EAPs need secure, HIPAA-compliant case-management software, a redundant 24/7 crisis intake call center, and telephonic and telehealth counseling platforms. They also depend on provider-network and referral/authorization tracking, de-identified utilization reporting for employer clients, and encrypted backup and disaster recovery. Underpinning all of it is strict access control that walls off identifiable employee PHI from the employer paying for the program.