Vendor Risk Management for Employee Assistance Program Providers: HIPAA Compliance Checklist

When does HIPAA apply to an employee assistance program?

HIPAA does not automatically apply to every employee assistance program (EAP). It depends on the organization providing the services, the program’s relationship to a health plan or covered provider, and whether the relevant organization meets HIPAA’s definitions of a covered entity or business associate.

An EAP provider may be a covered health care provider if it provides health care and conducts covered transactions electronically. An EAP that performs services involving protected health information (PHI) on behalf of a covered group health plan or another covered entity may instead be a business associate. A program’s name or its employer sponsorship alone does not settle the question; assess the parties’ actual functions and data flows. See HHS guidance on covered entities and business associates.

HIPAA generally does not regulate an employer’s employment records, even when those records contain health-related information. But health plan or provider records about an employee can remain protected PHI. Employers should distinguish ordinary workforce administration from the administration of a covered group health plan. See HHS guidance on employers and health information in the workplace.

For an initial checklist, identify the entity sponsoring the EAP, the entity contracting with the provider, the services performed, and each party that creates, receives, maintains, or transmits PHI. Then document which HIPAA role applies to each party and why.

Which EAP vendors qualify as business associates?

An EAP vendor generally qualifies as a business associate when it performs a function or service for a covered entity that involves creating, receiving, maintaining, or transmitting PHI. For example, a vendor providing counseling or case-management services on behalf of a covered group health plan may be a business associate. A vendor that acts solely as an employer’s service provider may not be one under HIPAA if it does not handle PHI on behalf of a covered entity—but other privacy, employment, or state-law obligations may still apply.

Assess the relationship in practice rather than relying only on the contract’s label. Map the PHI the vendor handles, the purpose of each disclosure, who controls the program, and whether the vendor is acting for the health plan, a covered provider, or the employer in a separate employment capacity. HHS explains that a business associate relationship turns on the services performed and the use or disclosure of PHI, not simply on an organization’s title. See HHS Business Associates FAQs.

Also identify any downstream service providers that create, receive, maintain, or transmit PHI for the EAP vendor. These may include hosting, scheduling, messaging, or records-management providers. Where the HIPAA business-associate rules apply, the vendor must address subcontractors flow-down obligations through written agreements before allowing those subcontractors to handle PHI.

What must an EAP business associate agreement include?

A HIPAA business associate agreement (BAA) should clearly define the vendor’s permitted and required uses and disclosures of PHI, prohibit other uses or disclosures unless required by law, and require safeguards appropriate to the information handled. It should also require the vendor to report impermissible uses or disclosures, security incidents, and breaches of unsecured PHI to the covered entity.

Under the HIPAA rules, the agreement must address the vendor’s support for applicable individual rights and covered-entity duties, access to relevant records by HHS for compliance review, and the return or destruction of PHI at termination when feasible. It must also require the vendor to bind relevant subcontractors to applicable privacy and security restrictions and conditions, and authorize termination for a material violation. See HHS sample business associate agreement provisions.

Make incident procedures operational, not merely aspirational. Specify how the vendor will report suspected incidents, what information it will provide to support an investigation, how the parties will coordinate notices, and whether the contract imposes a reporting deadline shorter than HIPAA’s outer limit. HIPAA’s breach notification requirements obligate a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; a BAA can set a shorter contractual deadline. See the HHS Breach Notification Rule guidance.

Do not assume a vendor’s standard BAA fully addresses EAP-specific workflows. Clarify which party handles requests for records, complaints, security investigations, and notices, and describe how the vendor will keep employer-facing reports separate from clinical PHI.

How to assess and document vendor privacy and security risks

Before sharing PHI, assess the EAP vendor’s services, data flows, systems, workforce access, subcontractors, and incident-response capability. Identify the information involved, where it is stored or transmitted, who can access it, and how the vendor will return, retain, or destroy it when the relationship ends.

For a covered entity or business associate, the HIPAA Security Rule requires an accurate and thorough risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI. A useful review records identified risks, their likelihood and potential impact, existing controls, gaps, and planned corrective actions. It should be revisited as services, systems, threats, or data flows change; HIPAA does not prescribe one universal assessment template or review interval. See HHS guidance on HIPAA Security Rule risk analysis.

Request evidence proportionate to the vendor’s role and risk, such as security policies, relevant assessment results, incident-response procedures, workforce training practices, and information about material subcontractors. HIPAA does not expressly require every vendor to provide a particular audit report or permit a customer audit, so document such requests and commitments in the BAA or other contract where appropriate. HHS notes that customers may seek additional assurances based on their own risk analysis and risk management. See HHS guidance on HIPAA and cloud computing.

• Document the EAP service, HIPAA roles, PHI categories, systems, and data flows.
• Record the vendor’s risk findings, safeguards, open issues, and remediation owners and dates.
• Review subcontractor access and the applicable subcontractor flow-down obligations.
• Retain the BAA, relevant review materials, approvals, and significant follow-up decisions.

Which security safeguards should EAP vendors implement?

The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for electronic PHI. It is designed to be scalable: safeguards should reflect the organization’s size and capabilities, technical environment, costs, and the probability and criticality of risks. The Rule does not prescribe a single security product or configuration for every EAP vendor. See the HHS overview of the HIPAA Security Rule.

As part of a risk-based review, examine whether the vendor has safeguards such as:

• Administrative safeguards: assigned security responsibility, workforce security measures, security awareness and training, incident procedures, contingency planning, and ongoing risk management.
• Physical safeguards: controls for facilities, workstations, devices, and media that could contain or provide access to PHI.
• Technical safeguards: access controls, authentication, audit controls, integrity protections, and transmission security for systems that handle electronic PHI.

Check that the vendor can limit system access to authorized users, record and examine relevant activity, respond to security incidents, and recover or restore data when needed. Encryption is an important protection to assess, but avoid treating a particular encryption setup as a universal standalone HIPAA certification or as proof of compliance. Determine appropriate measures through the risk analysis and applicable Security Rule requirements. See the HHS summary of the HIPAA Security Rule standards.

How should employers limit access to EAP protected health information?

Employers should separate EAP clinical information from ordinary human-resources and management systems. Do not give supervisors or HR staff access to counseling notes, diagnoses, or identifiable participation details simply because the employer sponsors the program or pays the vendor. Whether a disclosure is permitted depends on the parties’ roles, the applicable HIPAA permissions, and any other laws governing the information.

Where a covered group health plan uses or discloses PHI for plan administration, plan documents and safeguards should restrict access to designated plan-administration personnel and separate those functions from employment decisions, as applicable. Establish role-based access controls so each authorized user can access only the information needed for an assigned task, and review access when roles change or end.

Use aggregate or de-identified reporting for employer program evaluations where feasible, and confirm that reports do not identify participants through small groups or unusual details. HHS explains that HIPAA generally controls disclosures by a covered health plan or provider, while the Privacy Rule does not protect an employer’s employment records as such. See HHS guidance on employers and health information in the workplace.

How to monitor vendors and manage remediation and termination

Set a review schedule appropriate to the vendor’s services and risk. Revisit material changes such as new systems, new subcontractors, expanded data use, or a security incident. Contractual review rights, evidence requests, and reporting commitments can help you evaluate the relationship, but HIPAA does not generally require covered entities to continuously monitor every means by which a business associate implements safeguards.

If you become aware of a material breach or violation of the BAA, investigate the available facts and take reasonable steps to cure the breach or end the violation. If those steps do not succeed, terminate the BAA when feasible; if termination is not feasible, report the problem to HHS as required. See HHS guidance on responding to business-associate violations.

For a significant incident, preserve relevant records, coordinate investigation and mitigation with the vendor, and determine whether breach notification is required. Document the decision, the evidence considered, and any notices made. At contract end, disable access, recover or securely destroy PHI when feasible, address any required retention, and document the disposition consistent with the BAA and applicable law. For a security incident, preserve relevant records and coordinate investigation and mitigation with the vendor.

Substance use disorder records may carry additional confidentiality protections under 42 CFR Part 2 when the information comes from a federally assisted Part 2 program. The 2024 Part 2 final rule’s general compliance date was February 16, 2026; assess whether the EAP’s services or records fall within Part 2 and update consent, disclosure, and redisclosure procedures accordingly. See SAMHSA’s Part 2 statutes and regulations guidance and the 2024 Part 2 final rule.

In short, determine the EAP vendor’s HIPAA role, put required protections in a BAA, assess and document security risks, restrict access, and respond promptly to incidents and material contract violations.

FAQs

Does HIPAA apply to every employee assistance program?

No. HIPAA applies when an organization is a covered entity or business associate under the rules. An EAP’s status depends on the services it provides, its relationship to a covered health plan or provider, and whether it handles PHI in that role. An employer’s health-related employment records are not automatically HIPAA-protected PHI.

When does an EAP vendor need a business associate agreement?

An EAP vendor generally needs a BAA when it performs services on behalf of a HIPAA covered entity and creates, receives, maintains, or transmits PHI in doing so. The covered entity should determine the vendor’s role from the actual services and information flows, not just the vendor’s name or contract label.

Can an employer access an employee's EAP records?

Not simply because it sponsors the EAP. An employer should not assume it may access identifiable counseling records or other clinical information. Any permitted access or disclosure depends on the applicable HIPAA roles and permissions, the specific information, and other relevant laws. Keep clinical records separate from employment records and limit employer-facing reports to information that is permitted and necessary.

What additional restrictions may apply to substance use disorder records?

42 CFR Part 2 may apply to records from a federally assisted program that provides substance use disorder diagnosis, treatment, or referral for treatment. Depending on the circumstances, Part 2 may impose additional consent, use, disclosure, and redisclosure restrictions beyond HIPAA. Determine whether the program and records qualify, and ensure the vendor and relevant downstream parties follow applicable requirements.