Health Insurance Security: 10 Best Practices for Agencies & AI Tips

Table of Contents

• What health insurance security means for your agency
• 10 tips to keep your agency secure year-round
• What security looks like at AgencyBloc
• Frequently asked questions about health insurance security

What Health Insurance Security Means for Your Agency

Health insurance security is about keeping electronic protected health information (e-PHI) secure across your agency’s systems and processes. That starts with understanding what happens to sensitive information once it enters your agency.

So, what should your agency actually be doing? In this blog, we’ll cover 10 practical security tips to help protect sensitive information and build better security habits across your agency.

Tip 1: Keep Your HIPAA Security Risk Analysis Up to Date

The HIPAA Security Rule sets expectations for how organizations and service providers handle e-PHI. One of those requirements is a risk analysis. Under 45 CFR § 164.308, agencies and vendors that hold e-PHI must assess risks to that data. That means mapping where e-PHI is located and identifying which safeguards reduce those risks.

Here's where e-PHI typically shows up across your agency:

• Your agency management system (AMS) and CRM house client and policy files your team opens all day long.
• Email and attachments house applications, Scope of Appointments (SOAs), ACA compliance documents, and carrier notices.
• Shared drives and desktops store exports, spreadsheets, and temporary folders.
• Phones and tablets house photos of IDs, voicemails, text messages, and emails.
• AI and browser tools store prompts, uploads, and browser extensions.

A solid risk analysis shows you where your agency is exposed, so your safeguards actually match the risks you face.

Use the free HIPAA Security Risk Assessment Tool to walk through the assessment process step by step. Keep in mind this is a helpful starting point, not proof of compliance on its own.

Tip 2: Clean Up Your Passwords & Stop Reusing Them

How many logins tie back to the same password across your agency? Weak or reused passwords are one of the easiest ways attackers get in.

Reusing passwords is easier to manage and remember, but reused passwords can open your agency up to significant risk. A reused password can make it easier for an attacker to gain access to multiple accounts. If one password is compromised, every account using that same password could be at risk.

Here are 4 password best practices to follow at your agency:

1. Use a unique password for every account. Never reuse a password.
2. Choose long passphrases. A passphrase is a password made up of several words or a longer string of characters. Random words or a password manager-generated string are better than short passwords with predictable patterns.
3. Avoid storing passwords in spreadsheets. Storing shared passwords in Excel files or other unsecured documents creates another place for client and policy information to be exposed.
4. Use a password manager. A password manager can create and securely store unique passwords, so your team does not have to rely on memory or sticky notes.

Taking a few extra steps with passwords can go a long way toward keeping your information and accounts secure.

Tip 3: Protect Your Accounts With Multi-Factor Authentication

Even secure passwords can be compromised. Multi-factor authentication (MFA) adds a second layer of protection by requiring your password plus another form of verification, such as a code sent to your phone or a fingerprint scan. This is also called two-factor authentication or 2FA.

MFA can greatly reduce the risk of someone gaining access to a secured account. Adding a second verification step adds another layer of protection. If an attacker steals a password, they still need that second step to access the account. It is especially important for accounts that can access sensitive information or have admin-level permissions.

Start with the accounts that have access to the most sensitive information:

• Email
• AMS/CRM
• Carrier & enrollment portals
• Banking & financial accounts
• Admin accounts

When you can, use an authenticator app instead of text message codes. Authenticator apps are generally more secure because the code isn't sent through the phone network.

Tip 4: Help Your Team Spot Phishing Attempts

Phishing emails do not always look suspicious. A message can appear to come from a familiar person or company while containing a harmful link or request.

Before your team clicks or responds, take a moment to check the message. Knowing a few common warning signs can help you recognize phishing attempts and avoid putting your agency’s information at risk.

Watch for these common red flags:

• Urgent requests: Be cautious of messages asking you to verify information or act immediately.
• Unfamiliar sender addresses: Check the email address carefully. Look for small changes or domains that do not match the company.
• Unexpected attachments or links: Be careful with files or links you were not expecting, even if the message looks legitimate.
• Requests for passwords or verification codes: Do not share passwords or one-time codes through email or over the phone.
• Requests to change payments or commissions: Verify unusual financial requests using a known phone number or another trusted method.

AI can make phishing messages harder to spot by making them look more polished and convincing. When something feels unusual, take a moment to verify the request before taking action.

You can also reduce security risks by limiting how client and policy information is shared. Rx Collect gives Medicare clients a secure, compliant way to submit prescription and health information without sending sensitive details through email attachments.

Tip 5: Protect Your Data With Encryption

Encryption helps protect your agency’s information by turning it into a coded format that cannot be easily read without the right key or access. That protection matters whether data is moving between systems or being stored.

HIPAA's Security Rule (45 CFR § 164.312) lists encryption as an "addressable" safeguard for protecting electronic health information (e-PHI). But "addressable" doesn't mean optional. Your agency needs to assess its specific risks and decide how to integrate encryption. If you decide not to encrypt something, document why and put another safeguard in its place that provides the same level of protection.

Review how encryption protects your agency’s information in these areas:

• When data is sent: Use secure connections, such as HTTPS, when information moves between systems.
• When data is stored: Encrypt information saved on laptops, servers, databases, and backups.
• When information is shared: Use secure methods when sending sensitive information by email or transferring files.

Your AMS vendor should be able to explain what encryption they use and how it protects your agency’s data. Use these questions to help evaluate their approach. Download AgencyBloc’s Agency Management System Security Questions Checklist to guide your vendor review.

Tip 6: Secure Devices, Networks, & Remote PHI Work

Working outside the office gives your team more flexibility, but it also creates more places where sensitive information can be exposed. Laptops may be used in different locations, connected to insecure or unfamiliar Wi-Fi networks, or left without important software updates. All of this can leave a device — and your data — vulnerable.

That's exactly why device and network habits matter just as much outside the office as inside it. Follow these device and network best practices to keep your agency's information secure, wherever your team is working:

• Lock your screen: Always lock your laptop when you step away, even if you will only be gone for a few minutes.
• Protect your computer with a password: Make sure every computer used for your agency requires a password to sign in. Follow the password best practices outlined above, including using long, unique passphrases.
• Keep devices with you: Do not leave laptops unattended in vehicles, meeting rooms, or public places where they could be lost or stolen.
• Use trusted networks: Avoid public Wi-Fi when accessing sensitive information. Use a secure connection approved by your IT team when working remotely.
• Keep software updated: Operating system and application updates often address known security issues, so install them as soon as possible.
• Limit user access: Give employees access to the systems and information they need for their roles, then review those permissions when responsibilities change.
• Monitor account activity: Watch for failed logins, unusual exports, and other activity that falls outside normal patterns.

Protecting your devices and networks is an important part of protecting the sensitive data your team handles every day.

Tip 7: Run a Regular Data Audit

You can't protect information you can't account for. A data audit gives you a clear picture of where your information is. 

Run through these questions during your data audit:

• Where does your data live? Check your AMS/CRM, email, shared drives, paper files, and any third-party tools your team uses day-to-day.
• How does data move through your agency? Know where information enters your systems, who touches it along the way, and where it ends up stored or shared.
• What can you get rid of? Review outdated spreadsheets and old files your agency no longer needs, then dispose of them appropriately.
• Is your documentation easy to find? Store security policies, access records, and other compliance documentation somewhere your team can pull up quickly.

The fewer places sensitive information lives, the easier it is to protect. Make this audit a regular habit, not a one-time cleanup, so you catch risks while they're still small.

Tip 8: Use AI Securely

AI tools can help your team save time, but they can also create new risks when sensitive information is shared. PHI and PII should be handled carefully when using generative AI or other AI-powered tools.

Knowing what information to include in an AI prompt is an important part of using these tools securely. AgencyBloc's AI Prompt Playbook includes examples to help your team get started.

Keep these AI security practices in place:

• Use approved AI tools: Make a list of AI tools your IT, legal, and/or leadership teams have reviewed and approved for use with agency information.
• Keep client & policy information out of consumer AI tools: Do not enter PHI, PII, member information, or other sensitive client data into personal or free consumer AI accounts.
• Ask how your data is handled: Before using an AI tool, understand how it stores information, whether it uses your data to train AI models, and which third parties may receive it.
• Use the minimum necessary information: When AI can help with a task, provide only the information needed to complete it. Remove names and other identifying details when they are not necessary.
• Review AI-generated content: AI can make mistakes or leave out important information. Have a team member review client-facing emails, documents, and other AI-generated content before sharing.
• Set clear expectations: Create an AI policy that explains which tools your team can use and what information they can enter.
• Choose tools with appropriate safeguards: If an AI tool will handle PHI, make sure your agency understands the vendor's HIPAA safeguards, including whether a business associate agreement (BAA) is available.

AI can be a useful part of your agency's workflow when the right safeguards are in place. Take the time to understand how each tool handles your information before giving it access to sensitive data.

Tip 9: Ask Vendors the Right Security Questions

Choosing an AMS or other technology partner involves more than comparing features and pricing. Take time to understand how each vendor protects your agency’s data.

Keep these vendor security questions in mind:

• Data storage: Where is your data stored?
• Data protection: How is your data protected/encrypted?
• Backups: How is your data backed up and recovered?
• Data ownership: Can you access and export your data?
• Access controls: How is user access managed?
• Security practices: How does the vendor handle updates and security issues?
• HIPAA: Will the vendor sign a BAA if it handles PHI?

The way your software is hosted can also affect your agency's security responsibilities. With a hosted AMS, the vendor typically manages the infrastructure, updates, and backups. With an on-premise system, more of those responsibilities fall to your agency or IT team. Make sure you understand what the vendor handles and what your agency is responsible for.

Tip 10: Centralize Data in a Security-First AMS

Every extra spreadsheet, inbox folder, or tool that houses client data (like an AMS/CRM or quoting and enrollment tool) adds another place where PHI can be at risk. And once information is scattered across multiple tools, it's much easier to lose track of who has access to what.

A purpose-built AMS gives your team:

• A single source of truth: Client and policy records stay consistent instead of living in different versions elsewhere.
• Clearer visibility into access: You can see who has access to what, making it easier to spot gaps.
• Fewer manual handoffs: Less copying and pasting between tools means fewer errors or chances for sensitive data to end up somewhere it shouldn't.
• Easier audit prep: Centralized activity and records mean you're not digging through multiple tools when it's time to produce documentation for auditors or compliance reviews.

Centralizing your data and processes into an AMS is a great step in the right direction, but it only works if the platform holding that data takes security just as seriously as you do. Be sure to partner with a vendor who cares about the safety of your data.

What Security Looks Like at AgencyBloc

Security is something we take seriously at AgencyBloc. AgencyBloc is HIPAA-compliant and audited regularly for HITRUST and SOC 2 Type II. We also take a layered approach to data security. Encryption helps protect information as it moves between systems, while backups and ongoing monitoring add additional safeguards.

For AI, AgencyBloc Intelligence brings assistance into AMS+ while keeping agency data private. Customer data is not used to train shared or public AI models, and humans stay in the loop before final actions are taken.

FAQ

What is a business associate agreement (BAA), and when does my agency need one?

A business associate agreement (BAA) is a contract between your agency and a vendor that handles PHI on your behalf. If a vendor, including an AI tool, will have access to client or policy information, your agency may need a BAA with that vendor. The agreement outlines how the vendor must handle and safeguard that information.

Hosted vs. on-premise for agency PHI data?

With hosted SaaS, the vendor takes on infrastructure, patching, and multi-location backups so your team doesn't have to. On-premise keeps that work in-house, usually with your own IT support handling it. Neither option comes with automatic compliance built in. That depends on the contract terms, access controls, and how your risk analysis actually gets applied.

What is a SOC 2 Type II report?

A SOC 2 Type II report is an independent attestation of security-related controls over a period of time. It helps agencies evaluate whether a vendor's safeguards operate consistently.

Does a SOC 2 Type II report mean a vendor is HIPAA compliant?

Not on its own. SOC 2 Type II confirms a vendor's security controls held up over time, but it isn't a HIPAA certification. HIPAA compliance depends on safeguards for health information that SOC 2 doesn't evaluate.

Posted by Shannon Beck on Monday, October 12, 2026 in Data Management & Security

1. ai
2. data management