Healthcare Business Analyst
Healthcare Business Analyst: HIPAA, HEDIS, CMS, and the Regulatory Floor SR Soft Built Around
- Healthcare Business Analyst
- HIPAA
- HEDIS
- CMS
- STAR
- ICD-10
A Healthcare Business Analyst is not a generic BA with a clinical adjective. The job is HIPAA Privacy and Security, HITECH, BAAs, minimum necessary, TPO, 42 CFR Part 2, CMS Conditions of Participation, NCQA, HEDIS, STAR ratings, MIPS, MACRA, ICD-10-CM, CPT, HCPCS, DRG, HCC, RAF. SR Soft LLC did not write those statutes. We pioneered how a staffing firm operationalizes them: job architecture, interview bars, and delivery cells a compliance officer will sit with.
Requirements that cite “per compliance” are not requirements. They must cite the regulation and the measure. User stories include audit trail, break-the-glass, and minimum necessary. UAT scripts fail on a real STAR or HEDIS numerator, not on a login page. Traceability runs from a CMS memo to a sprint increment. If your BA cannot do that, you hired a scribe.
The interview we pioneered
We ask for a denial root cause and a HEDIS numerator in the same hour. We ask how break-the-glass should appear in a user story. We ask which STAR measure their last epic actually moved. Fortune 500 health systems and national payers do not buy “Agile BA.” They buy someone who can sit in a utilization-management huddle and then write a FHIR prior-auth story. That is the bar. We file visas for it. We do not dilute it.
- 01
Role architecture
Payer BA, provider BA, interoperability BA — not one blob.
- 02
Interview bar
Regulation + measure + EHR reality in one conversation.
- 03
Story standard
Cite, audit, minimum necessary, fail-able UAT.
- 04
Pairing
BA + Epic/claims analyst + compliance when the epic is a STAR or OCR risk.
- 05
Library
The next BA inherits the process, not a graveyard of Confluence.
Where healthcare BA reqs actually fail
Cite the regulation or it is not a requirement
“Per compliance” is not a story. HIPAA minimum necessary, break-the-glass, TPO, BAAs, 42 CFR Part 2, a STAR measure, a HEDIS numerator — those are stories. UAT fails on the measure, not on login. We pioneered the interview that asks for both a denial root cause and a numerator. We will not submit a generic Agile BA to a health system and call it healthcare.
Role architecture matters: payer BA, provider BA, interop BA. Pairing with Epic/claims and compliance when the epic is STAR or OCR. The next BA inherits the library.
We did not pioneer HIPAA. We pioneered refusing to staff healthcare without it.
SR Soft LLC healthcare practice