Availity

The Corma and Availity integration keeps your organization's Availity Essentials users in line with the staff who work with health plans every day. Availity describes Availity Essentials as a secure, multi-payer platform where healthcare providers and health plans collaborate by exchanging administrative and clinical information. Essentials is free and sponsored by health plans, so the governance question is not seats but who still holds a login to that information.

Key takeaways

• Availity requires each person to have their own account, and it does not charge for user accounts on Availity Essentials.
• The person who registers an organization in Availity Essentials automatically becomes its primary administrator.
• Availity's Organization Access Agreement requires the Administrator to disable a terminated employee's access immediately upon termination.
• Every Availity Essentials user must enroll in 2-step authentication, and Availity locks an account after 60 days or more without a login.

What does Availity expect from your administrator?

The obligations sit in a contract. Availity's Organization Access Agreement makes the Administrator solely responsible for ensuring each user has unique login credentials and for keeping an accurate, up to date list of all users. The Administrator can disable a user's access online or by written request to Availity, and the organization is liable for losses caused by any third party who uses its users' login credentials. HIPAA and Business Associate provisions sit in a separate section of the same agreement.

The administrator invites users one at a time, in bulk from a spreadsheet, or by copying a user from another organization, and assigns roles by job function. Availity also names administrator delegates and a User Administrator. Availity periodically purges inactive users, and a purged user needs a new user ID from their administrator, so the user list in Availity can drift from your HR records. Availity's API guide adds that each Developer Portal app gets a client ID and a client secret shown only once, and that access tokens last five minutes.

How Corma governs Availity

• Leavers disabled on time: a leaver workflow in the IT Workflow Builder, triggered from your HR system, asks the Availity administrator to revoke the person's access on their last day, as the agreement requires.
• Users and administrators under review: Availity users, administrators and administrator delegates go into automated access reviews, which helps keep the accurate user list the agreement asks for.
• Developer apps with an owner: Developer Portal client IDs and secrets are non-human identities, so each app needs a named owner on your side.
• Paid options in view: an Essentials Plus monthly subscription, which adds many non-sponsoring payers, sits in SaaS subscription management.

Frequently asked questions

Does Availity support SSO and SCIM?

Availity's 2-step authentication FAQ mentions users who access Availity through Single Sign-On and says the change does not affect them, but Availity's public pages document no SAML setup and no SCIM provisioning for provider organizations. Read how to offboard apps without SCIM, SAML or SSO.

How does Corma connect to Availity?

Availity's API guide lists eligibility, claims and other healthcare APIs but no user management API, so Corma's browser-based agents handle user steps in Availity Essentials, in an isolated browser session with credentials taken from your password vault. See also how Corma helps HR teams automate onboarding and offboarding.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know which Availity logins outlived the people who held them? Book a Corma demo.