Identity Verification before disclosing protected health information
Key Takeaway
Before sharing sensitive information, an agent must verify the caller's identity, no matter who the caller is. If someone calls on another person's behalf, use Verify Customer Identity V2 to verify each person.
Identity Verification is an Agentforce Health feature that makes an agent confirm who a caller is before sharing any sensitive or protected health information. Healthcare organizations must comply with regulations such as HIPAA. Failing to comply has legal consequences. You configure which records to search and which questions to ask, so the process fits each organization's business and legal requirements.
The core rule
An agent must verify the caller's identity before sharing sensitive information, no matter who the caller is. The caller could be:
- A patient
- A parent or guardian, if the patient is a minor
- A patient's authorized representative
- A provider
A question about public information, such as a hospital's location, doesn't need verification.