Patient privacy in medical billing rests on three controls: share only the minimum necessary data for each billing task, sign a business associate agreement (BAA) with every outside party that handles patient data for you, and limit and log who can open records. HIPAA allows billing without patient consent, but not without these controls.
HIPAA lets a practice use and share patient information to get paid. It does not let everyone in the billing chain see everything. This guide covers privacy inside the billing workflow: what to limit at each task, which outside parties must sign an agreement, and how to control access. For the practice-wide HIPAA program (risk analysis, policies, training), see our HIPAA compliance checklist for medical practices. We do not repeat it here.
Key takeaways
- Payment is a permitted use of patient data, but minimum necessary still limits what each task may see.
- Any outside party that handles patient data for your billing, and its subcontractors, needs a written BAA before access.
- Role-based access and regular log review are how minimum necessary works in daily billing.
- Patient requests to restrict a claim or change a mailing address reach the billing office.
- The HIPAA Security Rule update is still a proposal. Build to today’s rules.
Why is the billing office a privacy risk point?
Because billing handles a wide mix of identifying and clinical data and sends it outside the building. A claim carries a patient’s name, date of birth, insurance IDs, diagnoses and procedures. It moves between staff, vendors and payers.
HIPAA allows this. Under 45 CFR 164.506, a covered entity may use or disclose protected health information (PHI) for its own payment activities, and the Privacy Rule defines payment to include billing, claims management and collection activities (45 CFR 164.501). Uses that need authorization under 164.508(a)(2) through (4) are excepted. That permission is the starting point, not the finish line. Three conditions still apply: minimum necessary, a written agreement with outside parties who act for you, and controlled access.
Federal data shows the scale. The HHS report to Congress on 2024 breaches counted 663 breaches affecting 500 or more people, with about 242.9 million individuals affected. Business associates were involved in 106 of those reports (16%) but about 206.9 million of the individuals (85%). One very large incident can dominate totals like these, so read the 85% as a warning about concentration, not a typical rate.
Billing vendors are targets too. In October 2023, the HHS Office for Civil Rights (OCR) announced a $100,000 settlement with Doctors’ Management Services, a Massachusetts company offering medical billing and payor credentialing that acted as a business associate to several covered entities (HIPAA Journal; Brooks Pierce). A ransomware attack found in December 2018 involved up to 206,695 people. OCR found no accurate and thorough risk analysis, no regular review of system activity such as audit logs and access reports, and no reasonable security policies. Ordinary gaps.
What does minimum necessary mean for billing tasks?
It means each billing task gets only the patient information it needs. The Privacy Rule says a covered entity or business associate must make reasonable efforts to limit PHI to the minimum necessary for the purpose of a use, disclosure or request (45 CFR 164.502, paragraph (b)).
The standard has exceptions, and the main one is treatment: it does not apply to disclosures to or requests by a provider for treatment. Billing is not treatment. A clinician may need the whole chart. A payment poster does not.
HHS calls the standard flexible: each organization writes policies that fit how it works. For uses inside your practice, the regulation requires you to identify which workforce members need PHI, the categories of PHI each needs and any conditions on access, and to make reasonable efforts to limit access to match (45 CFR 164.514, paragraph (d)(2)). Routine disclosures can follow standard protocols. Other disclosures need criteria and individual review. The entire medical record may not be used, disclosed or requested unless specifically justified.
A working example by billing task
HIPAA publishes no task-by-task list, so these rows are our examples. Your written policy decides.
| Billing task | What the task usually needs | What it usually does not need |
|---|---|---|
| Eligibility and benefits check | Name, date of birth, insurance ID, date and type of service | Diagnoses, clinical notes, unrelated visit history |
| Charge entry and coding support | The documented encounter for that visit, provider, procedures and diagnoses to code | Notes from unrelated visits, other family members’ records |
| Claim submission and scrubbing | Claim data fields, payer ID, billing codes | Clinical notes, unless the payer asks for an attachment |
| Payment posting | Remittance details, claim and account references, amounts | Clinical documentation |
| Denial appeal | The claim, the remittance and the documentation that supports the denied service | The complete chart, which needs a specific justification |
| Patient statements and collections | Name, balance, dates of service, amounts, payment history | Clinical detail beyond what the statement requires |
Rule basis: 45 CFR 164.502(b) and 164.514(d) (Cornell LII). The task examples are RCM Finder’s working examples, not regulatory text.
Requests from payers
When a payer or another covered entity asks for records, HHS says you may reasonably rely on the request as the minimum necessary. You are not required to rely on it. In practice we send what the request names, not the full chart.
Who needs a business associate agreement in the billing workflow?
Any outside person or company that handles patient information to do billing work for you. HHS guidance names billing and claims processing among the functions that make a company a business associate. Before you disclose PHI to one, the Privacy Rule requires satisfactory assurances, documented in a written contract or other written arrangement (45 CFR 164.502, paragraph (e)). That is usually a business associate agreement.
Subcontractors count too. HHS says a business associate must have its own BAA with a subcontractor before disclosing PHI to it, and that downstream subcontractors are also business associates. You do not have to sign with the subcontractor directly, so ask your billing vendor to name them.
| Party | BAA needed? | Why |
|---|---|---|
| Outsourced billing or coding company | Yes | Billing and claims processing are named business associate functions |
| That company’s subcontractors that handle the PHI | Yes, between the vendor and the subcontractor | The vendor must get satisfactory assurances from them; you need not sign directly |
| Your own billing employees | No | Business associates are people other than your workforce. Your policies and training cover staff |
| Payer receiving your claims | Generally no | HHS: provider-to-plan claim submissions generally need no BAA; neither party acts for the other |
| Software or cloud vendor that can access your patient data | Usually yes. Confirm with counsel | The conduit exception covers only transmission, not routine access to PHI |
| Postal service or courier moving paper | No | Conduit exception for transmission only |
Source: HHS, Business Associates guidance; 45 CFR 164.502(e) (Cornell LII).
What the agreement has to cover
Under 45 CFR 164.504, paragraph (e)(2), a BAA must:
- Set out the permitted and required uses and disclosures of PHI.
- Bar use or disclosure beyond what the contract or the law allows.
- Require appropriate safeguards.
- Require the vendor to report unauthorized uses or disclosures, including breaches of unsecured PHI.
- Require subcontractors to accept the same restrictions and conditions.
- Require return or destruction of PHI at termination, if feasible.
- Let you terminate if the vendor violates a material term.
The agreement is a floor. We add a breach-notice window, a list of approved subcontractors and data locations, and the right to review access logs. By rule, a business associate must tell you about a breach without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410). Sixty days is the outer limit. You can ask for less.
You can delegate patient notices to the vendor, but HHS says the covered entity remains ultimately responsible for making sure notifications happen. If you learn of a pattern of material violation, HHS says you must act to cure it and, if that fails, end the agreement if feasible.
How should access to billing systems be controlled?
By role, by need and with a record of who opened what. The Privacy Rule asks you to limit access by staff class and category of information (45 CFR 164.514). The Security Rule adds policies for authorizing access to electronic PHI and procedures to regularly review system activity such as audit logs and access reports (45 CFR 164.308, paragraphs (a)(4) and (a)(1)(ii)(D)).
In daily work, role-based access for a billing team usually looks like this:
- Separate roles for registration, coding, posting, appeals and managers, each with only the screens it needs.
- A unique login for every person. Shared logins make an audit log meaningless.
- Access removed the same day someone leaves or changes roles.
- A written schedule for reviewing access logs, with a named reviewer and a record that the review happened.
These are our recommendations, not a regulatory list. The rule says to review activity regularly and leaves the schedule to your risk analysis.
Registration is where this data enters. See our guides to how the front desk affects the revenue cycle and to HIPAA guidelines for the front desk cover that step.
How we handle access at RCM Finder
Our team works inside your existing EHR (for example PrognoCIS, eClinicalWorks or athenahealth) to deliver medical billing services. Our portal uses role-based staff permissions, an audit log and encrypted (HTTPS) connections, and we put a Business Associate Agreement in place before accessing patient data. Ask any vendor, including us, to show you how each works.
What do patient privacy requests mean for the billing office?
Two requests land in billing: “do not send this to my insurer” and “send my statements somewhere else.” Both have rules.
A patient can ask a provider to restrict disclosure of their information for payment, and in general you may decline. There is one exception under 45 CFR 164.522, paragraph (a)(1)(vi). You must agree when the disclosure is to a health plan for payment or operations, is not otherwise required by law, and relates solely to an item or service the patient, or someone other than the plan on the patient’s behalf, has paid for in full.
Providers must also accommodate reasonable requests to receive communications by alternative means or at alternative locations (paragraph (b)(1)(i)). You may condition that on information about how payment will be handled and on a specified alternative address or contact method (paragraph (b)(2)(ii)).
Make it a flag, not a memory
Set a restriction flag and an alternate-address flag at registration so billing sees them before a claim or statement goes out. Without a flag, the request lives in one person’s head. This is our practice, not a rule. Check payer contracts and program rules before agreeing to a restriction.
Sensitive visit types make these flags worth building first. Behavioral health practices bill many of them, and our behavioral health billing and RCM operations page explains how we organize that work.
What do the breach and Security Rule rules mean for billing?
A breach is generally an impermissible use or disclosure, and HHS presumes one is a breach unless a risk assessment shows a low probability that the information was compromised. Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. For breaches affecting 500 or more people, notice to HHS is due on the same timeline. Smaller breaches can be reported annually, within 60 days after the end of the calendar year.
On the Security Rule, HHS published a proposed rule on January 6, 2025 (90 FR 898), with comments due March 7, 2025 (Federal Register). It is still a proposal. Its sections include verification from business associates of technical safeguards compliance and reporting contingency plan activation. A July 2026 summary of the Unified Agenda by McDermott says final action is now projected for July 2027, after an earlier May 2026 target. Until a final rule is published, today’s rules apply. Details are in our post on the 2025 HIPAA Security Rule proposal and revenue cycle management.
How do you vet a billing vendor's privacy practices?
Ask these before you sign, and get answers in writing. They pair with our guide to questions to ask before hiring a medical billing company.
| Question | A clear answer includes | Rule behind it |
|---|---|---|
| Will you sign a BAA before you access any patient data? | A signed BAA covering the contract points above, in place before access | 45 CFR 164.502(e), 164.504(e) |
| Which subcontractors touch our data, and where? | A named list, a BAA with each subcontractor, and where data is stored and accessed | HHS business associate guidance |
| How do you limit what each staff member sees? | Role-based permissions by task, unique logins, same-day removal | 45 CFR 164.514(d)(2) |
| Can we see who accessed our records? | Audit logs by user and a review schedule you can inspect | 45 CFR 164.308(a)(1)(ii)(D) |
| How fast will you tell us about a breach? | A stated window shorter than 60 days, plus the information needed to notify patients | 45 CFR 164.410 |
| What happens to our data when we leave? | Return or destruction of PHI at termination, in writing | 45 CFR 164.504(e)(2) |
| When did you last complete a risk analysis? | A dated, written assessment of risks to electronic PHI with a named owner | 45 CFR 164.308(a)(1)(ii)(A) |
Source: 45 CFR 164.308, 164.410, 164.502, 164.504, 164.514 (Cornell LII); HHS business associate guidance.
See where patient data moves in your billing
Our free practice audit reviews your billing workflow, including who handles claims data today. Pricing for any service is quoted after the audit.
Questions about how we handle access and agreements?
Talk to our team about role-based access, audit logging and our BAA process.
Our recommendations
- Map where billing data goes. List every person, system and vendor that touches patient data from registration to statements.
- Write a minimum-necessary standard for each task. Use the table above as a starting point, then have your compliance adviser review it.
- Confirm the agreement before the access. List vendors, confirm a signed BAA for each and ask for subcontractor lists, before any new vendor receives data.
- Replace shared logins with named, role-based accounts. Then write down who reviews access logs, and when.
- Put restriction and alternate-address flags into registration. Billing should see a patient’s request before a claim or statement goes out, not after.
- Ask for a shorter breach window. Sixty days is the legal outer limit. Agree a shorter window and what the vendor must send.
- Weigh privacy controls and cost together. Comparing in-house and outsourced billing? Start with what billing leaks today. Our revenue calculator gives a first estimate. Then compare vendors on the questions above.
Minimum necessary access is easier when the system enforces it.
The portal uses role-based permissions and keeps an audit log. Access to patient data starts with a signed Business Associate Agreement.
See how the RCM Finder portal works · Create a portal account
Disclosure: RCM Finder builds and sells this portal. It is a practice management system, not an EHR.
Bottom line
Billing may use patient data. It may not use all of it, for anyone, without a record. Limit each task to what it needs, put a BAA in place before any outside party sees data and control access by role. If front-desk work is where your data handling gets loose, our virtual medical assistants work inside your EHR, and we put a Business Associate Agreement in place before accessing patient data.
Frequently asked questions
Can a practice send patient information to a billing company without patient consent?
Yes, for payment, but not freely. HIPAA permits a covered entity to use and disclose PHI for its own payment activities in most cases without patient authorization. The billing company must sign a business associate agreement first, and both sides must limit data to the minimum necessary for each task. A few categories of information need patient authorization.
Do we need a BAA with our billing company?
Yes. HHS names billing and claims processing as business associate functions, and the Privacy Rule requires written satisfactory assurances before you disclose PHI to one. If the company uses subcontractors, it needs its own BAA with each. You do not sign with them yourself, so ask for the list.
Does minimum necessary apply to billing staff?
Yes. It applies to uses, disclosures and requests of PHI, including for payment. The main exception is disclosures between providers for treatment, and billing is not treatment. Your policy should say which roles may see which categories of information. Routine tasks can follow standard protocols instead of case-by-case review.
Can a patient tell us not to bill their insurance?
Sometimes. You must agree to a restriction when the disclosure is to a health plan for payment or operations, is not required by law, and the patient or someone other than the plan paid for the service in full. Otherwise you may decline. Document the request, flag the account and confirm payer rules first.
Who is responsible if our billing vendor has a breach?
Both of you have duties. The vendor must notify you without unreasonable delay and within 60 calendar days of discovery. You can delegate patient notices to the vendor, but HHS says the covered entity remains ultimately responsible for making sure notices happen. Put timing and content in the BAA.
Is the proposed HIPAA Security Rule update in effect?
No. HHS proposed changes on January 6, 2025, and a July 2026 summary of the regulatory agenda says final action is projected for July 2027. Follow the current rules now, and watch for the final text before changing your vendor contracts.
Get your free practice audit
Tell us about your practice. We will contact you using the details you give.
- A review of your recent claims, denials and A/R aging
- Where your front desk and prior authorizations slow payment
- A prioritized fix list you keep, whether or not you hire us
Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.
Sources
- Business Associates — HHS (2026)
- Minimum Necessary Requirement — HHS (2026)
- 45 CFR 164.502 Uses and disclosures: general rules — Cornell LII (eCFR text) (2026)
- 45 CFR 164.514 Other requirements relating to uses and disclosures — Cornell LII (eCFR text) (2026)
- 45 CFR 164.501 Definitions (payment) — Cornell LII (eCFR text) (2026)
- 45 CFR 164.506 Uses and disclosures for TPO — Cornell LII (eCFR text) (2026)
- 45 CFR 164.504 Organizational requirements — Cornell LII (eCFR text) (2026)
- 45 CFR 164.522 Rights to request privacy protection — Cornell LII (eCFR text) (2026)
- 45 CFR 164.308 Administrative safeguards — Cornell LII (eCFR text) (2026)
- 45 CFR 164.410 Notification by a business associate — Cornell LII (eCFR text) (2026)
- Breach Notification Rule — HHS (2026)
- Change Healthcare Cybersecurity Incident FAQs — HHS OCR (2025)
- Annual Report to Congress on Breaches of Unsecured PHI (2024) — HHS OCR (2024 data)
- HIPAA Security Rule To Strengthen the Cybersecurity of ePHI (NPRM) — Federal Register (2025)
- Final action on HIPAA Security Rule modifications now projected for July 2027 — McDermott (2026)
- Doctors' Management Services Settles OCR HIPAA Probe for $100,000 — HIPAA Journal (2023)
- Business Associate Victim of Ransomware Attack Pays $100,000 to HHS OCR — Brooks Pierce (2023)
Disclaimer: This article is general educational information for medical practice owners and managers. It is not legal, compliance, coding or billing advice. It covers federal HIPAA rules only. State law, payer contracts and other federal rules may add requirements, and rules change. Confirm requirements with a qualified healthcare attorney or compliance adviser before acting.
