HIPAA Compliance in Medical Billing

Medical billing is one of the highest-volume PHI workflows in any practice. Every claim contains:

• Patient demographics (name, DOB, address)
• Member ID and insurance information
• Diagnosis codes (ICD-10) — including sensitive conditions (mental health, substance use, HIV, abortion-related, gender dysphoria)
• Procedure codes (CPT) — including procedures of varying sensitivity
• Payment information including patient financial responsibility
• Provider details and dates of service

Most of this qualifies as PHI under HIPAA. A medical practice processing 1,000 claims per month is processing 1,000 PHI transactions, every one of which is subject to the Privacy Rule's permissible-uses standard, the Security Rule's safeguards, and the Breach Notification Rule's documentation requirements.

When billing is outsourced, the billing service becomes a Business Associate with direct compliance obligations. The HITECH Act of 2009 made business associates directly liable — meaning a billing company can be fined for HIPAA violations even when the covered-entity practice is not at fault. This direct liability has substantially raised the stakes for billing operations and is part of why mature billing companies invest heavily in compliance infrastructure.

Three HIPAA rules apply directly to medical billing operations:

1. Privacy Rule (45 CFR 164.500-534). Defines what PHI is, who can access it, and the permissible uses. Three broad permissible-use categories: Treatment, Payment, and Operations (TPO). Billing falls squarely under 'payment' uses. The Privacy Rule also establishes the minimum necessary standard — access limited to what's needed for the specific task. Patient rights include the right to access their own PHI, request amendments, request restrictions on disclosures, and receive an accounting of certain disclosures.

2. Security Rule (45 CFR 164.302-318). Requires administrative, physical, and technical safeguards for electronic PHI (ePHI). Specific requirements include access controls, audit logs, encryption (where reasonable and appropriate), transmission security, contingency planning, workforce training, and periodic risk analysis. The Security Rule is the operational backbone of HIPAA — most billing-company compliance programs are built around its safeguards taxonomy.

3. Breach Notification Rule (45 CFR 164.400-414). Defines what constitutes a breach (unauthorized acquisition, access, use, or disclosure of unsecured PHI), the timeline for notifying covered entities (without unreasonable delay, no later than 60 days from discovery), and the documentation requirements. The HITECH Act amendments expanded these obligations substantially.

A fourth rule — the Enforcement Rule (45 CFR 160.300-552) — establishes how HHS investigates complaints and applies penalties. While not a 'compliance' rule per se, it's what makes the others enforceable.

A Business Associate Agreement (BAA) is required between a covered entity (practice) and any business associate (billing company, clearinghouse, EHR vendor, etc.) that handles PHI. Per 45 CFR 164.504(e), a compliant BAA must contain the following elements. Use this as a checklist when reviewing a vendor's BAA:

Required by the regulation:

☐ Permitted uses and disclosures of PHI — clearly limited to the minimum necessary for the contracted purpose (billing, claim submission, payment posting, etc.).

☐ Prohibition on further use or disclosure except as permitted by the agreement or required by law.

☐ Implementation of appropriate safeguards — administrative, physical, and technical, consistent with the Security Rule.

☐ Breach reporting obligation — to the covered entity, without unreasonable delay and no later than 60 days from discovery.

☐ Subcontractor flow-down — any subcontractor handling PHI must execute a downstream BAA with equivalent obligations.

☐ Return or destruction of PHI upon termination, to the extent feasible. Where return/destruction is not feasible, continued protection of retained PHI.

☐ Compliance with covered entity's obligations to the extent the BA performs functions on the CE's behalf.

☐ Right to access PHI for the individual whose PHI is involved (cooperation with patient access requests).

☐ Right to amend PHI (cooperation with amendment requests).

☐ Accounting of disclosures documentation.

☐ HHS access — making books, records, and policies available to HHS for audit.

Negotiated provisions (not required by regulation but standard):

☐ Indemnification — typically mutual, capped

☐ Insurance requirements — cyber liability coverage, with the limit and coverage type negotiated; HIPAA sets no minimum and no published industry standard exists, so treat any quoted figure as a negotiating position

☐ Audit rights — covered entity's right to audit BA's compliance

☐ Notice timing — sometimes negotiated tighter than 60-day regulatory minimum (e.g., 30 days, or 'within 24 hours of confirmed breach')

☐ Specific incident response procedures

☐ State law compliance (for states with stricter rules — California, Texas, New York, Massachusetts often impose additional requirements)

A BAA missing any of the regulatory elements is non-compliant. A 'BAA' that is just a one-page acknowledgment is insufficient. OCR has settled cases in which a covered entity disclosed PHI to a vendor with no business associate agreement in place at all; the agreement is a precondition to sharing PHI, not paperwork to complete afterwards.

The minimum necessary standard requires that PHI access be limited to the minimum amount needed for the specific task.

For billing operations, this means:

• Billers should access claim-related PHI for claims they are working, not the entire patient population. Role-based access controls in the practice management system should enforce this technically.
• Coding staff should access charts for the encounters they are coding, not the full chart history of every patient.
• Customer service should access account information for the patient they are speaking with, not all accounts.
• Reporting and analytics should be aggregated where possible — practice-level KPI reports don't require access to individual patient PHI.

The standard applies operationally — through:

• Role-based access controls (RBAC) in PM/EHR systems
• Audit logging of all PHI access (who accessed what, when)
• Need-to-know discipline (just because access is technically permitted doesn't mean every staff member should have it)
• Periodic access reviews (do current access permissions still match each staff member's role?)

A billing service that gives every team member access to all clients' full PHI is operationally non-compliant even if technically encrypted at rest. Vetting a billing service should include questions about how they implement minimum necessary in practice — RBAC structure, audit log review, and access review cadence.

The Security Rule requires three categories of safeguards. Each has both required (must implement) and addressable (must implement, or document why not and what you did instead) specifications.

Administrative safeguards:

• Risk analysis — an accurate and thorough assessment of risks to ePHI, and it must be documented
• Risk management process
• Workforce training
• Sanction policy for non-compliance
• Information access management with role-based access controls
• Security incident response procedures
• Contingency plan (data backup, disaster recovery, emergency mode operation)
• Business associate agreements with subcontractors
• Periodic evaluation of compliance

A note on “annual”. You will read everywhere that HIPAA requires an annual risk assessment. The Security Rule does not say that. It requires a risk analysis and a periodic evaluation, and sets no interval; what the rule does require is that the analysis be current enough to reflect your actual environment, so a material change — new system, new vendor, new site, an incident — is itself a trigger regardless of the calendar. Annual is a sensible operating cadence and a common contractual requirement. It is not the regulatory text, and a vendor who defends a three-year-old assessment by saying the rule only says ‘periodic’ is technically right and still unacceptable.

Physical safeguards:

• Facility access controls (who can enter the building/data center)
• Workstation security (where staff access PHI)
• Device and media controls (handling of laptops, USBs, paper)
• Workstation use policy
• Disposal procedures (for both digital media and paper)

Technical safeguards:

• Access controls (unique user IDs, automatic logoff, encryption/decryption)
• Audit controls (logging of all PHI access)
• Integrity controls (preventing improper PHI alteration)
• Person or entity authentication (verifying who is requesting access)
• Transmission security (encryption in transit)

For a billing service, this concretely means:

• Encrypted storage and transmission
• Individual user accounts with role-based permissions
• Audit logs of PHI access, reviewed on a stated cadence. (The six-year retention people attach to audit logs is a misreading: the Security Rule's six-year clock applies to the documentation the rule requires you to keep — policies, procedures, and the records of actions, activities and assessments it requires you to document — measured from creation or last-effective date. Log retention itself is a policy decision you make and then have to be able to evidence.)
• Multi-factor authentication for staff accessing PHI
• Controlled physical access to billing operations centers (badge access, visitor logs)
• Documented training programs with completion records
• Documented, current risk assessments with dates
• Encrypted laptops, and encryption for any PHI-bearing communication
• VPN or zero-trust architecture for remote access
• Documented incident response plan with breach notification procedures

A breach is, generally, an impermissible use or disclosure of PHI under the Privacy Rule that compromises its security or privacy. Two things about that definition get misstated constantly, and both change what you do on the day.

First, the presumption runs against you. An impermissible use or disclosure is presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI has been compromised, based on a risk assessment of at least four factors: the nature and extent of the PHI involved (including identifiers and re-identification likelihood); who used it or received it; whether it was actually acquired or viewed; and the extent to which the risk has been mitigated (HHS, Breach Notification Rule, read 17 September 2026). Note what this is not: it is not the old “risk of harm to the individual” test, which the 2013 Omnibus Rule replaced. If your breach procedure still documents harm, it is documenting the wrong thing. You may also skip the assessment entirely and simply notify.

Second, ‘unsecured’ is a defined term, not an adjective. PHI is rendered unusable, unreadable or indecipherable only by encryption or destruction as specified in HHS guidance — for data at rest, encryption consistent with NIST SP 800-111; for data in motion, processes complying with NIST SP 800-52, 800-77 or 800-113, or otherwise FIPS 140-2 validated; and the decryption key must not itself have been breached (HHS encryption and destruction guidance, read 17 September 2026). A blanket claim that “we use AES so nothing is reportable” does not track the guidance; the question is whether the specific process qualifies and whether the key was protected.

Scenarios that are generally breaches:

• Stolen laptop containing unencrypted PHI
• Email containing PHI sent to wrong recipient
• Attacker gains access to systems containing PHI
• Lost paper records
• Employee accessed records of a patient they had no business need to view
• Disposal of paper records without shredding
• Misdirected fax containing PHI
• Vendor accessed PHI beyond what the BAA permits

Scenarios that are generally not:

• Disclosure permitted by HIPAA (treatment, payment, operations)
• Disclosure to a person authorized by the patient
• Encrypted laptop lost, where the encryption meets the guidance above and the key was not compromised
• The rule's three express exceptions: good-faith unintentional access by a workforce member within their authority; inadvertent disclosure between two people authorized to access PHI at the same entity; and a good-faith belief the unauthorized recipient could not have retained the information. In the first two cases the information must not be further used or disclosed impermissibly.

When a breach occurs, the business associate must:

1. Notify the covered entity without unreasonable delay and no later than 60 days from discovery
2. Investigate and document the scope (how many individuals, what PHI types)
3. Identify each affected individual to the covered entity, to the extent possible
4. Document remediation steps taken

The covered entity then has its own notification obligations:

• Affected individuals — without unreasonable delay and no later than 60 days from discovery, by first-class mail (or electronic notice if the individual agreed). If contact information is insufficient or out of date for 10 or more individuals, substitute notice is required: a web-site posting for at least 90 days or major print or broadcast media, with a toll-free number active for at least 90 days.
• HHS — for a breach affecting 500 or more individuals: without unreasonable delay and no later than 60 days. For smaller breaches: an annual submission, due no later than 60 days after the end of the calendar year in which the breach was discovered.
• Media — for a breach affecting more than 500 residents of a single State or jurisdiction: notice to prominent media outlets serving that area, on the same 60-day clock. The threshold is per State, not per breach, which is why a 600-person breach spread across four states may trigger no media notice at all.

Documentation requirements for any breach, regardless of size:

• Who was notified, when, how
• What PHI was involved
• What remediation steps were taken
• The four-factor risk assessment, if you relied on it to conclude no notification was required

The burden of proof sits with you: you must be able to demonstrate either that every required notification was made, or that notification was not required. Practices should have a written breach response procedure that dovetails with their billing service's.

Marketing claims of 'HIPAA compliant' are not vetting. Nothing below is a claim about MedPrecision — it is the question set we would expect a careful practice to put to any billing vendor, including us. Ask us the same things, and hold the answers to the same standard.

1. Request and review their BAA. Verify it contains all required elements (use the checklist above). Vague BAAs are a red flag — vendors with mature compliance programs have detailed BAAs they are willing to share before you sign anything.

2. Ask for the date and scope of their most recent security risk analysis. The Security Rule requires the analysis and a periodic evaluation without fixing an interval, so the useful question is not “do you do it annually” but “when was the last one, what did it cover, and what changed in your environment since?” A vendor who cannot answer that has not done one in any meaningful sense.

3. Ask about subcontractors that handle PHI — clearinghouses, software vendors, offshore staff — and confirm BAAs are in place with each. Subcontractor flow-down is required by HIPAA and is often overlooked.

4. Ask how they implement role-based access and minimum necessary. What does access control look like operationally? How are privileges reviewed and revoked when staff change roles or leave?

5. Ask about training — frequency, documentation, sanctions for non-compliance.

6. Ask about incident history. Ask how incidents are detected, logged and escalated, and to see the incident log with client identifiers removed. A vendor that reports never having had a security incident of any kind is describing its detection capability, not its security.

7. Ask about offshore staff if any. Offshore handling of PHI is permissible under HIPAA when properly secured, but calls for specific BAA provisions and security oversight, and some states impose additional requirements. A vendor that uses offshore staff without disclosing it has a transparency problem.

8. Ask for evidence of penetration testing and vulnerability assessment. The reports may be confidential but the existence and cadence should be disclosed.

9. Ask what cyber liability coverage they carry, and ask for the certificate. There is no HIPAA-mandated minimum and no published industry standard, so treat any figure a vendor or an article quotes as a negotiating position rather than a benchmark. What matters more than the headline limit is the coverage type — first-party breach-response costs, third-party defence, or both — and whether regulatory defence is included.

10. Ask for a SOC 2 Type II report if they have one. SOC 2 is a private attestation framework; it is not required by HIPAA and its absence is not a violation, but its presence is independent evidence.

11. Ask about data residency — where PHI is stored geographically, and whether that is contractually fixed or can change without notice to you.

12. Verify HITRUST certification status if claimed. HITRUST is a private certification covering a control framework that includes HIPAA plus additional standards. Ask for the certificate and its scope — certification often covers a defined system boundary, not the whole company.

A billing service that cannot answer these questions concretely is not a compliant partner. A billing service that answers all twelve with marketing copy rather than documents is answering a different question.

HIPAA civil money penalties are tiered by culpability, and the dollar amounts are adjusted for inflation every year. The amounts below are the maximum adjusted penalty figures published in the HHS civil money penalty table at 45 CFR 102.3, read there on 17 September 2026 — the table's current right-most column. Check that table rather than an article before you quote a number; a figure more than a year old is simply out of date, which is how the pre-2024 amounts ended up circulating as though they were current.

The annual cap is the part almost everyone gets wrong. The Enforcement Rule as written applies the same calendar-year cap — currently $2,190,294 — to all four tiers, and that single figure is what most summaries reproduce. But in April 2019 HHS published a Notification of Enforcement Discretion concluding that the better reading of the HITECH Act is a different annual limit per tier, and stating that all HIPAA enforcement actions would be governed by limits of $25,000, $100,000, $250,000 and $1,500,000 for tiers 1 through 4 respectively, as adjusted for inflation (84 FR 18151, 30 April 2019, read 17 September 2026). HHS said that exercise of discretion is effective indefinitely, pending further rulemaking. So the practical exposure for a lower-tier violation is roughly an order of magnitude below the regulatory cap, while the top tier is unchanged — and the inflation-adjusted values of those lower discretionary limits are not separately published in the 102.3 table.

Criminal penalties for knowing wrongful disclosure, which are separate and are prosecuted by the Department of Justice, not OCR:

• Knowing offense: up to $50,000 plus 1 year imprisonment
• Under false pretenses: up to $100,000 plus 5 years imprisonment
• For commercial advantage, personal gain or malicious harm: up to $250,000 plus 10 years imprisonment

Beyond fines, the consequences of a breach disclosure include:

• State enforcement action, where the state has its own health-privacy or breach-notification law
• Private litigation. HIPAA itself creates no private right of action, so claims are brought under state law — which varies enormously, and is the reason a national figure for litigation exposure does not exist
• Reputational damage and patient attrition
• A corrective action plan with OCR monitoring, which typically runs for years and consumes more staff time than the penalty consumes cash

Verified enforcement examples. Each of these is an OCR resolution agreement published on hhs.gov:

• Anthem — $16 million, October 2018, following cyberattacks that exposed the ePHI of almost 79 million people; OCR's largest HIPAA settlement
• Premera Blue Cross — $6.85 million, September 2020, a data breach affecting over 10.4 million people
• Excellus Health Plan — $5.1 million, January 2021, a data breach affecting over 9.3 million people
• Sentara Hospitals — $2.175 million, November 2019, for failing to properly notify HHS of a breach of unsecured PHI — the notification failure itself, not the underlying incident, was the violation

The Sentara agreement is the one worth reading twice if you run a billing operation, because it is the case where the reporting process, rather than the security incident, produced the penalty.

Even when billing is outsourced, the practice retains HIPAA obligations. Practice-side hygiene that matters:

1. Maintain BAAs with every business associate that handles PHI — billing company, clearinghouse, EHR vendor, transcription service, IT vendor, paper-shredding service. Audit the list annually; replace expired BAAs immediately.

2. Document the minimum necessary standard in your privacy policies. Specify what categories of staff access what types of PHI for what purposes.

3. Train all workforce members on HIPAA basics — what PHI is, what the permissible uses are, and how to recognise and report a suspected breach. Keep completion records; the training is only evidence if it is documented.

4. Keep the security risk analysis current and dated. The Security Rule requires the analysis and a periodic evaluation without naming an interval, so the standard to hold yourself to is that it reflects your environment as it is now — which makes a new system, a new vendor or an incident a trigger in its own right, whatever the calendar says. An annual review cadence is a reasonable default.

5. Implement and test contingency plans — data backup, disaster recovery, emergency mode operation. An untested backup is a hypothesis.

6. Maintain audit logs in PM/EHR systems, with periodic review. If you cannot audit access logs, you cannot verify minimum necessary is being followed.

7. Have a written incident response procedure with named roles, escalation path, and breach notification process, and make sure it applies the four-factor compromise test rather than the superseded harm test. Update it as personnel change.

8. Review business associate compliance periodically — request attestation of continued compliance, review incident reports.

9. Document workforce sanctions applied for HIPAA violations. The sanction policy is required, and the records are the evidence that it is real.

10. Document onboarding and offboarding — timely access provisioning at hire, immediate revocation at separation. Orphaned accounts are among the easiest findings to produce in any review.