HIPAA Business Associate Agreements for Medical Billing Companies: What to Include and How to Comply

A medical billing company handles some of the most sensitive data there is: names, insurance numbers, diagnoses and treatment details. Under HIPAA, that makes you a business associate, with direct legal obligations of your own. The business associate agreement (BAA) is the contract at the centre of those obligations. Here is what it must contain, what to watch for, and the security practices that make the agreement real.

Why billing companies are business associates

HIPAA's Privacy, Security and Breach Notification Rules apply to covered entities (most providers that bill electronically, health plans and clearinghouses) and to business associates: people and companies that create, receive, maintain or transmit protected health information (PHI) on a covered entity's behalf. HHS lists claims processing and billing among classic business associate functions.

Since the HITECH Act and the 2013 Omnibus Rule, business associates are directly liable for certain violations, including failing to comply with the Security Rule, failing to report breaches to the covered entity, and impermissible uses and disclosures. The HHS Office for Civil Rights enforces these rules.

What a BAA must contain

The required elements are set out at 45 CFR 164.504(e). In plain terms, the agreement must:

• ☐ Describe the permitted and required uses and disclosures of PHI by the business associate
• ☐ Prohibit other uses or disclosures except as the contract permits or law requires
• ☐ Require appropriate safeguards and Security Rule compliance for electronic PHI
• ☐ Require reporting of unauthorized uses or disclosures, security incidents and breaches of unsecured PHI
• ☐ Require support for patients' rights to access and amend PHI and for accountings of disclosures, as applicable
• ☐ Require Privacy Rule compliance when performing the covered entity's obligations
• ☐ Make internal practices, books and records available to HHS
• ☐ Require return or destruction of PHI when the contract ends, where feasible
• ☐ Require subcontractors to agree to the same restrictions through their own BAAs
• ☐ Allow termination if the business associate violates a material term

HHS publishes sample business associate agreement provisions that many attorneys use as a starting point.

Clauses to read carefully

Practices often send their own BAA. These terms deserve close attention:

Have an attorney review indemnity and liability terms, and make sure your errors and omissions and cyber insurance line up with what you are promising.

Your own subcontractor BAAs

Every vendor that touches PHI on your behalf is your subcontractor. You need BAAs with:

• Your billing or practice management software vendor
• Your clearinghouse
• Email and cloud storage providers
• Patient statement printing and mailing vendors
• IT support companies with access to your systems
• Shredding services
• Remote or offshore staff companies

If a vendor will not sign a BAA, do not use it for PHI.

Breach notification in practice

If a breach of unsecured PHI happens, you must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410), or sooner if your BAA requires. The covered entity then handles notifications to patients, HHS and, for large breaches, the media. State breach laws may add obligations.

A breach is presumed unless a documented risk assessment shows a low probability that PHI was compromised. Document every incident, even when you conclude it was not a breach.

Worked example: a misdirected email

A biller emails a denial report for Practice A to the office manager of Practice B by mistake. The report lists 40 patients' names, dates of service and procedure codes.

1. Contain: ask Practice B's manager in writing to delete the email and confirm deletion.
2. Assess: document what was sent, to whom, whether it was opened, and the recipient's confirmation. Consider the four factors HHS describes for breach risk assessment: the nature of the PHI, who received it, whether it was actually viewed, and the extent of mitigation.
3. Notify: under a BAA requiring notice within five business days, report the incident to Practice A by day five with your assessment, even if you believe the risk is low.
4. Fix: turn on recipient warnings and data loss prevention in email, and retrain staff.

Total cost if handled well: a few hours of work and an uncomfortable call. Handled badly, it can cost you the client and invite regulatory attention.

Security baseline that backs up your BAA

The Security Rule requires administrative, physical and technical safeguards based on a written risk analysis. HHS offers a free Security Risk Assessment tool at healthit.gov designed for small organizations.

• ☐ Written risk analysis, updated annually and after major changes
• ☐ Written privacy, security, breach response and sanctions policies
• ☐ Named privacy and security officer
• ☐ HIPAA training at hire and annually, with records
• ☐ Full-disk encryption on every device
• ☐ Multi-factor authentication on email, billing software, clearinghouse and payer portals
• ☐ Unique logins; no shared passwords; a password manager
• ☐ Encrypted email or secure portal for PHI
• ☐ Automatic updates and endpoint protection
• ☐ Encrypted, tested backups
• ☐ Same-day access removal when staff leave
• ☐ Locked storage and cross-cut shredding for paper

Warning: Phishing, lost laptops, misdirected emails and reused passwords cause most small-company incidents. Train specifically for these four.

Minimum necessary in daily work

Access and share only the PHI needed for the task. A coder needs the visit note; someone calling a patient about a balance does not need the full chart. Build this into user permissions in your software, not just into policy documents.

Before you sign: a quick BAA review routine

When a new practice sends its BAA, work through it in the same order every time:

1. Confirm the parties and that the agreement covers every entity and location you will serve
2. Find the breach and incident notice deadline and compare it with your incident response plan
3. Read indemnification, limitation of liability and insurance requirements, and check them against your policies
4. Check restrictions on subcontractors, offshore access and data storage locations
5. Confirm how PHI is returned or destroyed at termination and how long you have to do it
6. Note any obligations beyond HIPAA, such as state privacy laws or cyber insurance minimums
7. Send questions or proposed edits in writing before anyone shares PHI

Keep a signed copy of every BAA with your client file, along with a list of your subcontractor BAAs, so you can answer a client's or regulator's questions quickly.

Common BAA mistakes billing companies make

• Starting work "while the BAA is being finalised"
• Signing a practice's BAA without reading the breach deadline
• Forgetting subcontractor BAAs with everyday tools like cloud storage
• Using personal email or texting PHI
• Keeping client data after termination without a reason or a plan

A signed BAA is a promise. Starting a Medical Billing & Coding Business shows you how to keep it, alongside everything else a new billing company needs: credentials, compliance with billing laws, software and clearinghouses, pricing, denial workflows, contracts and finding clients.