A medical billing company creates, receives, maintains or transmits protected health information on behalf of a covered entity. That makes it a business associate under HIPAA, and it means a Business Associate Agreement has to be in place before any data changes hands.
Not after onboarding. Before.
This is a plain-language summary, not legal advice. Have your own counsel review any agreement before you sign it.
What the agreement has to establish
At minimum, a BAA sets out:
- Permitted uses and disclosures. What the business associate may do with the PHI, and nothing beyond it.
- Safeguards. A requirement to implement appropriate administrative, physical and technical safeguards.
- Subcontractors. That any subcontractor who touches the data is bound by equivalent terms.
- Breach notification. An obligation to report a breach or unauthorised use, and a timeframe for doing it.
- Access, amendment and accounting. Support for individuals' rights of access and amendment, and for an accounting of disclosures.
- Return or destruction. What happens to the data when the relationship ends.
- Termination. The covered entity's right to terminate for a material breach of the agreement.
An agreement that omits breach notification timing, or is silent on subcontractors, is worth questioning before signing.
The questions worth asking beyond the paperwork
A signed BAA is a contractual allocation of responsibility. It is not evidence of anything. These are the questions that produce useful answers:
How is data transmitted? Encrypted transfer, with a named standard. "Secure" is not an answer.
How is data stored, and where? Encryption at rest, and the geography of the storage.
Who can see what? Role-based access with least privilege, so a coder sees what they need for coding and no more.
Is PHI access logged? Audit logging that records who accessed which record and when — and whether anybody reviews those logs.
How are staff trained, and how often? Training at onboarding and on a stated cadence.
What are the controls for remote staff? Most billing work is now partly remote. Device management, VPN, screen locks, prohibition on local storage.
What is the breach procedure? Who is notified, in what timeframe, and what the practice's own obligations then are.
Has anyone independent examined this? A SOC 2 Type II report is the usual answer. If a company claims one, ask which firm performed it and what the report period was — and read it. A badge is not a report.
Where responsibility actually sits
A BAA allocates obligations. It does not remove the covered entity's own responsibilities.
The practice remains responsible for its own safeguards, its own workforce training, and for exercising reasonable diligence in choosing a business associate. If a practice knows of a pattern of activity constituting a material breach by a business associate and does nothing, that is its own problem.
Practically, that means the BAA is the beginning of the relationship rather than the end of the question. Ask the questions above, keep the answers, and revisit them.
A note on what practices send us
The most common HIPAA issue we see is not technical. It is PHI arriving where it should not — patient names in a web form, dates of birth in an email subject line, a spreadsheet with identifiers attached to a general enquiry.
Analysis of a practice's A/R does not require patient identifiers. Claim-level and payer-level data is enough. If a vendor asks for more than that before a BAA is signed, that is worth a question of its own.