Electronic Visit Verification became a federal mandate through the 21st Century Cures Act, which required all states to implement EVV for Medicaid personal care and home health services. The mandate is now fully effective across all states, and virtually every home health agency serving Medicaid patients operates an EVV system that captures visit time, duration, location, and patient and caregiver identity through GPS-enabled mobile applications. This data is ePHI. It's also location data — a category that carries privacy sensitivities beyond standard HIPAA considerations. And it's a system that most home health HIPAA programs haven't fully integrated into their security framework.
Why EVV Data Is ePHI and What That Means
EVV data identifies a specific patient, at a specific location, receiving a specific service, at a specific time, from a specific caregiver. Each element individually may not be PHI. In combination — which is how EVV systems store it — it unambiguously constitutes protected health information under HIPAA. The home address captured in EVV isn't just location data — it's the patient's home address associated with their care episode, making it PHI with all the security protections that implies.
The HIPAA Security Rule applies to EVV systems exactly as it applies to EHR systems: the platform must be covered by a BAA with the vendor, data must be encrypted in transit and at rest, access must be controlled on a need-to-know basis, audit logs must be maintained and reviewed, and the platform must be included in the HIPAA Security Rule risk analysis as part of the ePHI inventory.
State-Managed EVV Systems and the BAA Question
Many states have implemented state-managed or state-contracted EVV systems — where the EVV vendor is contracted by the state Medicaid program rather than by the individual agency. This creates a nuanced BAA situation: the agency is disclosing patient information to an EVV system it did not select and cannot negotiate with directly. State guidance on whether the state EVV contract constitutes a BAA equivalent varies. Home health agencies should confirm with their state Medicaid program whether the state EVV contract includes BAA provisions — and if it does not, should seek guidance on how to document this disclosure in their compliance program. This BAA-management responsibility falls squarely within the Security Officer's vendor oversight duties — EVV vendors should be added to the same BAA inventory maintained for every other system touching ePHI.
Agency-Selected EVV Platforms: Security Assessment Requirements
For agencies that select their own EVV vendor rather than using a state-mandated system, the vendor security assessment process applies:
Request and review the EVV vendor's SOC 2 Type 2 report or equivalent security certification
Execute a signed BAA with the vendor before any patient data enters the system
Verify that the EVV vendor's BAA includes sub-contractor provisions covering any cloud infrastructure provider the vendor uses
Review the vendor's encryption standards for data in transit (GPS data transmitted from field devices) and at rest (stored visit records)
Confirm the vendor's breach notification timeline in the BAA aligns with HIPAA requirements