What Should Be in a Medical Billing Company Contract?
A billing contract should say who does each task, where the money goes, what the fee applies to, how you leave, and what happens to your data and open claims when you do. The fastest way to check is to look for ten weak phrases and ask for the stronger wording shown below.
Written by Salman Saeed, CEO and Co-Founder · Reviewed by a Certified Medical Coder · 
In short: read the contract for ten weak phrases, such as "all billing-related services" or "promptly", and ask for specific wording with numbers in their place. The HIPAA business associate agreement is required, and counsel should review the final text.
Which Ten Phrases in a Billing Contract Should You Mark?
Mark any clause that leaves a task, a number or a date to the billing company's discretion. The table gives a weak version, a stronger version to request, and the reason. Anything in square brackets is a number you and the vendor have to agree; the post does not suggest one.
| Clause | Weak phrase | Stronger wording to request | Why |
|---|---|---|---|
| Scope | "All billing-related services as needed" | A numbered list of tasks, marked as the billing company's alone, yours alone, or shared | The OIG's billing company guidance recommends the contract enumerate those functions that are shared responsibilities and those that are the sole responsibility of either party. |
| Fee base | "[Percent] of all billings" | "[Percent] of collections actually received and posted for services in scope" | The OIG has a longstanding concern that percentage billing arrangements may increase the risk of upcoding and similar abusive billing practices, so define the base and the coding safeguards. |
| Payment routing | "Company will collect and remit payments" | "All payer and patient payments go directly to an account in the practice's legal name that the practice alone controls" | Form CMS-588 requires the EFT account to bear the provider's legal name and to be under its sole control. Under 42 CFR 424.73, payment to an agent is made in the provider's name. |
| Term | "Renews automatically for successive [number]-month terms unless [number] days notice" | "After the first term, renews month to month; either side may end it on [number] days written notice" | Long renewals with long notice windows are how a missed date locks you in. |
| Data on exit | "Company retains all records" | "Within [number] days of termination, Company returns claim-level data, ERA files and denial history in a usable format" | 45 CFR 164.504(e)(2)(ii)(J) requires the agreement to provide for return or destruction of protected health information at termination, if feasible. It does not give you your claim history in a usable form; write that in. |
| Fees after exit | "Fees continue on all collections from services billed by Company" | "Fees on payments for claims the company worked until the end date of a defined run-out period; none after" | Without an end date, you can pay two companies on the same claim. |
| Breach notice | "Company will notify Client promptly" | "Within [number] days of discovery, with the facts known" | 45 CFR 164.410(b) lets a business associate wait up to 60 calendar days after discovery. Ask for a shorter number. |
| Subcontractors | "Company may use affiliates and subcontractors" | A named list of locations and subcontractors that handle your data, each bound by the same restrictions | 45 CFR 164.504(e)(2)(ii)(D) requires the business associate to ensure subcontractors agree to the same restrictions and conditions. |
| Liability | "Liability limited to fees paid in the prior [number] days" | A cap that covers payer recoupments and penalties caused by the company's errors, plus insurance proof | This is a business and legal call; ask counsel what the cap should be. |
| Credit balances | "Company is not responsible for refunds" | "Company reports credit balances monthly and prepares refunds for your approval" | 42 CFR 401.305(b)(1) requires an overpayment to be reported and returned by the later of 60 days after it was identified or the date any corresponding cost report is due. |
What Should You Ask on the Sales Call Before the Contract Goes to Counsel?
Six questions settle most of the table before anyone drafts a word. Write the answers in your notes and ask for them in the contract.
| Question | A good answer sounds like | A red flag sounds like |
|---|---|---|
| Where do payer payments land? | "In your account, in your legal name, and we cannot move it." | "We receive them and send you a monthly check." |
| What is the fee applied to? | "Payments received and posted for the claims we worked, and fees stop when the run-out ends." | "All revenue from your practice." |
| What do I get when I leave? | "A file of every claim, payment and denial in a format your next company can load, by a set date." | "We keep our system and records; you can request reports." |
| Who touches my data? | "These named staff and locations, all under the business associate agreement." | "Our team and partners." |
| How fast do you tell me about a breach? | "Within a set number of days, in writing, with what we know." | "Promptly." |
| What happens to a claim you were working when I leave? | "We work it to the run-out date, then hand it to you or your next company with notes." | "It reverts to you as is." |
Does the Contract Need a Business Associate Agreement?
Yes. Under 45 CFR 164.502(e)(2), the satisfactory assurances a covered entity must get from a business associate have to be documented through a written contract or other written agreement that meets 164.504(e). A billing company that handles claims and patient accounts is a business associate.
The HIPAA for billing vendors rule lists what the agreement has to contain. Attach it to the services contract and make the services contract refer to it, so that a breach clause in one cannot contradict the other.
What Should You Do with the Draft Once You Have Marked It?
- Replace each weak phrase with the stronger wording and fill in the numbers you can accept.
- Compare it with the twelve-clause billing company contract checklist for anything missing.
- Send both versions to counsel with the marked table, and ask counsel about liability, indemnity and your state's rules.
- Check that the fee structure is consistent with your cost model, using the in-house versus outsourced cost guide.
- Sign only when the exit and data terms read the way the table does. If you ever leave, the switching calendar depends on those two clauses.
This post is not legal advice. The choosing a billing partner guide covers how to compare vendors before you reach the contract stage, and the outsourcing safety checklist covers the controls to test.
How Nucleus Align Handles It
We sign a Business Associate Agreement with every client, train all staff on HIPAA and put them under NDAs, and keep a dedicated compliance officer. Book a call to go through the terms for revenue cycle management at a practice like family medicine, or see more on the blog.
- OIG Compliance Program Guidance for Third-Party Medical Billing Companies, 63 FR 70138 · HHS OIG
- Form CMS-588, Electronic Funds Transfer Authorization Agreement · CMS
- 42 CFR 424.73, Prohibition of assignment of claims by providers · eCFR
- 45 CFR 164.502, Uses and disclosures of protected health information · HHS via eCFR
- 45 CFR 164.504, Uses and disclosures: Organizational requirements · HHS via eCFR
- 45 CFR 164.410, Notification by a business associate · HHS via eCFR
- 42 CFR 401.305, Requirements for reporting and returning of overpayments · eCFR
We check every rule, code and deadline against the official source. See our editorial policy.
Common Questions
Straight answers from the team that does the work.
Ask a billing lead directly. A 20-minute call, Monday to Friday, 9am to 5pm Eastern.
01What should be in a medical billing company contract?
The contract should list the tasks each side owns, define the fee base, route all payments to an account in your legal name, set the term and exit steps, require return of your claim data, attach a business associate agreement, set a breach-notice deadline, name subcontractors, and cover credit balances and liability. Have counsel review the final text.
02Does a billing company need a business associate agreement?
Yes. 45 CFR 164.502(e)(2) requires the satisfactory assurances from a business associate to be documented through a written contract or other written agreement that meets 164.504(e). A billing company that handles claims and patient accounts is a business associate of the practice.
03How soon must a billing company report a data breach?
Under 45 CFR 164.410(b), a business associate must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. A contract can require a shorter period, so ask for a specific number of days in writing.
04What should the contract say about my data when I leave?
The business associate agreement must provide for returning or destroying protected health information at termination if feasible, under 45 CFR 164.504(e)(2)(ii)(J). Add a clause requiring claim-level data, ERA files and denial history in a usable format by a set date, since that is not automatic.
Talk to a Billing Lead.
A 20-minute call about your payers, volume and setup. Monday to Friday, 9am to 5pm Eastern.