HIPAA-Compliant Medical Billing: 8 Questions to Ask Your Billing Company

A billing company sees some of the most sensitive data your practice holds: patient names, diagnoses, insurance details and payment information. Before you share access, make sure their safeguards match HIPAA requirements.

1. Will you sign a Business Associate Agreement?

A BAA is required whenever a vendor handles protected health information (PHI) on your behalf. No BAA, no access.

2. How is access controlled?

Each team member should have their own login with only the access their role needs, and access should be removed promptly when someone leaves.

3. Is data encrypted?

Connections to your systems and any file transfers should be encrypted. PHI should not be stored on personal devices.

4. How is the team trained?

Ask how often staff complete HIPAA and security training and whether they sign confidentiality agreements.

5. How are emails and calls handled?

Look for secure email, caller verification and a minimum-necessary approach to sharing information.

6. Are activities logged and audited?

Regular internal audits of access logs and claim accuracy help catch problems early.

7. What happens if there is a breach?

The company should have a written incident response plan and notify you promptly, as the BAA requires.

8. Do you have written policies?

Policies and procedures for privacy, security and compliance should be documented and reviewed regularly.

Talk to a billing specialist

Agile Nexus Solutions handles medical billing, coding, credentialing and A/R recovery for practices across the USA. Request a practice audit or book a call and we will show you where revenue is being lost.