Before you sign, ask ten things: how they handle your specialty, whose bank account receives payer payments, how they are paid, what the business associate agreement says, who coded claims and who checks them, how denials are worked, what reports you get, how filing deadlines are tracked, and how you leave. Get every answer in writing.
Most checklists for choosing a billing company stop at “how much experience do you have?” That is the easy question. The costly surprises come later: payments routed to the wrong account, a vague contract, a report you cannot check, or no clean way out. This guide groups ten questions by risk, ties each to a federal rule or HHS guidance you can read yourself, and shows what a solid answer looks like. If you are still deciding whether to outsource at all, start with our overview of medical billing services.
Key takeaways
- Payments should land in an account in your practice’s name; for Medicare, the rule says payment to a billing agent is made in the provider’s name.
- A billing company that handles patient data is a business associate, so a signed BAA comes before any data access.
- Fee models differ in what they reward. HHS OIG has warned that percentage billing may increase upcoding risk, so ask what safeguards sit around it.
- Ask for named metrics with written definitions, not a promise of a good rate.
- Settle exit terms (data export, transition help, return or destruction of PHI) before you start, not when you leave.
What should you know before you start comparing billing companies?
Know your own numbers and your scope first. A billing company’s answers only mean something if you can test them against your baseline. Pull the last 12 months of claims and remittances from your practice management system or EHR before the first call.
- Denials: how many claims came back denied on the first remittance, and the top five reasons.
- A/R aging: how much sits in each aging bucket, and by which payer.
- Payer mix: your top payers by claim volume, including any Medicare and Medicaid share.
- Scope: which tasks stay in-house (front desk, charge entry, patient calls) and which you would hand over.
Scope matters because “billing” can mean different things. Some companies only submit claims and post payments. Others also run eligibility checks, coding support, denial appeals and A/R follow-up, which is closer to full revenue cycle management. If the measures below are new, our guides to revenue cycle KPIs and clean claims explain them.
What are the 10 questions to ask a medical billing company?
They cover money, privacy, claim quality, reporting and exit. The table is the short version; the sections after it explain the rule or guidance behind each group.
| Question | A solid answer includes | Warning sign |
|---|---|---|
| 1. Have you billed for practices like mine? | Names your specialty and payer mix, explains how they handle your common procedures, and agrees to work a sample of your own claims. | “We do all specialties” with no detail. |
| 2. Whose account do payments land in? | Payer deposits go to an account in your practice’s name. You can see the statements and their access is documented. | Payments go to the billing company’s account, or you cannot see the bank activity. |
| 3. How are you paid? | A written fee model, what it covers, what costs extra, and who pays clearinghouse or other pass-through charges. | Add-on fees that are not listed in the contract. |
| 4. Will you sign a BAA before seeing patient data? | Yes, before access. The BAA covers safeguards, breach reporting, subcontractors and return or destruction of PHI. | Wants access first, or offers a generic privacy statement instead. |
| 5. Who else touches our data, and how fast do you tell us about a breach? | Lists subcontractors and where data is stored or accessed. States a breach-notice timeline in the contract. | Cannot name who has access. |
| 6. Who codes, and who checks their work? | Named coder credentials, a documented sample review before and after submission, and a way to query your providers. | “Our coders are experienced” with no review process. |
| 7. How do you work denials? | Sorts denials by reason, tracks appeal deadlines, fixes the cause upstream and reports it to you. | Resubmits claims without reporting why they were denied. |
| 8. What reports do we get, and can we see claim status? | Written metric definitions, a regular report schedule and direct access to claim status. | One total number with no definition. |
| 9. How do you track filing deadlines? | Knows each payer’s window, alerts before it closes and states in the contract what happens when one is missed. | Does not know the windows for your payers. |
| 10. What does leaving look like? | Notice period, data export in a usable format, transition help and PHI return or destruction, all in writing. | Data returned only “on request,” for a fee, in no stated format. |
Source: RCM Finder checklist, drawing on the HHS, CMS and HHS OIG sources cited in the sections below.
Do they know your specialty and payer mix? (Question 1)
Experience only counts if it matches your work. A pain management practice, a family practice and a behavioral health practice bill very differently, so “years in business” tells you little. Ask for specifics on your procedures, your common denials and your top payers.
Then test it. Give the vendor a sample of your recent claims, including denied ones, and ask what they would have done differently. Our billing team builds specialty logic per claim, not per practice: the portal groups 35 specialties into shared billing-pattern archetypes. Our billing pipeline was built and tested against real claim data from an affiliated pain management and neurology practice in Indiana. You can browse the specialties we support, or see how we approach pain management billing. If you are comparing vendors for another specialty, this OB-GYN outsourcing checklist shows how specific the questions can get.
Ask for a test, not a testimonial
A vendor that is confident in its process should be willing to review a sample of your own claims. A glowing quote from someone else’s practice tells you nothing about yours.
Who controls your money, and how are you paid? (Questions 2 and 3)
Payments should land in an account that belongs to your practice. For Medicare, the rule points the same way: under 42 CFR 424.73, payment to an agent “will always be made in the name of the provider.”
The same rule lets Medicare pay a billing agent only under set conditions. Look at what it requires:
- The agent is paid under an agency agreement with you.
- The agent’s pay is not related in any way to the dollar amounts billed or collected.
- The agent’s pay does not depend on actually collecting the payment.
- The agent follows payment instructions that you can change or revoke at any time.
- The agent acts only on your behalf when receiving payment.
That describes when Medicare may pay an agent directly. It is not a ready-made contract, and it does not settle every fee model. Ask your attorney how it applies to your arrangement, and ask the vendor to show you in writing where payments land and who can move the money.
How the fee model changes behavior
Fee models reward different things. In its compliance guidance for third-party billing companies (1998), HHS OIG said percentage billing arrangements may increase the risk of upcoding, and that staff pay should not give a financial incentive to upcode claims. A law-firm review of RCM contracts also notes that OIG has flagged percentage-based pay for federally payable services under the anti-kickback statute (Wilson Sonsini). None of that means a percentage fee is wrong for you. It means you should ask what safeguards sit around it.
| Fee model | How it works | Check before you sign |
|---|---|---|
| Percentage of collections | Fee is a share of what is collected. | Which payments count, how reversed payments are treated, and what review stops upcoding. |
| Flat monthly fee | Fixed fee for a defined scope. | What volume it covers and what counts as out-of-scope work. |
| Per-claim fee | A charge for each claim handled. | Whether resubmissions and appeals count as new claims. |
| Hourly or dedicated staff | You pay for time or a named person. | How hours are reported and who is accountable for quality. |
Source: HHS OIG, Compliance Program Guidance for Third-Party Medical Billing Companies, 63 Fed. Reg. (Dec. 18, 1998), on percentage billing; the other columns are RCM Finder’s practical checks.
We do not publish prices, because they depend on your volume, payer mix and scope. We quote after a free audit. Whoever you pick, get the fee, the scope and the pass-through charges on one page.
Want a baseline before you compare quotes?
Our free practice audit reviews a sample of your claims, denials and A/R aging, so you have numbers to hold any billing company to, including us.
What should the BAA and security answers look like? (Questions 4 and 5)
A billing company that handles your patients’ data is a business associate, and HIPAA requires a signed agreement first. HHS lists billing and claims processing among the activities that make a vendor a business associate. Do not allow data access until the business associate agreement (BAA) is signed.
Business associates are also directly answerable under HIPAA. HHS lists ten provisions, including complying with the Security Rule, limiting PHI to the minimum necessary, signing BAAs with subcontractors that touch PHI, and giving breach notice. Use that list as your question set:
- Will you sign our BAA before you see any patient data?
- Which subcontractors, clearinghouses or offshore teams will handle our PHI, and do you have BAAs with them?
- How is access limited by role, and can we see who opened our claims?
- How are connections encrypted, and how is data stored?
On breaches, 45 CFR 164.410 requires a business associate to notify the covered entity without unreasonable delay, and no later than 60 calendar days after discovery. Treat that as the outer limit, and ask for a shorter window in the contract. At the end of the relationship, the BAA must require the vendor to return or destroy PHI where feasible. HHS guidance also says that if you know of a pattern of activity that is a material breach by the vendor, you must take reasonable steps to fix it and, if that fails, end the agreement where feasible.
Ask to read the BAA and the security policies rather than accept a badge or a one-line assurance. For our own portal, we can state the controls we run: role-based access, audit logging and encrypted (HTTPS) connections, and we put a Business Associate Agreement in place before accessing patient data. Our guide to HIPAA compliance in medical billing goes deeper on what to expect from any vendor.
Who codes, who checks, and how are denials worked? (Questions 6 and 7)
A good billing company can describe its quality checks in specific terms. The HHS OIG guidance for billing companies is a useful yardstick, because it describes what a compliance-minded vendor does. Paraphrased, it calls for:
- Dividing responsibilities between you and the billing company and putting them in the written contract.
- Reviewing a valid statistical sample of claims each year, both before and after submission.
- Having the coder review rejected claims that involve diagnosis or procedure codes.
- Not employing or contracting with individuals sanctioned by OIG.
- Sending each provider client a copy of the billing company’s compliance program.
The same guidance says documentation is the provider’s responsibility. A billing company cannot fix a note that does not support the code. So ask what happens when documentation is unclear: who queries your provider, how fast, and how it is tracked.
“If a vendor cannot tell you how it finds its own coding errors, you are trusting its word. We would rather show the review process.”
— Awais Afzal, Healthcare Operations & Data Analyst
Denials: ask for a process, not a promise
Denial work is more than resubmitting. A solid answer covers sorting denials by reason, tracking appeal deadlines, fixing the cause (registration, eligibility, authorization or coding) and reporting back to you. Our guide to medical billing denial management shows what that workflow looks like.
Be careful with guaranteed rates
A promised denial rate or collection rate means little unless the formula, the payers and the baseline are defined. Your result depends on your payer mix and documentation. Ask for the definition in writing first, then for the rate.
What should you get in reports, deadlines and exit terms? (Questions 8, 9 and 10)
Ask for named metrics with written formulas. HFMA’s MAP Keys (2023 edition) publishes standard definitions that you can put in a contract. Here are four that suit a vendor review:
| Metric | How HFMA defines it | What to ask the vendor |
|---|---|---|
| Net Days in A/R (FM-1) | Net A/R divided by average daily net patient service revenue, using the most recent three-month daily average. | Do you report this the same way every month? |
| Remittance Denial Rate (AR-5) | Claims denied divided by claims remitted, counting only actionable denials that can be corrected and resubmitted. | How do you count a denial, and do you include appeal denials? |
| Denial Write-Offs as % of NPSR (AR-6) | Net dollars written off as denials divided by average monthly net patient service revenue. | Who approves a denial write-off, and do you report it? |
| Cost to Collect (FM-6) | Total revenue cycle cost divided by total patient service cash collected, net of refunds. | What does our total cost include, such as fees, software and staff time? |
Source: HFMA, MAP Keys: Indicators of Revenue Cycle Excellence, 2023 Edition.
For filing deadlines, know the payer rules. For Medicare fee-for-service, the CMS claims processing manual says Medicare denies a claim as untimely when it is received more than 12 months, or one calendar year, after the service date, with listed exceptions. Other payers set their own windows, so ask the vendor which ones it tracks and how it alerts you. Our guide to accounts receivable follow-up covers the A/R side.
Finally, settle the exit. The contract should state the notice period, the data export format, any help with transition to a new vendor or in-house team, and how PHI is returned or destroyed. It is far easier to agree on this before the first claim goes out.
Curious what open claims could be costing you?
Use our revenue calculator to put a rough number on stalled A/R before you compare billing companies.
Our recommendations
- Start from your own numbers. We would not take a single call before pulling denial reasons, A/R aging and payer mix from your last 12 months. Every answer you hear is then testable.
- Test on real claims. Hand over a sample of your own claims, including denials, and judge the review you get back. A demo deck cannot show you that.
- Put money flow in writing. Confirm in the contract which account receives payer payments and who can move funds. Have your attorney review it against the fee model.
- Sign the BAA first. No patient data should move until the BAA is signed. Read the breach-notice and subcontractor clauses yourself.
- Define every metric in the contract. Use named formulas, such as the HFMA definitions above, so a good month means the same thing to both sides.
- Agree the exit on day one. Data export format, transition help and PHI return or destruction cost almost nothing to write down at the start and a great deal to negotiate later.
One question to ask any biller is how you will see your own claims.
The RCM Finder portal gives practices a client portal with claim status by stage and owner, so you do not have to call to find out where a claim is.
See how the RCM Finder portal works · Create a portal account
Disclosure: RCM Finder builds and sells this portal. It is a practice management system, not an EHR.
Bottom line
The right billing company is the one that gives clear, checkable answers on money flow, privacy, claim quality, reporting and exit. If you want a baseline to hold any vendor to, start with our free practice audit. You can also read how our end-to-end revenue cycle management service works, or talk to us through our contact page.
Frequently asked questions
How much does a medical billing company cost?
It depends on the fee model, your volume, payer mix and scope, so we do not quote a number here. Common models are a percentage of collections, a flat fee, a per-claim fee or hourly staff. Whichever you choose, get the fee, scope and pass-through charges on one page. We quote after a free audit.
Do I need a BAA with a medical billing company?
Generally yes. HHS lists billing and claims processing among the activities that make a vendor a business associate, so a BAA must be in place before the vendor handles your patients’ PHI. Read it for safeguards, breach reporting, subcontractors and return or destruction of PHI at the end.
Should payer payments go to my bank account or the billing company's?
Ask for an account in your practice’s name. For Medicare, 42 CFR 424.73 says payment to an agent is made in the provider’s name and sets conditions for billing agents. Have your attorney confirm how the rule applies to your fee model and any other payers.
What denial rate should a billing company guarantee?
Be cautious with any guarantee. A rate depends on how denials are counted, your payers and your documentation. Ask for the formula first. HFMA’s Remittance Denial Rate counts actionable denials against claims remitted. Compare vendor figures with your own baseline.
Can I take my data if I leave a billing company?
Only if the contract says so. HHS says a BAA must require the vendor to return or destroy PHI at termination where feasible. Ask for the export format, timeline and any fees in writing, along with help moving to a new vendor or in-house team.
How long do I have to file a Medicare claim?
For Medicare fee-for-service, CMS says a claim is denied as untimely when received more than 12 months, or one calendar year, after the date of service, with listed exceptions. Other payers set their own windows, so ask your billing company which it tracks.
Get your free practice audit
Tell us about your practice. We will contact you using the details you give.
- A review of your recent claims, denials and A/R aging
- Where your front desk and prior authorizations slow payment
- A prioritized fix list you keep, whether or not you hire us
Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.
Sources
- Business Associates (HIPAA guidance) — HHS Office for Civil Rights (current)
- Direct Liability of Business Associates (fact sheet) — HHS Office for Civil Rights (current)
- FAQ 2082: ePHI retention after services end — HHS Office for Civil Rights (current)
- 45 CFR 164.410 Notification by a business associate — eCFR (current)
- 42 CFR 424.73 Prohibition of assignment of claims by suppliers — eCFR / Cornell LII (current)
- Compliance Program Guidance for Third-Party Medical Billing Companies, 63 Fed. Reg. (Dec. 18, 1998) — HHS Office of Inspector General / Federal Register (1998)
- Key Considerations for Contracting with Healthcare Revenue Cycle Management Companies — Wilson Sonsini (law firm; secondary source) (current)
- MAP Keys: Indicators of Revenue Cycle Excellence, 2023 Edition — HFMA (2023)
- Transmittal 12909 (Pub. 100-04, Chapter 1, Section 70.4) — CMS (2024)
Disclaimer: This article is general educational information for medical practices. It is not legal, HIPAA-compliance, coding or billing advice. Fee arrangements, payer rules and contract terms vary, and the rules cited here can change. Confirm requirements with qualified counsel and your payers before acting.
