HIPAA

HIPAA compliance and protected health information. Benefits data, leave records, and health plan files carry obligations that do not disappear because the data is in a spreadsheet. Here is how we handle them.

Momentum acts as a business associate where PHI is in scope.

When an engagement involves protected health information — benefits enrollment files, claims extracts, leave and accommodation records — we execute a Business Associate Agreement before any data is transferred, and we operate under it for the life of the engagement and the retention period that follows.

Placeholder for legal review: the language below summarizes our practices and is not a substitute for the executed BAA. Final wording should be confirmed by counsel before publication.

Administrative, Physical, and Technical Controls.

• Minimum necessary — We request only the fields required to complete the defined scope of work, and we document the justification for each PHI element received.
• Strict Access Control — PHI is restricted to named personnel assigned to the engagement, under unique credentials with multi-factor authentication and role-based permissions.
• Encryption — Data is encrypted in transit and at rest. Transfers use secure managed file transfer or client-provided secure channels — never email attachments.
• Workforce Training — All personnel complete HIPAA privacy and security training at onboarding and annually thereafter, with completion records retained.
• Incident Response — Suspected impermissible use or disclosure is escalated immediately and reported to the covered entity within the timeframe required by the BAA.
• Retention and Destruction — PHI is returned or destroyed at the conclusion of the engagement, per the BAA, with written certification of destruction on request.

Need our HIPAA documentation package?

We provide our BAA template, safeguards summary, and training attestations on request. Contact compliance →

Also on our main site: www.momentumdatasolutions.com/hipaa