e), required provisions address permitted uses and disclosures, safeguards, reporting of impermissible uses and disclosures, subcontractor obligations, individual rights where applicable, access to records for HHS oversight, and return or destruction of PHI at termination when feasible.

For electronic PHI, the applicable Security Rule requirements include administrative, physical, and technical safeguards. Access controls, audit controls, authentication, and transmission security are among the technical safeguard standards described in HHS’s Security Rule summary.

A D-SNP can use additional contract terms to make responsibilities workable in its operating environment. For example, it can specify a process for prompt incident escalation, define service-specific performance measures, require notice of material subcontractor changes, or set audit and evidence-sharing expectations. These are contract and risk-management choices, not universal HIPAA requirements with one federally prescribed format or deadline.

Downstream subcontractor oversight also matters. When a business associate engages a subcontractor that handles PHI on its behalf, the business associate must obtain the required written assurances from that subcontractor. Contracts can support this obligation by requiring an up-to-date subcontractor inventory, appropriate flow-down terms, and a process to address identified violations. See 45 CFR § 164.504(e)(2) and (e)(5).

How should vendors support Medicare and Medicaid care coordination?

Care-coordination vendors should work from the D-SNP’s approved workflows and the applicable State Medicaid Agency Contract (SMAC). Depending on the arrangement, their work may include coordinating services across settings, supporting individualized care planning, routing information to authorized care teams, and documenting referrals or follow-up. D-SNP state contracts must address specified roles and responsibilities, including coordination of Medicaid benefits; see 42 CFR § 422.107 and CMS’s D-SNP integration guidance.

HIPAA permits covered entities to use or disclose PHI for treatment, payment, and certain health care operations, subject to the Privacy Rule’s conditions and limits. It also permits certain disclosures between health plans for care coordination as a health care operations activity when the required relationship and purpose conditions are met. A vendor acting on behalf of a plan should access or disclose PHI only as permitted by the applicable HIPAA rules and its agreement with the plan. See HHS guidance on care coordination between health plans.

Set clear procedures for verifying recipients, transmitting only the information needed for the task, recording handoffs, correcting data, and escalating gaps. The D-SNP should also check relevant state Medicaid rules and contract terms, which may establish additional requirements for coordination or information sharing.

Who is responsible for hospital and skilled nursing facility admission notifications?

For D-SNPs subject to 42 CFR § 422.107(d)(1), the SMAC must provide for the plan to notify, or arrange for another entity to notify, the state Medicaid agency, its designated individuals or entities, or both, of hospital and skilled nursing facility admissions for at least one state-identified group of high-risk full-benefit dually eligible individuals. The state Medicaid agency establishes the notification timeframes and methods.

The federal rule excludes fully integrated and highly integrated D-SNPs from that particular paragraph’s notification requirement. State contracts may nevertheless impose similar requirements, so plans should check their own SMAC and applicable state rules. There is also a limited exception for certain partial-benefit-only D-SNPs under § 422.107(d)(2). See CMS’s Medicare Managed Care Manual, Chapter 16-B.

If the D-SNP assigns notifications to a vendor or another entity, the D-SNP retains responsibility for complying with the applicable federal notification requirement. This admission notification accountability should be reflected in clear operating procedures: identify who receives event data, who sends the notice, how deadlines are tracked, how failures are escalated, and how completion is documented. Contract terms can set vendor duties and remedies, but delegation does not remove the plan’s responsibility under the rule.

How should vendor contracts address integrated appeals and grievances?

First determine whether the D-SNP and affiliated Medicaid arrangement meet the definition of an applicable integrated plan. Unified procedures do not apply to every D-SNP in the same way. For applicable integrated plans, the state contract must document use of the unified appeals and grievance procedures identified in 42 CFR § 422.107(c)(9), including procedures under 42 CFR §§ 422.629–422.634 and relevant Medicaid regulations. See CMS’s D-SNP integration guidance and 42 CFR Part 422, Subpart M.

If a vendor supports intake or case processing, its contract and procedures should align with the plan’s integrated appeals and grievance procedures. Specify how the vendor will capture the date and nature of a complaint or appeal, route it to the right team, preserve records, support required notices, and alert the plan when a deadline or urgent-care issue may be at risk. The plan should retain appropriate controls over decision-making and ensure its procedures meet applicable federal and state timeframes.

CMS explains that a state may adopt more protective timeframes or notice requirements for applicable integrated plans, and the state contract must include differing standards. The CMS integrated-plan addendum also does not replace separate Medicare Part D procedures. Use the applicable rules and contract terms rather than assuming one vendor workflow covers every benefit or appeal type. See CMS’s guidance addendum for applicable integrated plans.

In practice, effective D-SNP vendor management connects HIPAA business associate agreements and protected health information safeguards with the plan’s Medicaid contract duties, care-coordination workflows, notification controls, and integrated appeals and grievance procedures. Clear role assignments, appropriate safeguards, and practical escalation paths help vendors support the plan without obscuring the D-SNP’s own responsibilities.

FAQs

When must a D-SNP vendor sign a HIPAA business associate agreement?

When the vendor is a business associate—that is, it performs a service on behalf of a covered entity involving PHI—the covered entity generally must have a compliant written agreement or arrangement before permitting that work with PHI. Whether a vendor qualifies depends on its actual role and service, not simply on its industry or contract title. See HHS’s Business Associates guidance.

Do subcontractors that handle protected health information need business associate agreements?

Generally, yes. A business associate that engages a subcontractor to create, receive, maintain, or transmit PHI on its behalf must obtain written assurances that the subcontractor will follow the applicable restrictions and conditions. The subcontractor agreement must meet the relevant HIPAA requirements. See 45 CFR § 164.504(e)(2) and (e)(5).

Can D-SNP vendors exchange health information for care coordination?

They may exchange or use PHI when the disclosure is permitted by HIPAA and the vendor’s role and agreement authorize it. HIPAA allows certain covered-entity disclosures for treatment, payment, and health care operations, including specified care-coordination activities. The parties should confirm the applicable purpose, recipient, minimum-necessary limits where they apply, and any additional state or contract requirements. See HHS’s care-coordination guidance.

Does a D-SNP remain responsible when a vendor handles admission notifications?

Yes, when the D-SNP is subject to the admission notification requirement in 42 CFR § 422.107(d)(1), the regulation states that the plan retains responsibility for complying even if it arranges for another entity to send notices. The plan should define vendor tasks, timelines, escalation procedures, and documentation in its operating arrangements and contracts.