HIPAA for medical billing and coding companies
What HIPAA requires of billing and coding companies: when you are a business associate and when you become a clearinghouse, BAAs with clients and subcontractors, remote and offshore staff, and breach reporting.
On this page
HIPAA for medical billing and coding companies: at a glance
A medical billing or coding company that handles claims and records for providers is usually a HIPAA business associate. Not every billing company is a clearinghouse: only one that processes nonstandard health information into standard transactions or data elements for another entity, or the reverse, meets HIPAA's clearinghouse definition and becomes a covered entity. Either way it needs BAAs with its clients and with its own subcontractors, Security Rule safeguards, minimum necessary access for coders and billers, and a process to report breaches to clients within 60 days of discovery.
| Usual status | Business associate of the providers it bills for |
|---|---|
| Can become a covered entity | Only if it performs the clearinghouse function: nonstandard → standard transactions, or the reverse |
| Subcontractors | Remote coders, offshore teams, software and cloud vendors need BAAs if they handle PHI |
| Breach notice to clients | Without unreasonable delay, no later than 60 days after discovery |
| Offshore work | Not prohibited by HIPAA; contracts and some programs may restrict it |
Business associate or clearinghouse?
A billing or coding company that handles claims, records and payments for providers is a business associate: it uses PHI on a covered entity’s behalf (45 CFR 160.103).
HIPAA’s definition of a health care clearinghouse names billing services as possible clearinghouses, but the status depends on the function, not the label. A company is a clearinghouse only if it processes health information received from another entity in a nonstandard format into standard transactions, or receives standard transactions and converts them to nonstandard formats for the recipient. Clearinghouses are covered entities. When a clearinghouse handles PHI as a business associate of a client, only part of the Privacy Rule applies to it, and it may use and disclose that PHI only as the BAA permits (45 CFR 164.500(b)). If your service includes format conversion — for example, taking a practice’s spreadsheet or print file and submitting 837 claims — get advice on your status.
What you owe clients directly
Business associates are directly liable under HIPAA for a specified set of duties (HHS fact sheet), including:
- Security Rule safeguards for client ePHI: a documented risk analysis, policies, access control and training.
- Minimum necessary: limit each employee’s access and each disclosure to what the job needs (164.502(b), 164.514(d)) — coders rarely need every client’s full chart.
- Breach notice to clients without unreasonable delay and no later than 60 days after discovery (164.410).
- BAAs with subcontractors that handle client PHI for you (164.308(b)).
Remote, offshore and subcontracted staff
Billing work is often done from home, by contractors or by offshore teams. HIPAA doesn’t prohibit any of these, but every person and company handling PHI must be covered — workforce members by your policies and training, outside companies by a BAA — and your risk analysis must include where and on what devices the work happens. Client contracts and some government programs restrict offshore access; check before you assign work.
Getting clients’ trust
Providers increasingly send security questionnaires to billing vendors. A current risk analysis, written policies, training records and a subcontractor list answer most of them.
Main risks
- Not realizing that format-conversion services can make the company a clearinghouse, with covered-entity duties.
- Remote or offshore coders and subcontractors handling PHI without BAAs or managed devices.
- Coders and billers with access to every client's full records instead of what each job needs.
- Client BAAs promising breach notice faster than the company can investigate.
- Patient statements, EOBs or files sent to the wrong patient or provider.
- Former staff and contractors still able to sign in to client portals and payer websites.
Requirements that matter most here
- Business associate →§ 160.103Who counts as a HIPAA business associate, common examples including SaaS and cloud vendors, subcontractors, and what business associates must do.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- Minimum necessary →§ 164.502(b)What the HIPAA minimum necessary standard requires, when it does not apply, and how small practices put it into practice with role-based access and standard disclosure limits.
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- Access control and sign-in →§ 164.312(a)(1)Only the right people should reach ePHI, each under their own account, with a reliable way to confirm who is signing in. In practice: unique user accounts, strong authentication such as MFA, and automatic logoff.
- HIPAA training requirements →§ 164.530(b)Who must be trained under HIPAA, on what, how often, and how to document it — and what the rule does not actually require.
- HIPAA policies and procedures →§ 164.316What written policies and procedures HIPAA requires, how to keep them current, and how long to keep them — for small practices and business associates.
- Notifying patients of a breach →§ 164.402An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented four-factor assessment shows a low probability of compromise. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery.
- Covered entity →§ 160.103What makes an organization a HIPAA covered entity, the three types, how the provider test works, and what covered entities must do.
Solutions to look at
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Cloud storage and file sharing →ToolCloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
- HIPAA risk assessment software →ToolTools for the security risk analysis HIPAA requires — from the free HHS SRA Tool to paid platforms with guidance, remediation tracking and expert help. What each covers and what it costs.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
If something happens
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Is a medical billing company a business associate?
Usually yes: it handles PHI to perform billing for a covered entity. If it processes nonstandard data into standard HIPAA transactions for others, it may also be a health care clearinghouse, which is a covered entity.
Can we use offshore coders?
HIPAA doesn't ban it. You need BAAs with the offshore subcontractor and the same safeguards; enforcing them abroad is harder. Check your clients' contracts — many restrict offshoring.
Do remote coders working from home need special safeguards?
The Security Rule applies wherever the work happens. Your risk analysis should cover home workstations, network access and printing; we recommend company-managed devices and VPN or virtual desktop access.