HIPAA and your billing partner: what to ask before you sign

When you outsource billing, you're trusting an outside company with your patients' protected health information. Before you sign anything, get clear answers to these questions.

Will you sign a Business Associate Agreement?

A BAA is the contract that legally binds a billing company to protect PHI. If a vendor hesitates, walk away.

How is data encrypted?

Patient data should be encrypted both in transit and at rest. Ask specifically.

Who can access my data?

Look for role-based access and the "minimum necessary" principle — staff should only see what their job requires.

Is access logged?

Audit trails create accountability. There should be a record of who accessed what.

Compliance isn't a feature to upsell — it's the baseline. A partner who treats it that way is the one to trust with your practice.