So what does HIPAA compliance in medical billing really ask of you? Share protected health information only for permitted reasons. Keep it safe from registration through the last payment posted. Respond properly when a patient makes a request or a breach happens. Handing billing to an outside company doesn’t take any of that off your plate.
Swift Billing Solutions is a Billing Company, so yes, we have a stake in this topic. The first thing we'd ask a practice owner has nothing to do with us: who can see your patients' billing information right now, why do they need it, and what would you do if it got out?
So what does HIPAA compliance in medical billing really ask of you? Share protected health information only for permitted reasons. Keep it safe from registration through the last payment posted. Respond properly when a patient makes a request or a breach happens. Handing billing to an outside company doesn’t take any of that off your plate.
What HIPAA actually covers in billing
Send claims electronically, or have a billing service send them for you, and you’re very likely a covered entity under the Health Insurance Portability and Accountability Act.
Good news first: getting paid is a permitted use, so you don’t need a separate patient authorization to send a claim. Bad news: that permission only stretches so far, and some records (we’ll get to behavioral health below) sit under tighter laws.
What counts as PHI once billing gets involved
PHI stands for protected health information. In plain terms, it’s anything held or sent by a covered entity or business associate that identifies a person and relates to their health, their care, or how that care was paid for. Yes, paid for. Plenty of offices treat the chart like a vault and then leave the A/R report open on a shared drive.
In a billing office, PHI looks like this:
- claims, since they pair a name with diagnosis and procedure codes
- remits showing what a payer decided on a specific patient
- that A/R spreadsheet with names and balances
- the insurance card scan in the registration record
- appeal packets with clinical notes inside
- recorded calls about someone's bill
Deleting the name column won’t de-identify a file, by the way. HIPAA has a specific standard for that, and it’s stricter than most people guess.
ePHI is the same thing in electronic form, and it’s what the Security Rule was written around. Paper isn’t exempt. A statement on a desk or a conversation at the front window still needs privacy safeguards.
Who's responsible once you outsource billing?
These are both parties that are involved in this work. Actually a billing company creates and transmits the PHI for you with direct HIPAA responsibilities of its own. Furthermore, no body interfer with your privacy policies and access decisions.
Settle the boring details before work starts. Who approves access? Who hears about an incident first? Who answers record requests? Who watches the subcontractors? Put the answers in the contract since a verbal agreement is worth very little on the day something goes wrong.
Staff Meeting Exercise: Try this at your next staff meeting. Ask what happens if a statement reaches the wrong patient this morning. If your office manager and your biller describe two different plans, you've found your first gap.
The three HIPAA rules your billing team should know
There are three, and your billers run into all of them.
The privacy rules will be responsible for using or sharing the PHI and providing the patient’s rights regarding it. It is up to the payer to decide whether a record will go to the payer or not. Electronic PHI falls under the security rule. That’s why you need to think about the file transfer.
One doesn’t cover for another. A locked-down system can still send something it shouldn’t, and a legitimate payment request can still travel over an insecure channel.
Minimum necessary, without the overkill
Where this standard applies, you access, request, and share only what the job reasonably calls for. Appeals are where it gets tested. A payer wants documentation on one procedure, and it’s so tempting to export the whole chart and hit send. Resist that. Read the request, pull those records, use your approved channel.
Some offices overcorrect and decide every file must be as small as possible. That’s not the rule either. Disclosures to the patient are exempt, so are provider requests or disclosures for treatment, and so are uses or disclosures required for HIPAA Administrative Simplification compliance. Let the purpose of the request, the transaction requirements, and your written policy guide you.
Job roles make the daily version easy. A payment poster and a coder don’t need the same screens, and collections needs something else again. Somebody needs extra access for a cleanup project? Approve it, then remove it when the project ends. Permanent exceptions pile up fast.
Where billing data gets exposed
Trouble usually starts at a handoff. Follow a claim through your office and you will see what we mean.
The big trouble starts when there is not enough information provided in the registration process. You can double-check the patient data and identify the patient modifiers. Furthermore, coding is the backbone of medical billing. Wrong coding can cause lots of trouble in reimbursement. When submitting a claim, wrong codes might bring low or higher charges or might leads out of the patient. This will cause loss or resubmission.
Payment posting makes its own mess.
Remittance files pile up in shared download folders until somebody sets a cleanup routine and a controlled place to keep them. Appeals need a second look too, because unrelated records slip into packets easily. Compare what you’re sending against what the payer asked for.
When the addresses are not right, the patient statements are going to the wrong address. Collection calls require a written script for verifying callers and limiting details. Reports also matter a lot; sometimes the patient names in the personal inbox require the disclosure problems waiting to be solved.
Last is the one everybody forgets. When you change vendors or a biller leaves, reconcile every account and confirm the login is dead. Old access tends to outlive the relationship.
Four situations that trip up billing teams
Then there’s the quiet one: confidential communications. Providers have to accommodate reasonable requests, so when a patient wants mail sent somewhere other than home, whoever runs statements and makes collection calls needs to know.
3. Patient Records Requests & Unpaid Balances
Records requests from patients who owe money cause a lot of confusion. An unpaid balance is no reason to hold anything back. With limited exceptions, patients have a right to medical and billing records, and you generally get 30 calendar days to act, plus one 30-day extension. OCR hit its 55th Right of Access settlement in August 2026, so this isn’t a paper rule. Don’t let a request get anywhere near day 30.
4. Family Callers
Families call and concern staff more than they should. A daughter calls over something her father said. If she is the one paying for his treatment, you can discuss it with her, but only to the extent of what she needs to know, and if he hasn’t protested, as per HHS advice. If he is not there to enquire, apply professional judgement about what is in his best interest. Your clinic can make up its own criteria for verifying the identification of a family caller, but HIPAA doesn’t demand evidence of identity.
Behavioral health records need more care
Psychiatry and therapy practices have an extra line to watch. Psychotherapy notes generally need the patient’s written authorization, so they don’t belong in a routine appeal packet.
Substance use disorder programs have more still. Federally assisted programs fall under 42 CFR Part 2, and the updated rule’s compliance date came and went on February 16, 2026. Before a claim, appeal, or collection call goes out for one of these programs, find out how patient consent and redisclosure limits apply.
Security goes well beyond the EHR
Start with an honest risk analysis
Make safeguards work on a normal Tuesday
Administrative, physical, and technical safeguards are all required. Paper policies won’t tell you whether they work, so check. Can you tie activity in the billing system to one named user? Does access change when someone’s job changes? Can a visitor read a screen from the waiting room? Who looks at unusual exports? Has anybody ever restored billing data from backup, or is everyone assuming it works? Would your staff spot a misdirected attachment or a fishy login request?
Encryption is a decision you have to document
What's changing in HIPAA
Short answer: less than the headlines suggest. As of November 4, 2026, the big Security Rule and Privacy Rule updates aren’t in effect.
HHS pushed its target for the Security Rule update from May 2026 to July 2027. It’s still only a proposal; that date isn’t binding, and today’s rule stays in force.
On the Privacy Rule side, a draft final rule was still under federal review on October 26 and hasn’t been published. The proposed version would shorten access response times and make care coordination sharing easier, and what comes out could look different. HHS’s agenda also listed a separate proposal on access response times for November 2026. Back in 2021, HHS proposed cutting the 30-day deadline to 15.
None of this is a deadline yet,
so check HHS and the Federal Register before rewriting any policies. Two things are final: updated notice of privacy practices requirements applied from February 16, 2026, and electronic claims attachment standards require compliance by May 26, 2028.
What your business associate agreement should spell out
No BAA, no PHI. A Business Associate Agreement has to be in place before a billing partner handles patient information for your practice, even for a trial or a small cleanup project.
HHS sample provisions give you the skeleton: permitted uses, safeguards, reporting, patient rights, subcontractors, and the end of the contract. Read yours with practical questions in mind. Does it match the services you’re actually buying? How fast will you hear about an incident? Who pulls data when a patient asks for records? Are subcontractors bound to the same limits? What happens to your PHI on the way out?
Remember, a signed BAA
If billing information gets exposed
A statement goes to the wrong patient. Someone shares a spreadsheet outside the practice. Don’t wait to see if anyone complains.
First, contain it: pull in your incident lead and cut off further access. Save the logs, messages, timestamps, and file details before they disappear. Then work out what information and which people are involved, and have your privacy and security leads assess and document any notification duties. Fixing the cause comes last, whether that’s a workflow, an access setting, or a system.
HIPAA starts from an uncomfortable assumption.
An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented assessment shows a low probability of compromise. That assessment looks at the information involved, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated.
Your billing company has to tell you about a breach without unreasonable delay, and within 60 days of discovery at the latest. Sixty days is a long time to sit in the dark, so we’d ask for much faster in the contract. You’ll have your own duties to patients, HHS, and sometimes the media.
What can a violation cost you?
Federal civil penalties run from $145 to $2,190,294 per violation depending on culpability, with lower annual caps from OCR on the three less serious tiers. The check you write may be the smallest part. Corrective action plans, patient notices, state attorney general actions, and lost trust can drag on for years.
Two billing company cases worth reading
Comstar did ambulance billing. Ransomware hit in 2022; more than 585,000 people were affected, and over 70 covered entities were relying on the company at the time. OCR faulted it for lacking a proper risk analysis, and in 2025 Comstar agreed to $75,000 and a two-year corrective action plan. Then came the states. Massachusetts and Connecticut announced another $515,000 settlement in January 2026. Breach notices had gone out on behalf of the organizations Comstar billed for, so its clients got dragged in too.
Twenty Months. That's roughly how long someone sat
inside the network at Doctors’ Management Services, a medical billing and credentialing company, between April 2017 and December 2018. The breach involved 206,695 people, OCR pointed to a missing risk analysis and weak system monitoring, and the company settled for $100,000 in October 2023 with a corrective action plan and no admission of liability.
Interviewing a billing company? Push on this. Can they show you a risk analysis? Who reads their logs? When a problem gets written down, does anyone go back and close it?
Questions to ask any billing company
| Ask | A good answer includes |
|---|---|
| Who handles privacy and security? | Actual names and an escalation path |
| How do you find and fix risks? | A scoped risk analysis summary and where remediation stands |
| How does staff access get controlled? | Who approves it, who reviews it, how it’s removed |
| Where do your staff and systems sit, and who can reach our PHI? | Locations, roles, access limits |
| Which subcontractors touch our PHI? | A current vendor list and the BAA arrangement for each |
| How will we hear about an incident? | Contract language and a process they’ve tested |
| What happens during an outage? | Recovery steps and real test results |
| How do we get our data back if we leave? | Export steps, usable formats, retention terms |
"HIPAA certified" on a sales page should make you look closer. HHS doesn't endorse or recognize private Security Rule certifications as proof of compliance, and a badge doesn't remove a single legal obligation.
A HIPAA Compliance Checklist for your Billing Office
This won't prove you're compliant. It will show you where to look.
Making this part of everyday billing
People follow the safe process when it’s also the easy one. Give your team approved channels, sensible access, clear handoffs, and one person who owns the problem.
Partner With Swift Billing Solutions
Swift Billing Solutions handles billing for independent practices at a flat 3% of collections, with no setup fees or long-term contracts. We don’t sell an EHR, so we work with the software you already use.
Bring the questions above to a first call and we’ll answer them for your practice: who touches your data, where it sits, and how you’d get it back if you left. Contact Swift Billing Solutions to set that up.
Frequently Asked Questions
They can when the work calls for it and the access fits HIPAA and your BAA. Browsing is another matter. A billing contract is no license for that.
HIPAA doesn't prohibit it. HHS says overseas risks and enforceability belong in your risk analysis. Other rules can go further: Medicare Advantage plans need attestations about offshore subcontractors, often passed down to network providers, and some state Medicaid programs and contracts restrict offshore work or ban it outright. Ask any billing partner where its staff and systems are, then check that answer against your payer contracts.
No, and be wary of anyone who hints otherwise. Payment depends on coverage, documentation, and payer decisions. What a company can commit to is response times, follow-up timelines, and honest reporting.
