HIPAA, DOL and privacy compliance for TPAs and benefit plans.
Third party administrators sit between employers, plans and participants, and regulators expect you to protect all of their data. Eagle helps TPAs and plan sponsors meet HIPAA, Department of Labor cybersecurity and privacy expectations, and answer the security questionnaires your clients send.
Your clients’ regulators are your regulators.
As a TPA, you are a HIPAA business associate of every group health plan you serve. You must run a risk analysis, maintain written security policies, train staff, and report breaches to your plan clients.
The Department of Labor’s cybersecurity guidance sets expectations for ERISA plan fiduciaries and their service providers, and in 2024 EBSA confirmed it covers all ERISA plans, including health and welfare plans. Plan sponsors now ask their TPAs to prove they follow it.
Privacy obligations don’t stop at HIPAA. TPAs that administer plans for employers with EU staff may handle data covered by GDPR, and state privacy laws such as California’s CCPA reach data HIPAA doesn’t. Eagle builds one program that covers HIPAA, DOL guidance and these privacy laws together.
A compliance program your clients can verify.
Security risk assessment
A HIPAA and DOL-aligned assessment of your systems, vendors and processes, with prioritized fixes.
Policies and procedures
TPA-specific HIPAA and cybersecurity policies, written or customized for you.
Client security questionnaires
Help answering employer and plan sponsor due-diligence requests, backed by real documentation.
Privacy program
GDPR, CCPA and state privacy compliance alongside HIPAA, including data mapping and privacy notices.
Training
Security awareness and HIPAA training with records you can show clients and auditors.
vCISO
Ongoing security leadership, annual program reviews and support for self-insured plan sponsors.
How we build your program.
Assess
Review your systems, vendors and data flows against HIPAA, DOL and privacy requirements.
Document
Put policies and procedures in place that match how you operate.
Train
Train staff and keep records clients and auditors will ask for.
Prove
Answer client questionnaires and audits with confidence.
Prefer to handle it in-house?
TPA Compliance Program
Policy templates, a security risk assessment template, a year of the Eagle Training Portal and staff training.
Learn more →HIPAA Policy Templates for TPAs
HIPAA and DOL cybersecurity policy templates written for third party administrators.
Learn more →Templates for Self-Insured Group Health Plans
HIPAA Privacy and Security policy templates for plan sponsors.
Learn more →Talk with a TPA compliance consultant.
Tell us about your plans, clients and the requests you are getting. We will follow up to talk through where you stand.
Schedule a consultation