What Does HIPAA Require of a Medical Billing Company, and of Your Practice?
HIPAA requires a billing company to sign a business associate agreement, follow the Security Rule and report breaches to you. Your own duties stay with you: obtain the agreement, limit what you send, train staff, answer patient requests and notify patients of a breach.
Written by Salman Saeed, CEO and Co-Founder · Reviewed by a Certified Medical Coder · 
In short: outsourcing billing moves the work, not the covered entity's responsibility. Assign each duty in the table to a named person, send only the minimum necessary data and write a short breach reporting window into the BAA, because a vendor's discovery date can start your own 60-day clock.
What Does HIPAA Require of a Medical Billing Company, and of You?
HIPAA requires a billing company to sign a business associate agreement, follow the Security Rule for electronic patient data and report any breach to you. It does not take your own duties away. You still have to obtain the agreement, limit what you send, train your staff, answer patient requests and notify patients if a breach happens.
The vendor's side, including the required contract terms and safeguards, is on the HIPAA for billing vendors rule page. This post covers the other half: the duties that stay with your practice, in a table you can assign to named people.
Which Duties Stay with Your Practice?
The table lists each duty, the person who owns it under HIPAA, the rule and the practical step. Duties marked "You" are the ones a practice most often assumes the vendor has taken over.
| Duty | Owner | Rule | What to do |
|---|---|---|---|
| Written agreement before sharing patient data | You obtain it; the vendor obtains one from any subcontractor | 45 CFR 164.502(e) | Sign the BAA before any account-level sample is sent |
| Limit data to the minimum necessary | You and the vendor | 45 CFR 164.502(b) | Send the fields billing needs, not the full chart |
| Train your own workforce | You | 45 CFR 164.530(b) | Include the billing handoff in staff training |
| Safeguard electronic patient data on the vendor's systems | The vendor, as a business associate | 45 CFR 164.314(a)(2) | Ask for the named security official |
| Act on a patient's access request | You | 45 CFR 164.524(b)(2) | Route requests to the person who answers them within 30 days |
| Reduce harm from a violation, including one by the vendor | You | 45 CFR 164.530(f) | Keep a contact list so you can act at once |
| Report a breach to the covered entity | The vendor | 45 CFR 164.410 | Write a reporting window into the BAA |
| Notify patients and HHS of a breach | You | 45 CFR 164.404 and 164.408 | Know who signs the notices before you need them |
Employees of the practice are workforce members and need no BAA. An outside billing team is a business associate, so each of the rows above applies.
What Does Minimum Necessary Mean for Billing?
Under 45 CFR 164.502(b)(1), a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of a use, disclosure or request. The rule excludes disclosures to a provider for treatment, and billing is not treatment, so the standard applies when you send data to a vendor.
In practice, that means sending the fields the claim needs: demographics, insurance, the service, the diagnosis and the provider. A full clinical note is not one of those fields unless a payer or a denial asks for it. Decide the list once, put it in writing and review it when the practice changes systems, adds a service line or starts sending data through a new channel. A short written list also gives you something to show if a payer or an auditor asks how you decide what the vendor receives. The minimum necessary entry in the glossary has the definition.
When Does Your 60-Day Breach Clock Start?
It can start on the day your vendor finds the breach. Under 45 CFR 164.404(a)(2), a breach is treated as discovered by a covered entity on the first day it is known, or would have been known with reasonable diligence, to the covered entity or to any person other than the one who committed it who is a workforce member or agent of the covered entity. Whether a vendor is an agent is decided under the federal common law of agency.
The notice to individuals must go out without unreasonable delay and in no case later than 60 calendar days after discovery, under 164.404(b). A business associate has its own 60-day limit to tell you under 164.410(b). If the vendor is your agent and takes most of that time, you may have little of your own left.
This illustrates the risk of a long reporting window. Whether a given vendor is an agent is a legal question for your counsel.
The vendor kept to its limit and you still had 15 days. A reporting window of a few days in the BAA protects you from this. The HHS notice depends on size: 164.408 requires notice at the same time as individual notice for a breach affecting 500 or more individuals, and a yearly log with notice within 60 days after year end for fewer than 500.
What Should the Practice Do Each Year?
- List every vendor that handles patient data and confirm a signed agreement is on file for each one.
- Re-check the minimum necessary list against what is actually sent to the billing company.
- Confirm the billing handoff is in staff training records.
- Ask the vendor who its security official is and when its last risk analysis was done.
- Test your own breach path: who receives the vendor's report, who decides, and who signs the notices.
Use the audit checklist on the rule page for the vendor's records, and the choosing guide when you compare vendors. For the wider outsourcing risks, read is it safe to outsource medical billing.
How We Handle HIPAA for Clients
We sign a Business Associate Agreement with every client. All staff have HIPAA training and NDAs, every system uses two-step login, backups are encrypted and automatic, and we have a dedicated compliance officer. Details are on the security page. See the revenue cycle management service, the internal medicine billing page or book a call.
- 45 CFR 164.502, Uses and disclosures of protected health information: general rules · eCFR
- 45 CFR 164.504, Uses and disclosures: organizational requirements · eCFR
- 45 CFR 164.314, Organizational requirements (Security Rule) · eCFR
- 45 CFR 164.404, Notification to individuals · eCFR
- 45 CFR 164.408, Notification to the Secretary · eCFR
- 45 CFR 164.410, Notification by a business associate · eCFR
- 45 CFR 164.524, Access of individuals to protected health information · eCFR
- 45 CFR 164.530, Administrative requirements · eCFR
We check every rule, code and deadline against the official source. See our editorial policy.
Common Questions
Straight answers from the team that does the work.
Ask a billing lead directly. A 20-minute call, Monday to Friday, 9am to 5pm Eastern.
01What does HIPAA require of a medical billing company?
A billing company is a business associate. It must sign a business associate agreement, follow the Security Rule for electronic patient data, pass the same terms to any subcontractor and report breaches to you under 45 CFR 164.410, no later than 60 calendar days after discovery. Your own duties stay with you.
02Do I still have HIPAA duties if I outsource billing?
Yes. You must obtain the agreement before sharing data, send only the minimum necessary, train your workforce, act on patient access requests and notify patients and HHS of a breach. Outsourcing the work does not outsource the covered entity's responsibility under 45 CFR parts 160 and 164.
03Can the vendor's breach start my 60-day clock?
It can. A covered entity is treated as knowing a breach when any workforce member or agent knows it, under 45 CFR 164.404(a)(2), and agency is decided under federal common law. Ask counsel whether your vendor is your agent, and set a short reporting window in the BAA.
04Do I need a BAA with a billing company?
Yes. Under 45 CFR 164.502(e), you may let a business associate handle patient data only with satisfactory assurance in a written contract that meets 164.504(e). Sign it before the vendor sees an account-level record. Employees of your practice do not need one.
Talk to a Billing Lead.
A 20-minute call about your payers, volume and setup. Monday to Friday, 9am to 5pm Eastern.