Why Security Must Be on Every Evaluation Checklist for Employer Plan Sponsors
.webp)
When your organization evaluates a pharmacy benefit manager (PBM), medical benefit administrator, or any other specialty care or service provider, you're likely focused on cost, transparency, reporting, and member care. Those are the right things to focus on.
Three questions, though, often come last, if at all:
- How secure is this platform?
- Where is the data stored?
- Who owns the infrastructure?
Those questions matter more than most buyers realize.
Our new, free buyer's guide, Why Security Must Be on Every Evaluation Checklist for Employer Plan Sponsors, explains why and gives you a practical way to ask them.
Your Benefits Partners Hold Some of Your Most Sensitive Data
For benefits plan sponsors, understanding how to evaluate service providers to their health plans is no longer an option, it’s mandatory. Pharmacy benefit managers (PBMs), medical benefit administrators, and other care providers sit at the center of some of the most sensitive data your plan members will ever generate:
- Claims history
- Eligibility records
- Diagnoses
- Prescriptions
- Other personal information
A breach doesn't just expose that data. It triggers regulatory action, erodes member trust, and can cost millions to remediate.
The threat is real. Last year alone, there were more than 750 breaches affecting more than 500 individuals. They ranged from smaller incidents impacting a couple thousand people to the massive Change Healthcare compromise, which touched hundreds of millions of Americans and crippled the system.
So why do security questions so often get treated as a formality in the RFP process?
A Guide Grounded in Practice, Not Theory
The whitepaper is based on feedback from Shane Garoutte, Chief Information Security Officer at Judi Health. He shares what he learned leading the organization through FedRAMP® Ready status, HITRUST certification, and a range of other security milestones.
It's written for the technology, security, and benefits leaders who carry the due diligence behind an RFP or vendor evaluation. Each section breaks down into key takeaways and a short list of questions you can bring straight to your next finalist meeting.
Here's a preview of what you'll find:
What a Vendor's Security Posture Tells You
A vendor's security posture works as a proxy for how seriously it takes sensitive business data, including your members' data.
When security is a C-suite priority, it shows up in how every team handles data, from implementation to member services to account management. When leadership treats it as an IT problem, gaps appear exactly where you can't afford them.
Culture matters too. A culture of accountability surfaces problems early. A culture of fear hides them until it's too late.
I really challenged the business when we first went down this road toward FedRAMP® Ready status. I said it can't be something that's driven by the security team. It has to be something that's driven by the executive team and the C-suite." — Shane Garoutte, Chief Information Security Officer, Judi Health
The guide gives you questions to test this directly, such as who owns security at the executive level and how accountability flows to the teams handling your plan and member data.
The Credentials That Show a Vendor Is Serious
SOC 2 Type 2 and HITRUST are the floor. FedRAMP® Ready status signals a higher level of maturity because it's not a one-time or annual check. It's continuous and constant, verifying controls as the platform evolves rather than at the moment of a snapshot audit.
Why Platform Ownership Matters
Platform ownership isn't just a technical distinction. It shapes how quickly a vendor can adapt, improve, and respond when plan sponsors need something. It may also determine where your data lives, which could be much farther away than anyone would expect.
For example, some PBMs have accelerated their strategies by acquiring other companies' platforms. Rented, acquired, or stitched-together technology can introduce more handoffs, integration gaps, and possible data risk (including data being stored offshore). The guide includes a simple but revealing question to ask every finalist: If we chose you, where would our plan data and our members' data be stored, and will any of it reside outside the U.S.?
What Security Looks Like Day to Day
Credentials confirm that a vendor built a platform securely. Your evaluation should also probe how the vendor manages security every day.
The whitepaper walks through five practical areas to examine:
- Data in transit and at rest
- Incident response
- Integration security
- Vendor chain
- Access controls
Put Security on the Checklist From the Start
The organizations that get this right treat security and technology as a filter from the first conversation, not a cursory due diligence item at the end.
Your benefits partner will hold some of your members' most sensitive information, process claims that affect their care, and integrate with your existing systems. Done poorly, those connections expose you to risk. Done correctly, they can improve the member experience and overall outcomes.
Download the Whitepaper
If you're preparing for an RFP or evaluating a pharmacy or medical benefit administrator, click here to access this guide so you can organize the questions worth asking - the ones that matter to you, your organization, and your plan members - before you sign your next partner contract!
And if you'd like to go deeper, contact the Judi Health team! We’re always open to technical conversations.
Bring your hardest questions!
.webp)
