Medical Billing Vendor Evaluation Scorecard

The scorecard rates 27 criteria, each on a simple 0/1/2 scale, then weights the eight categories so that the dimensions most likely to cost you money — compliance, pricing transparency, KPIs, and contract terms — carry the most influence.

Per-criterion scoring (0/1/2):

• 2 points (strong): The vendor meets the criterion cleanly and can show evidence (a report, a sample, a contract clause).
• 1 point (partial): The vendor partially meets it, or commits to meeting it but cannot yet show proof.
• 0 points (weak / red flag): The vendor fails the criterion, deflects, or refuses to answer.

Category weights — and where they come from. Each category has a maximum weighted contribution to the 100-point total, and within a category the raw points you award (sum of its criteria, each 0-2) are scaled to that weight. The weights below are our editorial judgement of which dimensions most often cost a practice money. No standards body publishes a weighting for vendor selection, and we are not presenting these as one. A practice whose problem is aged A/R should raise Performance KPIs & Reporting; a practice in a heavily audited specialty should raise Compliance & Security. What must not change is the sheet: once set, use the same weights on every finalist, or the totals are not comparable.

The weighted-score formula for each category is: (raw points earned / max raw for that category) x category weight. Sum the eight weighted category scores for the total out of 100.

Interpretation bands:

• 85-100 — Strong finalist. Meets the high-stakes criteria with evidence. Proceed to references and contract redlining.
• 70-84 — Workable, with written conditions. Sound overall but with specific gaps. Advance only if the gaps are closed in the contract or SLA before signing.
• 55-69 — Significant gaps. Proceed only if the missing criteria are fixable and the vendor agrees to fix them in writing. Otherwise decline.
• Below 55 — High risk. Decline.

The band is a guide, not a verdict: the auto-disqualifiers in the final section override the total score entirely. A vendor can score 90 and still be disqualified for refusing a BAA.

Score every finalist on this identical table. Each row is one criterion worth 0, 1, or 2 points. The columns define what a 2-point (strong) answer and a 0-point (weak / red-flag) answer look like, so two different evaluators score consistently. KPI criteria are anchored to HFMA's MAP Keys, which publish the equation, inclusions and exclusions for each revenue-cycle KPI — Clean Claim Rate (CL-1), Remittance Denial Rate (AR-5), Net Days in A/R (FM-1), Aged A/R as a Percentage of Total A/R (AR-3) and Cost to Collect (FM-6) among them — so you compare vendors against a recognized definition rather than each vendor's private math. Be clear about what that does and does not give you: MAP Keys publishes definitions and equations only, with no target values attached, and it has no net-collection-rate key at all. Use it to make each metric mean the same thing across vendors; set the target itself from your own baseline.

For the deeper pricing context behind criteria 8-10, see how much medical billing companies charge; for the KPI definitions behind criteria 11-14, see the clean claim rate formula and days in A/R benchmark.

Here is the rubric applied to two hypothetical finalists so the math is concrete. Award each criterion 0/1/2, sum the raw points per category, then scale to the category weight using (raw earned / max raw) x weight.

Vendor A is a mid-market firm with strong compliance and KPI discipline but a per-claim model with some add-ons. Vendor B pitched a low headline price but is thin on compliance and reporting.

Reading the result. Vendor A lands at 88 — a strong finalist. Advance to reference calls and contract redlining, and close the two-point gaps (specialty currency, A/R remedy) in the SLA. Vendor B lands at 46 — below 55, decline. Note what the weighting did: Vendor B's competitive pricing barely moved the total because pricing is one of three mid-weight categories, while its compliance and KPI weakness — the high-weight categories — sank the score. That is the scorecard working as designed: a cheap vendor that cannot evidence compliance or commit to KPIs should not win on price alone.

One caution the math cannot show. Run the auto-disqualifier check (next section) before you celebrate any total. If Vendor B had also refused a BAA, its 46 would be moot — it is out regardless. Conversely, never let a high total paper over a missing SOC 2 Type II report.

Four findings remove a vendor from consideration no matter how high the weighted total climbs. These are not point deductions — they are gates. One of them is a legal requirement; the other three are requirements you are choosing to set as a buyer. Keeping that distinction straight matters, because a vendor that fails a buyer-set gate is not thereby breaking the law, and a vendor that fails the legal one is.

1. No SOC 2 Type II report — a gate you set, not one the law imposes. SOC 2 is a private assurance framework. HIPAA does not require it, and a vendor without one is not thereby non-compliant. What a current Type II report gives you is independent evidence that security controls operated effectively across a period, rather than existed on a single day (the weaker Type I) or were merely described in a questionnaire. For a vendor holding your patients' PHI and your cash flow, that evidence is worth making a hard stop — but make it a hard stop you have set deliberately and apply identically to every finalist, including any incumbent. 'In progress' is not a Type II report.
2. Refusal to sign a HIPAA Business Associate Agreement (BAA) — this one is the law. A billing vendor creates, receives, maintains or transmits PHI on your behalf, which makes it a business associate. HHS states that the HIPAA Rules permit a covered entity to disclose PHI to a business associate where the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement, citing 45 CFR 164.502(e); the Privacy Rule sets the required elements of that agreement at 45 CFR 164.504(e), the Security Rule adds its own BAA requirements at 45 CFR 164.308(b), and business associates are directly liable for certain provisions of the Rules in their own right. A vendor that resists signing one, or that tries to gut the breach-notification and liability terms, is telling you how it will behave when something goes wrong. Non-negotiable, and not a matter of preference.
3. Multi-year lock-in with no performance guarantee or exit clause. A long term is only acceptable when paired with written KPI commitments and a remedy if they are missed. A multi-year contract with punitive termination clauses and no performance guarantee transfers all the risk to you: if the vendor underperforms, you are trapped paying for it. Pair this disqualifier with the companion read on switching billing companies without revenue loss — the exit terms you sign today determine whether you can ever leave cleanly.
4. Refusal to put KPI targets in writing. A vendor that will not commit a clean claim rate, a denial-rate ceiling, a net days in A/R target or a net collection rate floor into the contract or SLA — each with its denominator written out, and using MAP Keys definitions wherever a key exists for the metric — is selling effort, not outcomes. Verbal assurances are unenforceable. If it is not in writing with a defined denominator and a remedy, it does not exist.

A practical rule: score all 27 criteria first so you understand the vendor fully, then run the four gates. The score tells you how good the best-case relationship looks; the gates tell you whether the relationship is safe to enter at all. A vendor must clear all four gates and land in an acceptable band to advance.

The scorecard is only as good as the discipline you apply it with. A repeatable process keeps the comparison honest across finalists.

1. Build the worksheet once, reuse it for every vendor. Put the 27 criteria, the 0/1/2 definitions, and the category weights into a spreadsheet before the first demo. Scoring vendors on different sheets, or scoring later vendors more generously because you have 'demo fatigue,' destroys comparability.
2. Walk in with your own numbers. Pull your current clean claim rate, denial rate, net days in A/R, aged A/R over 90 and net collection rate from your PM system, using MAP Keys definitions for the four it defines and writing down your own formula for net collection rate, which it does not. This turns a sales pitch into a diagnostic conversation — if most of your money is sitting in the aged buckets, what you are actually buying is accounts receivable follow-up services, and criterion 13 should carry the most weight in your read — and it gives you a baseline to measure the vendor against. The medical billing KPI dashboard template and medical billing audit checklist help you assemble those numbers.
3. Demand evidence for every 2. A criterion only earns 2 points with proof: the SOC 2 report under NDA, the redacted sample report, the contract clause, the reference call. Score on artifacts, not adjectives.
4. Score independently, then reconcile. If two people from your practice score each finalist separately and then compare, the criteria where they diverge are exactly the ones to probe further with the vendor.
5. Decide build vs. buy with the same rigor. If your top finalist still lands below your threshold, the answer may be to keep billing in-house and fix the process. The trade-offs are laid out in RCM outsourcing vs. an internal team, and the broader market view is in best medical billing companies 2026.

Where MedPrecision Billing maps onto the scorecard — with the evidence, and with the gaps named. This is disclosure, not scoring; you score us.

• Criteria 1-4, compliance and security. On independent attestation we are naming a gap rather than filling it: we are not publishing an attestation summary while we cannot publish the artifact behind it. Ask us directly and we will tell you in writing what we hold and what we can send under NDA — and apply criterion 1 to that answer exactly as you would to any other vendor's. Note also that a hosting provider's SOC 2 is not its customer's; check whose name is on any report you are shown. We sign a HIPAA Business Associate Agreement as a matter of course — as criterion 2 says, that one is not optional for anybody. Where you should push us exactly as you would push any vendor: ask for the report, and ask who performed the audit and for which period, because a Type II report you have not read is not evidence.
• Criterion 5, coding credentials. Team-level AAPC certification and AHIMA credentials, held across the coding team rather than attached to any one named individual. Ask how that maps to your specialty specifically.
• Criteria 8-10, pricing transparency. One model, published: 7.0% of monthly collections for solo practices, 6.0% for group practices of 2-15 providers, custom tiered pricing for enterprise. No setup fee, no implementation fee, no per-claim charge, no software fee, with EMR/EHR integration included. The solo tier carries a monthly minimum; the amount is set in your quote and the Service Agreement rather than published here, and you should ask for it in writing before comparing our price to anyone else's.
• Criteria 11-14, KPIs and reporting. Ask us for the same written targets and the same denominators you demand of every other finalist, and score the answer by whether it is in the contract, not by whether it sounded confident.

The point of this page is the neutral framework: score every vendor — including us — on the identical 27 criteria, and let the evidence decide.