Pediatrics Specialty

Pediatric Billing Services for Well-Child, Vaccine and Medicaid-Heavy Practices

Preventive visits, vaccine administration, screenings, EPSDT and newborn enrollment, billed to each payer's rules with pre-visit coverage checks and a claims portal.

  • Works inside your current EHR
  • US practice time zone, every shift
  • Weekly KPI reporting, or on your schedule
Pediatric billing dashboard showing well visits due, vaccine claims, denials by reason, A/R days and newborn coverage

Quick answer

Pediatric billing services turn each visit into payable claims: preventive and sick visits split with modifier 25, vaccines counted by component and program, screenings billed per instrument, and Medicaid, CHIP and newborn coverage checked first. RCM Finder adds pre-visit checks, patient marketing and a claims portal.

Disclaimer: This page is educational and is not legal, coding or compliance advice. CPT and HCPCS codes, Medicaid and CHIP rules, VFC billing details, payer policies and state minor-consent laws change often and vary by state, plan and contract. Verify every code, modifier, indicator, unit limit and eligibility rule against the current CPT and HCPCS code sets, your state Medicaid agency, your payer contracts and your own counsel before billing.

Why pediatric billing is different

Pediatric billing is high volume, low dollars per line and heavy on Medicaid and CHIP. One well-child visit can carry a preventive visit, two vaccines, a developmental screen and a separate sick problem. Each line can be denied on its own.

In MACPAC's February 2026 data book, about 37% of US children (36.9%) had Medicaid or CHIP coverage in 2024. MACPAC also counts 47.2 million children ever enrolled in the two programs during fiscal year 2024. State rules shape cash flow as much as national ones.

Coverage also moves. Since January 1, 2024, Medicaid and CHIP must give children under 19 a full year of continuous eligibility. That does not reach commercial plans, newborn enrollment gaps or a family that switches plans, so the front desk still checks coverage at each visit.

For a general overview, read our post on pediatric billing and collections challenges. This page goes deeper on codes and state rules. Practices that also see adults may want our family practice billing page.

The four pillars, built for a pediatric practice

A pediatric practice needs parents who can find it, a front desk that confirms coverage before the child arrives, claims coded to the vaccine component and the screening instrument, and software that shows where each claim sits.

Revenue leaks at the handoffs: a newborn seen before coverage is on file, a vaccine line billed without the program indicator, a screening billed twice. We run all four pillars on one set of rules.

Pillar 1 · Healthcare Marketing

Healthcare Marketing for pediatric practices

Parents search when expecting, after a move and when a child is sick. Our healthcare digital marketing covers local search, newborn pages and review replies that never confirm someone is a patient.

  • Newborn pages that match who you accept
  • Accurate plan listings on profiles
  • KPI: new-patient requests by plan type
Explore Healthcare Marketing
Pillar 2 · Virtual Medical Assistants

Virtual Medical Assistants for pediatric front desks

Our virtual medical assistants for pediatric practices work on your practice's time zone. They check coverage, follow up on newborn enrollment, track referral authorizations and answer billing calls.

  • Coverage and plan type checked before each visit
  • Newborn coverage follow-up until the baby's own ID is on file
  • Referral and imaging authorizations tracked
  • KPI: visits with verified coverage
Explore Virtual Medical Assistants
Pillar 3 · End-to-End RCM

End-to-End RCM for pediatric claims

Our end-to-end pediatric revenue cycle management covers charge entry, coding support, claim scrubbing, posting, denials and A/R follow-up, with extra checks on vaccine components, modifier 25, screening units and state indicators.

  • Vaccine lines checked by component and by program
  • Modifier 25 documentation reviewed before submission
  • Screening units reconciled with the instruments used
  • KPI: denials by reason and A/R days
Explore End-to-End RCM
Pillar 4 · Practice Management System

Practice Management System for pediatric billing

Our practice management system tracks every claim by stage, applies specialty-aware billing logic per claim, checks data completeness before submission and flags underpayments. Billing companies get a client portal.

  • Workflow rules that hold claims missing required data
  • Underpayment flags against expected amounts
  • Role-based permissions and an audit log
  • Early access: appointment scheduling
Explore Practice Management System

Find where your pediatric claims leak

We review recent claims, remittances and denials, then show where vaccine lines, modifiers or coverage gaps cost you.

Get a Free Practice Audit

Well visits, vaccines and screenings: the codes and where they deny

Most pediatric denials start with modifier 25, vaccine counting, the VFC program or screening units. The table lists each service family, its rule and the usual denial trigger. Codes are described in our own words; check the current CPT set.

Pediatric service families: how they are billed and where they deny
ServiceCode or modifier (our wording)Rule or documentation pointTypical denial trigger
Preventive visit99381-99385 new patient; 99391-99395 established; age-banded (99393 is ages 5-11, 99394 ages 12-17)Pick the family by new or established status, then the age bandWrong age band; established code on a new patient
Sick problem at a well visitOffice E/M 99202-99215 with modifier 25Problem must be significant, separate and documented on its ownMinor concern coded; payer ignores 25
Vaccine with counseling90460 first or only component of each vaccine; 90461 each added componentThrough age 18; counseling by a physician or other qualified professionalBilled per vaccine, not per component; no counseling note
Vaccine without counseling90471-90474Used when no counseling, or the patient is over 18Wrong family chosen for the visit
Vaccines for Children (VFC) vaccineVaccine code plus the state's program modifierProduct is free; the practice bills administration. Modifier rules vary by stateProduct billed to Medicaid; program modifier missing
Developmental screen96110 per standardized instrumentTool, score and follow-up documented; payers set unit capsUnits above the cap; no instrument documented
Brief emotional or behavioral screen96127 per standardized instrumentA recognized tool, scored and documentedNo scored standardized tool; units split when the payer wants one line
EPSDT claimReferral indicator in item 24h or its electronic equivalentRequired by some Medicaid plans on every EPSDT claimClaim denied for a missing indicator

Sources: AAP modifier 25 primer (Nov 2025); AAFP and Maryland Department of Health vaccine administration guides; CDC VFC pages (Aug 2026); 42 CFR 441.615; Oregon OAR 410-130-0255; AAPC code pages (99383, 99393, 99394); Oklahoma Health Care Authority coding fact sheet; AMA 2023 coding fact sheet; Molina Ohio EPSDT guide. Rules vary by payer and state.

Diagram of a pediatric visit from eligibility and VFC screen to documentation, coding, modifier check and payment review
How one well-child visit becomes a clean claim.

Modifier 25 goes on the problem visit

The AAP's modifier 25 primer (updated November 2025) puts the modifier on the office E/M code, not the preventive code. The extra problem must be significant, separate from the preventive work and documented on its own. It warns that many payers, including Medicaid, do not recognize modifier 25 or reduce payment.

Payers differ on vaccines too. Blue Cross NC's provider notice says its correct-coding edit pays only the vaccine administration when a preventive visit shares the date, unless modifier 25 is on the visit code. Read each payer's policy. Our explainer on modifiers 25 vs 59 covers the basics.

Count vaccines by component

The AAFP's vaccine administration guide and the Maryland Department of Health billing manual describe 90460 and 90461 as for patients through age 18 when a physician or other qualified professional counsels face to face. 90460 covers the first or only component of each vaccine. 90461 covers each additional component of a combination vaccine. When there is no counseling, or the patient is over 18, 90471-90474 apply. The vaccine product is billed separately; some payers want its National Drug Code.

VFC vaccines: product free, administration billable

Under 42 CFR 441.615, a provider may not charge for a VFC vaccine. The administration fee cannot exceed the regional maximum, and a provider may not refuse an eligible child because the family cannot pay it. State billing details differ. Oregon's Medicaid rule has VFC providers bill the vaccine code with an SL or 26 modifier. A Humana notice about Kentucky Medicaid requires SL from January 1, 2025 and says 90461 is no longer payable for VFC-eligible children. Build these rules per state and plan.

Developmental and behavioral screens are billed per instrument

The 2023 AMA coding fact sheet says 96110 (developmental) and 96127 (brief emotional or behavioral) are each reported per standardized instrument. For 96127 with a preventive visit, it tells practices to append modifier 25 to the E/M code. A coding fact sheet from the Oklahoma Health Care Authority adds that the physician should sign the tool and document follow-up. A Maryland Medicaid guide limits 96110 to 8 units per child through age 5 and screening codes to 2 units per visit; limits vary by state. Behavioral screens overlap with our behavioral health billing work.

Medicaid, CHIP and EPSDT: what the claim has to carry

EPSDT is Medicaid's benefit for enrollees under 21. For billing, it means well-child visits follow the state's schedule, screening is documented, and many plans want an EPSDT indicator on the claim.

According to Medicaid.gov, EPSDT screening includes a health and developmental history, an unclothed physical exam, immunizations, lab tests including lead, and health education, plus vision, hearing and dental care. States may adopt a nationally recognized schedule such as Bright Futures. The AAP periodicity schedule page shows a February 6, 2025 update, and the April 2023 schedule PDF lists eight visits in the first year.

Claim rules sit with each plan. A Molina Healthcare Ohio guide says EPSDT claims without the referral indicator in item 24h are denied, with a matching field on electronic claims. Because a practice often holds several Medicaid managed care contracts, we keep a rule sheet for each: indicator, modifier, unit caps and fee schedule.

Newborn enrollment, retroactive eligibility and pre-visit checks

A newborn may be covered through the mother's commercial plan, deemed Medicaid eligibility, a CHIP application or not at all yet. The first claims deny when sent to the wrong one, so confirm the source first.

For employer plans, 45 CFR 146.117 gives at least 30 days from a birth to request enrollment, and coverage for the newborn starts on the date of birth. For Medicaid, 42 CFR 435.117 deems a child born to a Medicaid-eligible mother eligible from birth to the first birthday, with no separate application. The mother's ID can serve at first, but the state must issue the child a separate ID, and some cases need one immediately, such as an emergency-only mother or a CHIP-covered child.

Billing follows the ID. Mississippi's newborn billing guide says claims should use the baby's own ID. It describes the mother's ID with a K suffix as a last resort that can delay payment or cause denials. Other states differ.

Retroactive eligibility is getting shorter

Until the change takes effect, the Medicaid statute covers services back to the third month before the application month. For applications on or after January 1, 2027, H.R. 1 cuts that to two months for most Medicaid enrollees and one for expansion adults, per the National Health Law Program. The AMA's summary says CHIP is capped at two months. Hold pending claims and record the application date.

Run the checklist before the child arrives

Pre-visit checklist for a pediatric practice
CheckWhenWhat to confirmWhy it matters
Active coverage and plan typeBefore every visitMedicaid fee-for-service, managed care, CHIP or commercial, and the member IDContinuous eligibility covers Medicaid and CHIP only; plans change
Newborn coverage sourceBefore the first visitMother's plan, deemed Medicaid, a CHIP application or nothing yetClaims under the wrong ID deny
Application date for pending MedicaidWhen coverage is pendingThe date and the retroactive windowThe window shortens for applications from January 1, 2027
VFC eligibilityEvery visitThe screening answer is recordedFederal program requirement
Visit type against the scheduleAt schedulingLast well visit, payer frequency, EPSDT flagEarly or duplicate visits deny
Planned screening toolsAt schedulingWhich instrument, and whether the payer covers it at this ageUnit caps and age limits vary
Authorization for referrals and imagingWhen orderedWhether the plan requires it and the decision timeframeMedicaid and CHIP now have set decision timeframes
Adolescent confidentiality flagAt registrationAlternate contact and how statements go outStatements can reach the policyholder

Sources: Medicaid.gov continuous eligibility (CAA 2023 s. 5112); 42 CFR 435.117; 45 CFR 146.117; 42 U.S.C. 1396a(a)(34); AMA OBBBA summary; CDC VFC eligibility (Aug 2026); CMS-0057-F fact sheet. Rules vary by state and payer.

Diagram of a newborn from birth and coverage source to enrollment, the baby's own ID, eligibility check and claim release
Newborn coverage, from birth to a claim under the right ID.

Prior authorization still applies to some pediatric services. Under CMS-0057-F, Medicare Advantage, Medicaid and CHIP fee-for-service and managed care plans must decide prior authorizations within 72 hours (expedited) or seven calendar days (standard) since January 1, 2026, excluding drugs. Healthcare Finance News (July 2026) reports UnitedHealthcare will remove nearly two-thirds of its requirements for children under 18 by year-end 2026. See our guides to prior authorization and insurance verification.

See what denials and coverage gaps cost you

Enter your volume and denial rate to estimate what your pediatric practice is losing.

Open the Revenue Calculator

Adolescent confidentiality and explanation-of-benefits risk

A teenager's visit can be exposed by a statement or an explanation of benefits (EOB) sent to a parent. Your billing process has to know which visits need a private channel before anything is mailed.

Under the HIPAA Privacy Rule, a parent is generally the child's personal representative, and the rule defers to state law on what a provider may tell a parent. Providers must honor reasonable requests for confidential communications under 45 CFR 164.522. A health plan must do so only when the person states that disclosure could endanger them.

The risk sits with the plan. The Society for Adolescent Health and Medicine and the AAP (2016) warned that EOBs and billing notices can reveal care for contraception, pregnancy, STIs, substance use or mental health. A 2012 Guttmacher review found about half of states required EOBs or assumed them, and Medicaid programs generally handled this better.

In practice, registration records an alternate contact, and billing holds statements for flagged visits until the right address is confirmed. We also ask each plan how to file a confidential communications request. Your counsel should confirm your state's rules; see our EOB explainer for how EOBs work.

In-house team, billing-only vendor or four-pillar partner?

Keep billing in-house with an experienced pediatric coder and a stable payer mix. Use a billing-only vendor if claims are your only gap. Choose a combined partner when problems start at coverage or the front desk.

Decision table: which billing model fits a pediatric practice?
JobIn-house teamBilling-only vendorFour-pillar partner (RCM Finder)
Coverage and newborn enrollment checksFront desk, between callsUsually left to the practiceVMA checks each visit and follows up on newborns
Vaccine counting and VFC rulesDepends on one experienced coderVendor coders, after the factComponent and program rules checked before submission
Modifier 25 and screening unitsEasy to miss under a full scheduleBilled if the note is clearDocumentation reviewed against payer rules
Medicaid plan rule sheetsStaff memoryVaries by vendorRule sheet per plan, held in the portal
Adolescent statement handlingManual flagsRarely includedFlag, hold and alternate contact in the workflow
Cost structureSalaries, benefits, turnoverVaries; ask how fees are setQuoted after a free practice audit

Whichever model you choose, track denials by reason and underpayments by payer every month. See our guide to claim scrubbing for the checks to expect.

How it works

We build our billing pipeline around how claims actually move through a practice: registration, charge entry, submission, payment and follow-up. For pediatrics, we add the vaccine, screening, program and newborn checks on this page.

  1. 1

    Free practice audit

    We compare recent claims, remittances and denials with your visit records.

  2. 2

    Business Associate Agreement and access

    We put a Business Associate Agreement in place before accessing patient data. Then our team works inside your existing EHR (for example PrognoCIS, eClinicalWorks or athenahealth) and our portal.

  3. 3

    Payer and program map

    We list each plan's rules: EPSDT indicator, VFC modifier, unit caps, modifier 25 policy and confidential-communication process.

  4. 4

    Pre-visit checks and billing go live

    VMAs check coverage and follow up on newborns. Claims are coded from the record, scrubbed, submitted and worked to payment.

  5. 5

    Weekly KPI review

    Each week we review denials by reason, A/R days, held newborn claims and underpayments, and adjust the rule sheets.

Talk to us about your pediatric practice

Tell us your payer mix, your EHR and your hardest denials. We will say honestly whether we fit.

Call +1 (302) 556-2288

Compliance: what to ask any pediatric billing company

Any vendor handling your claims is a business associate under HIPAA. Ask for the agreement and the access model before sharing patient data, including data on minors.

Per HHS, billing and claims processing done for a covered entity is business associate work. The agreement must limit uses of PHI, require Security Rule compliance and incident reporting. The business associate needs its own agreement with any subcontractor. The minimum necessary standard expects policies that name which staff roles may see which PHI. The Security Rule's technical safeguards list access control, audit controls, integrity, authentication and transmission security.

  1. Will you sign a Business Associate Agreement before you see patient data, and do your subcontractors sign one too?
  2. Who can open adolescent and sensitive-service accounts, and is it logged?
  3. Is access role-based, and do offshore staff follow my practice's time zone and rules?
  4. How do you hold statements for flagged visits?
  5. How do you track vaccine program rules for each state and plan?
  6. What do you report weekly, and who owns the numbers?

We use role-based access, audit logging and encrypted (HTTPS) connections, and we put a Business Associate Agreement in place before accessing patient data. See our HIPAA checklist for medical practices.

Who this is for, and who it is not for

We would rather tell you now than after you sign. Here is where we fit and where we do not.

A good fit if you are

  • Pediatric and multi-specialty practices with heavy Medicaid and CHIP volume
  • Practices giving many vaccines under VFC and private stock
  • Groups that see newborns before coverage is confirmed
  • Practices that run developmental and behavioral screenings at well visits
  • Billing companies serving several pediatric practices from one portal

Probably not a fit if you are

  • Hospital-employed pediatricians whose billing the hospital controls
  • Practices that want promised collection rates; we report measured KPIs instead
  • Practices that need a scheduling module or credentialing module in the portal today (scheduling is early access; credentialing is coming next)
  • Groups unwilling to share visit notes and screening documentation

Expert recommendations from our operations team

What we would do first if we were running your practice's revenue cycle tomorrow.

  1. 01

    Build a rule sheet for every Medicaid plan

    Indicator, modifier, unit caps and fees differ by plan. We write them down once and load them into the claim checks.

  2. 02

    Count vaccines at the component level

    We reconcile each administered vaccine with its components and counseling note before 90460 or 90461 goes out.

  3. 03

    Screen VFC eligibility at every visit

    The answer must be recorded each time, in the visit record.

  4. 04

    Document the separate problem on its own

    Modifier 25 stands on the note. We ask clinicians to record the sick problem and its plan apart from the preventive work.

  5. 05

    Chase newborn coverage from day one

    We track birth date, coverage source and application date, and hold claims until the baby's own ID is on file.

  6. 06

    Flag sensitive visits at registration

    An alternate contact and a statement hold cost little. A mailed EOB can cost a teenager's trust.

Frequently asked questions

What do pediatric billing services include?

They cover charge entry, coding, claim scrubbing, submission, payment posting, denial management and A/R follow-up. For pediatrics that also means counting vaccines by component, applying modifier 25 correctly, billing screening instruments, following state Medicaid and EPSDT rules and handling newborn enrollment. RCM Finder adds pre-visit coverage checks, patient marketing and a claims portal.

How do you bill 90460 and 90461?

Use 90460 for the first or only component of each vaccine and 90461 for each additional component, when a physician or other qualified professional counsels the patient or caregiver face to face. These codes apply through age 18. Without counseling, or for patients over 18, 90471-90474 apply. Some payers, such as Kentucky Medicaid for VFC children, do not pay 90461.

Do you bill VFC vaccines to the insurance company?

The vaccine product is supplied free to enrolled providers, so you do not charge for it. You may bill an administration fee, up to the regional maximum, and state rules decide the modifier and the payer. Oregon accepts SL and Kentucky requires it, for example. Record VFC eligibility screening at every visit. Check your state's current rules.

When is modifier 25 used at a well-child visit?

The AAP says modifier 25 goes on the office E/M code that covers a significant, separately documented problem, not on the preventive code. Minor concerns do not qualify. Payers vary, and many Medicaid programs do not recognize the modifier. Some commercial plans also require it on a preventive visit when a vaccine is given the same day.

How does newborn Medicaid coverage work for billing?

A child born to a Medicaid-eligible mother is generally deemed eligible from birth to the first birthday, and the mother's ID may be used at first. The state must issue the child a separate ID. Some states call the mother's ID a last resort that can cause denials. Hold claims if the baby's ID is missing.

How do you protect teen confidentiality on statements and EOBs?

We flag visits that need a private channel at registration, record an alternate contact and hold patient statements until the address is confirmed. We also ask each plan how to file a confidential communications request. The plan controls its own EOBs, and state minor-consent laws vary, so counsel should confirm your rules.

No cost, no commitment

Get your free practice audit

Tell us about your practice. A member of our operations team replies within one business day.

  • A review of your recent claims, denials and A/R aging
  • Where your front desk and prior authorizations slow payment
  • A prioritized fix list you keep, whether or not you hire us

Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.

Tell us about your practice

RCMFinder Master Intake Form
AA

About the author: Awais Afzal

Healthcare Operations & Data Analyst, RCM Finder

Awais has spent more than 16 years in healthcare digital marketing and clinical operations management. He builds data-driven revenue cycle blueprints for high-ticket medical practices and leads product development of the RCM Finder portal. More about our team.

How we write: every figure, code and rule on this page was checked against the primary source listed below and independently fact-checked before publishing. We re-review this page every six months. Last reviewed October 12, 2026; next review April 12, 2027.

Sources

  1. MACStats: Medicaid and CHIP Data Book (February 2026 edition) — MACPAC (2026)
  2. Exhibit 32: Child Enrollment in CHIP and Medicaid by State, FY 2024 — MACPAC (2026)
  3. Continuous eligibility for children in Medicaid and CHIP — Medicaid.gov (CMS) (undated; CAA 2023 s. 5112)
  4. Modifier 25 primer: use it, don't abuse it — American Academy of Pediatrics (2025 (updated Nov 11, 2025))
  5. Coding for vaccine administration — American Academy of Family Physicians (undated (fetched 2026))
  6. Coding IZ Admin: 90460 and 90461 — Maryland Department of Health (undated (fetched 2026))
  7. Coding preventive medicine visits and administration of vaccines on the same date of service — Blue Cross and Blue Shield of North Carolina (2022 (edit version scheduled Aug 24, 2022))
  8. Vaccines for Children (VFC) program: about — CDC (2026 (updated Aug 27, 2026))
  9. Vaccines for Children (VFC) program eligibility — CDC (2026 (updated Aug 27, 2026))
  10. 42 CFR 441.615: Administration fee requirements — eCFR (HHS/CMS) (current (fetched 2026))
  11. OAR 410-130-0255: Immunizations, Vaccines for Children, and Immune Globulins — Oregon Health Authority (Oregon Administrative Rules) (current (fee figures date from 2013-2014))
  12. Provider letter for VFC providers: billing change (Kentucky Medicaid) — Humana (2025 (effective Jan 1, 2025))
  13. CPT 99383, 99393, 99394 and 99460 code pages — AAPC (undated (secondary source))
  14. Early and Periodic Screening, Diagnostic and Treatment — Medicaid.gov (CMS) (undated)
  15. Periodicity schedule (AAP/Bright Futures) — American Academy of Pediatrics (2025 (updated Feb 6, 2025))
  16. Recommendations for Preventive Pediatric Health Care (periodicity schedule PDF) — American Academy of Pediatrics (2023 (April 2023))
  17. EPSDT provider guide (Ohio Medicaid) — Molina Healthcare of Ohio (undated (fetched 2026))
  18. Coding guidelines for screening tools in primary care (Healthy Kids) — Maryland Department of Health (Medicaid) (undated (reimbursement table 2017))
  19. Coding fact sheet for primary care pediatricians — Oklahoma Health Care Authority (refers readers to the AAP; author not named) (undated)
  20. CPT coding fact sheet: developmental screening, testing and emotional/behavioral assessment — AMA (hosted by Maine AAP) (2023)
  21. 42 CFR 435.117: Deemed newborn children — eCFR (HHS/CMS) (current (fetched 2026))
  22. 45 CFR 146.117: Special enrollment periods — eCFR (HHS) (current (fetched 2026))
  23. Newborns with Medicaid (Section 1.11) — Mississippi Division of Medicaid (undated)
  24. 42 U.S.C. 1396a: State plans for medical assistance — Cornell Legal Information Institute (current (fetched 2026))
  25. OBBBA Slashes Retroactive Coverage for Medicaid Beneficiaries — National Health Law Program (authors McKee and Perkins) (2025 (July 25, 2025))
  26. Select provisions and implementation dates: OBBBA summary — American Medical Association (2025)
  27. CMS Interoperability and Prior Authorization final rule (CMS-0057-F) fact sheet — CMS (2024)
  28. UnitedHealthcare cuts nearly two-thirds of pediatric prior auth requirements — Healthcare Finance News (2026 (July 23, 2026))
  29. Personal representatives and minors (HIPAA FAQ) — HHS Office for Civil Rights (current (fetched 2026))
  30. 45 CFR 164.522: Rights to request privacy protection — eCFR (HHS) (current (fetched 2026))
  31. Joint statement on privacy protections for young patients (EOBs) — Society for Adolescent Health and Medicine / American Academy of Pediatrics (2016 (Feb 19, 2016))
  32. Confidentiality for Individuals Insured as Dependents: A Review of State Laws and Policies — Guttmacher Institute (2012 (law current to Jan 1, 2012))
  33. Business Associates (HIPAA guidance) — HHS (2026 (reviewed July 30, 2026))
  34. Minimum necessary requirement — HHS (current (fetched 2026))
  35. 45 CFR 164.312: Technical safeguards — eCFR (HHS) (current (fetched 2026))