Getting HIPAA-ready before the funding does

The problem

A small California nonprofit runs restorative transitional housing and credible-messenger mentorship for people coming home from incarceration. The founder came to Klaro with a specific request: help choosing a HIPAA-compliant electronic health record so the organization could bill Medi-Cal.

It was a reasonable question, and it was the wrong starting point. The organization had no formal data infrastructure yet — client information lived wherever the work happened to put it. Buying an EHR would have meant paying for software designed for a clinic, then bending a mentorship-and-housing program to fit it, before anyone had settled what the organization would actually be billing for.

Reframing the question

The first piece of work was figuring out how an organization like this actually gets paid by Medi-Cal. For a reentry and housing program, the route usually isn’t direct medical billing. It runs through CalAIM, California’s Medi-Cal transformation initiative, which pays community-based organizations to deliver Enhanced Care Management and Community Supports.

In practice, that means contracting with the region’s Medi-Cal managed care plan as an ECM and/or Community Supports provider, then documenting and invoicing that work through a secure case-management system. That changes the whole shape of the problem. The software still matters, but the bigger job is getting the organization contract-ready — clear on which services it will offer, able to document them the way the plan expects, and able to protect the health information that comes with them.

Credible-messenger programs are built on trust with people who have good reason to be wary of systems. Getting the data side right — consent that’s actually understood, and information that only goes where it should — is part of protecting that trust, not a separate compliance chore.

The recommendation: configure, don’t build

The recommendation was not to buy a platform in isolation or build one from scratch. Instead, the organization should adopt a vetted case-management system — ideally funded through a capacity grant — with Klaro acting as data architect and implementation lead: designing the data foundation, configuring the tools, and training staff to run them.

A custom build would have left a small nonprofit maintaining software it couldn’t afford to support. An off-the-shelf purchase with no design work behind it would have produced a system nobody used consistently, and documentation that couldn’t stand up to a billing review. The middle path puts the organization on supported software, set up around how its team actually works.

A phased scope, with a decision point up front

The engagement was scoped in seven phases: discovery and readiness; strategy, requirements, and funding; data architecture and standards; implementation and configuration; billing and reporting; compliance scaffolding; and training and handoff.

Each phase has a concrete deliverable. Discovery produces a current-state summary and an ECM and Community Supports readiness checklist, gap-checked against what the plan expects of its providers. Strategy produces a scored platform recommendation and a funding-ready requirements brief, including the technical justification a capacity-grant application needs for its IT line item. Data architecture produces a data model designed so that documentation is billing-ready by construction, along with a data dictionary, naming conventions, and a consent and data-sharing design. Later phases configure the platform, build the billing-prep and payment-reconciliation workflow and dashboards, organize a HIPAA security risk assessment and draft procedures for professional review, and finish with staff training and a maintenance playbook.

The scope explicitly recommended committing to Phase 1 only, then deciding together whether to continue. For a startup nonprofit with no budget line for this work yet, a seven-phase commitment signed on day one would have been a promise nobody could keep. A defined first step with a real decision point respects the organization’s capacity and keeps the engagement honest.

Naming the boundaries

The scope was just as specific about what Klaro would not do. Klaro doesn’t sign off on legal, privacy, or HIPAA compliance — it prepares and organizes the documentation, and a qualified attorney or privacy professional reviews and attests to it. Klaro is not the system of record and never holds client health information. It doesn’t build a custom billing or claims engine, write the grant application itself, or become an on-call help desk. The handoff playbook and a maintenance plan are meant to replace dependence on the consultant, not create it.

Those limits protect the client as much as the consultant. Small organizations are often sold more than they can sustain, or left relying on one outside person to keep a system running. Writing the boundaries down at the start keeps responsibility where it belongs.

Verifying before committing

The scope was written as a map, not a guarantee. Before the organization commits to anything, the specifics get checked against the authoritative sources: eligibility rules, rates, billing codes, and which Community Supports the managed care plan actually offers, taken from the state’s ECM policy guidance and the plan’s provider contract; whether capacity funding is currently available through the plan’s grant program and the state’s PATH initiative; and whether 42 CFR Part 2 applies at all, which depends on whether the organization handles substance-use-disorder treatment records.

That last point matters. Part 2 adds confidentiality requirements that go beyond HIPAA, and assuming it applies when it doesn’t — or the reverse — changes consent design, data sharing, and system configuration.

What success looks like

The finish line was defined in operational terms, not as a software launch. Success means the organization can document and submit a clean ECM or Community Supports invoice to its managed care plan and reconcile the payment, in a system its own staff can run without outside help.

Where it stands

This is in-progress, pro bono work. Following the initial scope, a HIPAA needs assessment identified what compliant data handling would actually require given the organization’s size and current tools, rather than applying a generic checklist.

There is a completed needs assessment, not yet a finished build. It’s included here as an honest look at early-stage nonprofit data work, not as a case with measured results.