Every Call Carries PHI: How a Healthcare Contact Center Uses HITRUST e1 for Right-Sized, Year-After-Year Assurance
Client profile: U.S. customer experience outsourcing provider running inbound, outbound and work-at-home contact center services for health plans and other leading brands
The client handles member conversations on behalf of health plans: answering benefit and service questions, running outreach campaigns and completing health risk assessments with members. Almost every one of those interactions involves protected health information, from member IDs to conditions and medications.
That makes the client a business associate under HIPAA, and its health plan clients treat it that way. They want independent evidence that member data is protected across every agent, workstation and system that touches it, and they want that evidence renewed every year.
What the client didn’t need was the heaviest HITRUST assessment on the market. Working with ValueMentor, it chose HITRUST e1 and has kept it current year after year. Along the way, it challenged three common assumptions about HITRUST healthcare compliance.
Myth 1: “HITRUST is for technology companies, not contact centers”
The reality: if your people see or hear PHI, your health plan clients will expect proof that you protect it.
Contact centers sit right in the middle of the member relationship. Agents open member records, take calls that include health details, and work across CRM, telephony and quality monitoring systems. To a health plan, that is third-party risk like any other vendor. HITRUST gives a contact center the same recognized language of assurance that health plans already use for their technology vendors, instead of a different questionnaire for every client.
Myth 2: “Serving large health plans means pursuing the largest assessment”
The reality: assurance should match the risk and purpose of the environment being assessed, not the size of the client list.
We started by defining a scope around how member information actually moves through the client’s operations: the systems agents use, how access is granted and removed, and how calls and records are handled. For that environment, the e1 was the right fit: a foundational, independently validated HITRUST assessment of 44 essential cybersecurity controls, recognized across U.S. healthcare and achievable without the cost and disruption of a full r2. It gives the client a clear, HIPAA-aligned answer for every health plan it serves.
What e1 controls look like in a contact center
| Control area | What it means on the contact center floor |
|---|---|
| Access control | Agents see only the member data their queue needs, and access is removed quickly when people change roles or leave, which matters in a high-turnover workforce |
| Endpoint protection | Agent workstations are patched, encrypted and protected, whether agents work on-site or from home |
| Security awareness | Training covers social engineering over the phone, not just email phishing |
| Incident response | Agents know exactly how to report a suspected data exposure during or after a call |
| Third-party oversight | Telephony, CRM and cloud providers are reviewed for how they handle member data |
Myth 3: “Certification is a one-time project”
The reality: an e1 certification is valid for one year. A lapsed certificate is a gap health plans notice in their next vendor review.
For the client, keeping assurance continuous matters as much as the certificate itself. So rather than treating each year as a fresh project, ValueMentor runs it as a steady cycle.
What a year of HITRUST e1 looks like
| Phase | What happens | Why it matters |
|---|---|---|
| Re-scope | Review new client programs, systems, vendors and working models since the last cycle | Keeps the certificate accurate as the business grows |
| Refresh evidence | Collect updated evidence using standard request templates | Teams know exactly what is needed and when, with no last-minute scramble |
| Track through the year | Monitor open items and control changes between assessments | Issues are fixed as they appear, not found at assessment time |
| Assess and pass QA | Coordinate with the External Assessor and manage HITRUST QA responses | Keeps the renewal on schedule |
| Share and repeat | Updated report shared with health plan clients; planning starts for the next cycle | Assurance never lapses |
The outcome
- HITRUST certification maintained continuously, year over year
- One consistent, independently validated answer to health plan vendor reviews
- A proportionate HITRUST healthcare compliance program that protects member data without slowing down operations
- A foundation to move up to i1 or r2 if clients require it later, since all three tiers are built on the HITRUST CSF
Is HITRUST e1 the right starting point for you? A quick self-check
Answer these five questions honestly:
- Do health plans or other healthcare clients ask you for HITRUST, without specifying i1 or r2?
- Is the environment that handles PHI focused and well defined, rather than your entire organization?
- Do you need a recognized credential quickly, within your current budget?
- Are you new to HITRUST, or moving up from questionnaires and self-assessments?
- Would a yearly renewal cycle fit how your organization plans compliance work?
Mostly, yes? An e1 is likely the right fit. Mostly no, or clients name i1 or r2 in contracts? A higher tier may serve you better, and we’ll tell you which one.
Our HITRUST compliance services start with an honest recommendation: the assessment that fits your risk, clients and timeline, not the most expensive one. Book a HITRUST scoping call or read more about HITRUST e1.
