Is my medical billing company a HIPAA business associate?

Yes. Any company that handles PHI on your behalf, including a billing service that processes claims, is a business associate. That makes it directly subject to HIPAA’s Security Rule and liable for its own violations.

Do I need a Business Associate Agreement with my billing company?

Yes. HIPAA requires a signed BAA before you share any PHI. Without a valid one, the disclosure itself is a violation, and both parties face federal penalties.

Can I be penalized for my billing company’s HIPAA mistakes?

You can. If you fail to do due diligence on a vendor and a breach occurs, you may be held liable. A billing breach often lands on the practice that hired the vendor, not just the vendor.

What are the penalties for HIPAA violations?

Penalties run from 145 dollars to over 2.1 million dollars per violation, depending on fault. Because most breaches involve many records, the totals stack quickly into the millions.

What must a HIPAA-compliant billing company do?

It signs a valid BAA, encrypts PHI in transit and at rest, limits access, trains staff regularly, runs risk assessments, and notifies you of any breach within the required timeframe.

How often should a BAA be reviewed?

Review it at least once a year and whenever the vendor changes services or subcontractors, or a regulation changes. A BAA drafted before 2013 is out of compliance.

Is Your Medical Biller HIPAA Compliant? Find Out Now