Medical Billing & Revenue Cycle Management FAQs
100 straight answers about medical billing, denials, accounts receivable, coding, pricing and security for US healthcare practices. No sales language, no invented statistics — where a figure genuinely varies by payer or state, we say so rather than pick one.
Choosing an RCM partner
What to ask, what to compare, and how to tell a revenue cycle partner from a claim processor.
What does a medical billing company actually do day to day? #
A medical billing company enters charges, checks claims against payer rules, submits them, posts payments, works rejections and denials, and follows up on unpaid claims. The day-to-day reality is mostly payer follow-up and exception handling — the submission itself is the easy part. See our medical billing service for the full workflow.
How do I know if my practice actually needs outsourced billing? #
Three signals usually settle it: your accounts receivable over 90 days is growing, denials are worked only when someone has spare time, or billing depends on one person with no cover. Any one of those means the work is being deferred rather than done. If none apply and you can explain your own numbers, in-house is likely fine.
What is the difference between a billing company and an RCM company? #
A billing company processes claims, while an RCM company takes responsibility for the whole cycle around them — eligibility and authorization before the visit, coding accuracy, denial root causes, AR strategy and the reporting over all of it. The practical difference is that an RCM partner tells you why claims are failing upstream, not just that they failed.
How long does it take to see results after switching? #
Expect at least one full claim cycle before anything meaningful appears in the numbers, which is usually six to ten weeks. Denials arrive weeks after the date of service, so a change made in month one shows up in month three. Anyone promising improvement in the first fortnight is describing activity, not results.
Should we pick a billing company that specializes in our specialty? #
Specialty experience matters more than most practices assume when choosing a billing company. The rules that stall a physical therapy claim — timed units, plan-of-care certification — have nothing in common with the rules that stall behavioral health claims. A generalist can process your claims; a specialist knows where they will fail before they do.
What questions reveal whether a billing company is any good? #
Ask who specifically will work your account and how many others they hold, what happens when a metric moves the wrong way, and what they do when the cause of a denial is inside your practice. Vague answers to those three are more informative than any reference.
Is a bigger billing company safer than a small one? #
A bigger billing company is not inherently safer than a small one. Scale brings process and continuity but often means you are a small account in a shared queue. What matters is whether a named person knows your payers and providers. Ask for the name, and ask what else that person is responsible for.
Can we outsource billing without losing control of our practice? #
Yes, you can outsource billing without losing control, provided the boundaries are written down. Your practice keeps its payer contracts, its data, its practice management system and its clinical decisions. Access is granted by you and can be withdrawn. If a vendor requires you to move to their platform to work with them, that is a lock-in decision, not a billing decision.
What should be in a medical billing contract? #
At minimum: exactly what is in and out of scope, the fee basis and every additional charge, the metrics performance will be judged on, who owns the data, the notice period, and what happens to claims in flight if the relationship ends. The exit terms are worth more attention than the onboarding terms.
How do we compare two billing proposals fairly? #
Compare scope before price, because two proposals at the same fee can differ by half the revenue cycle. Two proposals at the same fee can differ by half the revenue cycle — one may exclude denials, appeals, aged AR or patient billing entirely. Write out every stage of your cycle and mark each as included, excluded or extra for both vendors, then compare.
Pricing, fees and contracts
How medical billing is priced, what the models reward, and the costs that appear later.
How much does medical billing cost? #
Medical billing is usually priced as a percentage of collections, a flat monthly fee, or a per-claim rate. Percentages vary widely by specialty, claim volume and scope, so any figure quoted without reference to your data is a placeholder. What changes the number most is scope — whether denials, appeals and aged AR are included.
Is percentage-based billing better than a flat fee? #
Percentage pricing aligns the vendor with your collections but subtly rewards easy money, so ask specifically how small balances and difficult appeals are handled. A flat fee is predictable and easy to budget but decouples their income from your results. Neither is wrong; the risk sits in different places.
Do billing companies charge for working our old AR? #
Frequently yes, and often at a different rate from ongoing billing. Aged receivables take disproportionate effort per dollar recovered, so many vendors scope it as a separate project. The important thing is to establish it explicitly — inherited AR is the most common ambiguity in billing agreements. See AR cleanup and recovery.
What contract length is normal for medical billing? #
Twelve months is common, with a notice period of 30 to 90 days. Longer initial terms are not automatically a red flag given the cost of onboarding, but they should be matched by a fair exit route. Be more suspicious of a long notice period than a long term.
Can we start with a trial or a smaller engagement? #
Most billing companies will start with a smaller engagement, and it is a sensible way to begin. Denial management or a scoped AR cleanup project are common starting points because they are self-contained, measurable, and let both sides see how the working relationship actually feels before the whole cycle moves.
Who pays for the clearinghouse and practice management software? #
Usually the practice, because those are your systems and your contracts. Some vendors include clearinghouse fees; some rebill them. Ask which, because a low headline rate with rebilled transaction costs can end up higher than a slightly higher all-inclusive rate.
What happens to our fees if our claim volume drops? #
Under percentage pricing your cost falls with collections automatically. Under flat-fee pricing it does not, unless the agreement has a volume band. If your practice has seasonal swings, ask how the fee behaves in a quiet quarter before you sign.
Is outsourced billing cheaper than hiring in-house? #
Not necessarily, and the honest case for outsourcing is usually capability and continuity rather than price. A fair in-house comparison has to include salary, payroll taxes, benefits, training, software, management time, holiday cover and the cost of work not done during a vacancy — that last item is the one most often left out.
What does it cost to switch billing companies? #
The direct cost is usually low; the real cost is the transition period, when claims can stall between two teams. Minimize it by agreeing in writing who works claims submitted before the changeover date, and by keeping the outgoing vendor engaged until open items are resolved.
Medical billing basics
The vocabulary and mechanics behind the numbers on your reports.
What is a clean claim? #
A clean claim is one that passes payer edits and is adjudicated on first submission without needing correction, additional information or resubmission. The clean claim rate is a useful health check because it measures the front end of your cycle — registration, eligibility and coding — rather than the persistence of your follow-up.
What is the difference between billing and coding? #
Coding translates the clinical documentation into standard codes describing what was done and why. Billing takes those codes and turns them into a claim, submits it, and pursues payment. A coding error causes a denial; a billing error causes a rejection or a delay. See medical coding.
What is a superbill? #
A superbill is an itemized record of the services provided at a visit, with the associated codes, given to a patient or used internally to create a claim. Patients with out-of-network coverage often submit one to their insurer themselves to claim reimbursement.
What does adjudication mean? #
Adjudication is the payer's process of reviewing a submitted claim and deciding what to pay, reduce or refuse. A claim that has been adjudicated has received a decision; one stopped before adjudication was rejected, and never reached that stage at all.
What is an EOB and how is it different from an ERA? #
An explanation of benefits is the human-readable statement of how a claim was processed. An electronic remittance advice is the machine-readable equivalent used to post payments automatically. The information overlaps, but the ERA carries the adjustment and remark codes that make automated posting and denial routing possible.
What are adjustment and remark codes? #
They are the standard codes on a remittance explaining why a payment differs from the amount billed. Adjustment codes give the reason for a reduction or refusal; remark codes add detail. Preserving them at posting is what allows denials to be categorized by cause rather than lumped into one write-off.
What is the difference between gross and net collection rate? #
Gross collection rate compares payments to total charges, which mostly reflects how your fee schedule is set. Net collection rate compares payments to what you were actually entitled to collect after contractual adjustments — that is the number that tells you how well the revenue cycle is performing.
What is a fee schedule? #
A fee schedule is the list of amounts your practice charges for each service, and separately, the contracted amounts each payer has agreed to pay. Comparing the two is how underpayments are detected. Without current contracted rates on file, a short payment is indistinguishable from a correct one.
What does write-off mean in medical billing? #
A write-off removes a balance from accounts receivable. Contractual write-offs are the expected difference between your charge and the contracted rate. Adjustment write-offs are choices — a claim deemed uncollectable, a small balance not worth pursuing. The second kind should always carry a documented reason.
What is a credit balance and why does it matter? #
A credit balance is money on the account that exceeds what was owed, usually from an overpayment or a duplicate payment. It matters because it is an obligation, not a windfall, and unresolved credit balances distort your accounts receivable while creating a liability that does not disappear by being ignored.
Claims, rejections and denials
Why claims fail, what the difference costs you, and what to do about each.
Why do claims get denied even when the coding is correct? #
Correct coding is only one of several conditions. A claim can be coded perfectly and still be refused for inactive coverage, a missing authorization, a diagnosis that does not establish medical necessity, coordination of benefits, or a filing deadline. This is why grouping denials by root cause matters more than the headline rate. See denial management.
What is a denial rate and how is it calculated? #
Denial rate is the share of submitted claims a payer refuses, usually measured by claim count or by billed value over a period. Both are useful and they can tell different stories — a low count with a high value means your largest claims are the ones failing, which is the more urgent problem.
What are the most common causes of claim denials? #
Across most practices the recurring causes are eligibility and coverage problems, missing or expired prior authorization, coding and modifier errors, insufficient documentation of medical necessity, coordination of benefits, and timely filing. The proportions differ by specialty, which is why your own categorized data beats any published list.
Can a denied claim be resubmitted? #
A denied claim can sometimes be resubmitted, and choosing the right route matters. If the claim contained an error, a corrected claim is usually the right route. If the payer made a determination you disagree with, that needs a formal appeal — and resubmitting instead can waste the appeal window without ever triggering a review.
How long do we have to appeal a denied claim? #
Appeal windows vary by payer and plan and are typically counted from the remittance date rather than the date of service. They are frequently shorter than people assume. Establishing which of your denials are still in time is usually the first step in any backlog project.
What is a soft denial versus a hard denial? #
A soft denial can potentially be resolved and paid — missing information, a correctable error, a claim pending review. A hard denial is a final refusal that will not be paid without a successful appeal or a change in circumstances. Sorting them is what stops effort going into unrecoverable work.
Why do rejections not appear in our denial reports? #
Because a rejection was stopped before adjudication, usually at the clearinghouse, so the payer never made a decision to report. That is exactly what makes rejections dangerous: a practice can have a respectable denial rate and a serious rejection problem simultaneously. See claims management.
What happens if we miss the timely filing deadline? #
The claim is generally lost, and most payers will not consider it regardless of the underlying merit. A small number allow appeals where you can evidence timely submission that failed for a technical reason — which is another argument for keeping a documented submission history.
Should we appeal every denial? #
No — appealing every denial with equal effort costs more than it recovers. Where the recoverable balance is smaller than the cost of the work, or the denial is simply correct, the right decision is to close it with a documented reason and fix the cause. Working every denial with equal intensity is its own form of waste.
How do we stop the same denial happening every month? #
Route the cause to the stage that produced it rather than the stage that found it. An eligibility denial is a front-desk process issue; a modifier denial is a coding issue; a medical necessity denial is usually a documentation issue. Fixing it where it was discovered guarantees it returns.
Accounts receivable
Reading your AR, working it properly, and knowing what is genuinely collectable.
What does AR over 90 days actually tell us? #
It tells you how much of your money has stopped moving. New claims collect normally in most practices, so a growing balance beyond 90 days usually means older claims are not being worked rather than that payers have slowed down. It is the single most useful summary figure on an aging report.
Why does our AR keep growing even though collections look fine? #
Because collections measure what arrived, not what stalled. A practice can collect steadily from clean claims while a parallel population of denied, rejected and disputed claims quietly ages. The two behave independently, which is why the aging report matters more than the collections total.
How often should accounts receivable be worked? #
On a defined cadence per segment rather than when someone has time. High-value recent claims justify tighter intervals than small aged balances. The specific intervals matter less than the fact that they exist and are followed — ad hoc chasing is what produces backlogs. See AR follow-up.
What is a touchpoint history and why does it matter? #
It is the record of every contact on a claim: date, who was spoken to, what the payer said, what was agreed and when it will be checked again. It matters because without it every call restarts the conversation, and because it is the evidence that makes escalation credible.
When should we escalate a claim instead of calling again? #
When correct follow-up has been performed and the documented history shows repeated payer commitments that were not honoured. At that point a fourth status call produces the same answer. Escalation through the payer's own channels, supported by the history, is the step that changes the outcome.
Should insurance AR and patient AR be reported separately? #
Yes, insurance AR and patient AR should always be reported separately. They are different problems with different solutions — payer follow-up versus patient communication and collection — and averaging them hides both. With high-deductible plans now common, a practice can have healthy insurance AR and a serious patient balance problem at the same time.
What percentage of aged AR is usually recoverable? #
It depends entirely on why the claims aged and whether filing and appeal windows have passed, so a general percentage would be a guess. The useful exercise is triage: split the balance into collectable, correctable and closeable, and work the first two.
When should a balance be written off? #
When it is genuinely unrecoverable — past filing or appeal deadlines, correctly denied, or too small to justify the work — and always with a documented reason. Carrying dead balances inflates AR, distorts days in AR, and makes every aging report harder to read.
Does a high AR balance always mean something is wrong? #
No, a high AR balance does not by itself mean something is wrong. A practice that has grown will carry more AR simply because it bills more. The question is whether AR has grown faster than charges, and whether the older buckets are growing as a share of the total. Direction matters more than size.
What is the fastest way to reduce days in AR? #
Usually submitting faster and working rejections daily, because both act on the front of the pipeline where every day compounds. Cleaning up dead balances also reduces the figure, but that is bookkeeping honesty rather than performance improvement — worth doing, worth not confusing with progress.
Medical coding
Accuracy in both directions — claims that are not denied, and work that is not left unbilled.
What is upcoding and how do we avoid it? #
Upcoding is billing a higher-level service than the documentation supports. It is avoided by coding from the note rather than from expectation, querying the provider when documentation is unclear, and reviewing level distribution across providers so outliers surface internally before a payer finds them.
Is under-coding a real risk? #
Yes, and it is more common than most practices realize because it is invisible. Under-coding produces no denials and no audit letters, so nothing signals it. Providers worried about audit exposure often bill below what their documentation supports, and across a year that costs more than the denials do.
What are NCCI edits? #
They are national code-pair edits maintained by CMS that define which procedure codes may be billed together and how many units are plausible for one date of service. Claims that conflict with them are typically reduced or refused automatically, without a person reviewing the clinical circumstances.
When is a modifier appropriate? #
When the payer's policy specifically calls for it to describe a circumstance the base code does not — a distinct service, a bilateral procedure, an unusual situation. Modifiers applied by habit rather than by current policy are one of the most reliable sources of denials and of audit interest.
How do coding errors affect reimbursement beyond denials? #
They affect it through reduction as well as refusal. A claim can be paid at a lower level than the work justified, which never appears in denial reporting and is therefore rarely investigated. Comparing payments to expected contracted rates is what surfaces it.
Who is responsible if a claim is coded incorrectly? #
Legal responsibility for what is submitted under a provider's identifier remains with the practice, regardless of who assigned the code. That is why a coding partner should document its reasoning and raise queries rather than making assumptions — you need to be able to explain any code if asked.
How often do medical codes change? #
Code sets are revised annually, and payer policies governing how those codes may be used change more often and with less notice. A code valid in December can be rejected in January. Keeping current is ongoing work rather than an annual task.
What is a coding audit and should we have one? #
A coding audit reviews a sample of claims against their documentation to establish whether the codes were supportable. It is worth doing when denial patterns suggest a systematic issue, when providers code inconsistently, or before a payer does it for you.
Can documentation templates cause coding problems? #
Yes, documentation templates can cause coding problems when they strip out the specifics of an encounter. Templates that produce near-identical notes make it difficult to evidence that each encounter required the service billed, and repetitive documentation is a pattern reviewers look for. Templates are fine; templates that remove the specifics of the encounter are not.
Do we need a certified coder on staff? #
Not necessarily, but the function has to exist somewhere with genuine current knowledge. Whether that is an employee, a shared resource or an outsourced review layer matters less than whether someone is accountable for coding accuracy and measuring it.
Eligibility, authorization and the front desk
The cheapest place in the revenue cycle to prevent a denial.
Why does eligibility verification matter so much? #
Because a coverage problem caught before the visit is a phone call, and the same problem caught after adjudication is a denial, an appeal, a delay and an awkward conversation with a patient. Eligibility is the cheapest point in the entire cycle to prevent revenue loss. See eligibility verification.
What is a carve-out and why do claims go to the wrong payer? #
A carve-out is where a plan routes a category of care — behavioral health most commonly — to a separate carrier from the medical benefit. Claims sent to the medical plan are refused, not for any clinical reason, but because that payer was never responsible. Identifying it at verification prevents the whole problem.
What is the difference between eligibility and benefits verification? #
Eligibility confirms the patient has active coverage on the date of service. Benefits verification establishes what that coverage actually pays for — deductible position, co-insurance, visit limits, authorization requirements. Confirming eligibility alone catches inactive plans and misses almost everything else.
What is prior authorization and who is responsible for it? #
Prior authorization is a payer's advance approval for a service, without which the claim is typically refused. Responsibility sits with the practice, and the practical failure is rarely forgetting it entirely — it is not tracking how many authorized units remain as treatment progresses.
Can a service be authorized and still be denied? #
Yes, an authorized service can still be denied for another reason entirely. An authorization confirms the payer approved the service; it is not a guarantee of payment. The claim can still fail on eligibility, coding, documentation or filing. Payers generally state this explicitly in their own authorization language.
How far in advance should we verify coverage? #
Far enough ahead to act on what you find, which usually means several days before the appointment, with a re-check closer to the date for plans that change frequently. A check performed at the desk on the day catches inactive coverage and little else in time to matter.
How do we handle same-day and walk-in appointments? #
With an agreed same-day process rather than by pretending every appointment can be verified days ahead. The realistic aim is that scheduled visits are verified in advance and same-day visits get a rapid coverage check, with the limitation understood rather than hidden.
What front-desk errors cause the most denials? #
Demographic and subscriber mismatches — a transposed member number, a name that differs from the payer's record, the wrong subscriber relationship for a dependent. Each is trivial in isolation and enormous in aggregate, and they recur indefinitely unless someone feeds the consequence back.
Should we collect patient responsibility at the time of service? #
Collecting at the point of care is generally more effective than billing later, provided the estimate is accurate. That is the condition most practices miss: an estimate based on a guess creates refunds, disputes and complaints, which costs more than it collected.
How do we reduce patient complaints about surprise bills? #
Mostly by getting the benefits position right before the visit and explaining it clearly at check-in. A large share of billing complaints are not billing errors at all — they are expectations set incorrectly at the front desk, then discovered weeks later on a statement.
Payments, posting and patient balances
What arrives, whether it is correct, and what to do about the balance left behind.
How do we know if we are being underpaid? #
By comparing every payment to the contracted rate that should have applied. Without that comparison an underpayment posts identically to a correct payment and is invisible. This is the single most common silent revenue leak, and it compounds because it repeats. See payment posting.
What causes payments not to reconcile to our bank deposits? #
Usually timing differences, partially posted remittances, payments posted to the wrong account, or a remittance that never arrived. The reason reconciliation matters is that it distinguishes those from money that genuinely never came — which nothing else will.
Should payments be posted automatically or manually? #
Electronic remittances should be posted automatically wherever possible, but with adjustment and remark codes preserved at line level rather than collapsed. Automation is only a gain if the reasons survive it; otherwise it buries the denials it should be routing for action.
What is patient responsibility and how is it calculated? #
It is the portion of the allowed amount the plan leaves with the patient — deductible, co-payment and co-insurance. It is calculated from the allowed amount, not the billed charge, which is why estimates based on your fee schedule are usually wrong and generate disputes.
How should patient balances be collected? #
With clear statements, a predictable schedule, an easy payment route and defined escalation limits agreed in advance. Patient collections are a communication problem more than a persistence problem, and aggressive escalation reliably costs more in relationships than it recovers.
What should we do about very small patient balances? #
Decide a threshold in advance and apply it consistently. Chasing balances that cost more to pursue than they are worth is a loss disguised as diligence. The important part is that the threshold is a deliberate policy rather than an ad hoc judgment.
How do refunds and overpayments work? #
An overpayment creates a credit balance that must be resolved rather than absorbed — refunded to the payer or the patient as appropriate. Whether an overpayment can simply be kept is a question with legal and contractual dimensions, so take your own advice on the applicable rules.
What is a takeback or recoupment? #
It is a payer recovering money it previously paid, usually by offsetting against future payments after a post-payment review. It matters operationally because recoupments can appear on remittances as unexplained reductions unless whoever posts them knows to look for and record them.
How do high-deductible plans change our billing? #
They move a much larger share of revenue from a payer that pays predictably to patients who pay unpredictably. Practically that means accurate estimates at check-in and a working patient collection process become as important as payer follow-up, not an afterthought to it.
Should we offer payment plans? #
Payment plans usually improve collection on larger balances compared with a single demand, provided they have clear terms and are actually followed up. The failure mode is not the plan itself but the absence of any process for plans that stop being paid.
Specialty billing questions
Where different specialties fail differently, and what that means for your workflow.
Why do behavioral health claims fail more often than medical claims? #
Because behavioral health carries more conditions per claim: time-based session codes, authorizations measured in units, frequency limits, telehealth rules that vary by payer, and plans that route the benefit to a separate carrier. Each is an additional way for a clinically correct session to be refused. See behavioral health billing.
What makes physical therapy billing different? #
Physical therapy billing is defined by arithmetic that most other specialties never deal with. Units are calculated from documented treatment time, timed and untimed codes appear in the same visit, plan-of-care certification has to be current, and benefit limits count down visit by visit. One wrong unit rule applied consistently becomes a clinic-wide denial pattern. See physical therapy billing.
Why is chiropractic billing scrutinised so closely? #
Because payers draw a firm line between active treatment and maintenance care, and the distinction rests entirely on documentation showing measurable progress toward a goal. Repetitive daily notes are the pattern reviewers look for, even where the care itself is appropriate. See chiropractic billing.
What is the biggest billing risk in primary care? #
Inconsistency between providers on evaluation and management levels, and mishandling visits that are both preventive and problem-focused. The second produces patient balance disputes; the first is invisible until someone reports level distribution by provider. See primary care billing.
How does telehealth billing differ from in-person billing? #
Mainly in place of service codes, modifiers and payer-specific policy, all of which have changed repeatedly and still vary between payers and states. The practical risk is applying one blanket setting across all payers, which turns a single misunderstanding into a whole batch of denials.
Do multi-specialty practices need different billing workflows? #
Usually yes, because the rules that cause denials differ by specialty even inside one organization. The common failure is applying one generic process across all service lines, which works acceptably for the largest specialty and badly for the others.
How does billing change when we add a new provider? #
Payer enrollment becomes the immediate constraint when you add a new provider. A new provider treating patients before enrollment is complete generates claims that cannot be paid under their identifier, and depending on payer rules those may not be recoverable retroactively. Start enrollment well before the start date.
What changes when we open a second location? #
Place of service, payer enrollment for the new site, and the risk of the two locations billing inconsistently. That last one is the quiet problem: when two sites do things differently, every denial pattern becomes harder to diagnose because there is no baseline.
How are workers' compensation claims different? #
They generally run on their own fee schedules, forms, authorization expectations and timelines, and they do not behave like commercial claims. Practices with meaningful volume are effectively operating a second billing process, and blending it into ordinary AR reporting makes both harder to read.
Should personal injury and auto claims be reported separately? #
Yes, personal injury and auto claims should be reported separately from standard AR. Those balances often resolve on a completely different timescale — sometimes at settlement, months or years later — and mixing them into standard accounts receivable distorts days in AR and aging so badly that neither figure means anything.
Security, compliance and data
How sensitive information should be handled, and what to ask any partner about it.
What should we ask a billing company about data security? #
Ask how access is granted and removed, whether every person works under individually named credentials, what confidentiality obligations staff carry, what training they receive, and what happens to access when someone leaves. Then ask for any certification in writing rather than accepting a badge on a website. See our security approach.
Is a business associate agreement required? #
A vendor handling protected health information on a covered entity's behalf is generally expected to be under a written agreement governing that handling. The specifics of what your practice needs are a question for your compliance adviser or counsel, and any serious partner will expect to sign one.
Who owns our patient and billing data? #
Your practice owns its patient and billing data, not the billing company. A billing partner works under access you grant and can withdraw, and your data should be returnable in a usable format if the relationship ends. If a vendor is vague about data return, treat that as a material term rather than an administrative detail.
Should we send patient information by email? #
No, patient information should not be sent by email. Email is not an appropriate channel for protected health information, which is why enquiry forms on this site ask you not to include it. Where data genuinely needs to move as part of an assessment or onboarding, agree a secure route first.
What happens to our data if we leave a billing company? #
That should be defined in the contract before you start: what is returned, in what format, within what timeframe, and what the vendor retains and for how long. Establishing it at the exit is far harder than establishing it at the outset.
Does using an offshore billing team create a compliance issue? #
It creates obligations that have to be addressed explicitly — contractual terms, access controls, staff confidentiality and where data is processed. The relevant question is not the location but whether the controls are documented and evidenced. Ask specifically, and get the answer in writing.
What is the minimum necessary principle? #
It is the expectation that access to protected health information is limited to what a role genuinely requires. Practically, it means a billing team should not have blanket access to everything, and access should be scoped by role and reviewed rather than granted once and forgotten.
How should billing staff access be managed when someone leaves? #
Removal should be a defined step in a documented process, not a task someone remembers. Access that outlives the reason for it is one of the most common findings in any security review, and it is entirely preventable with a checklist.
Do we need to worry about state privacy laws as well as federal rules? #
Several states impose obligations beyond federal requirements, and they differ. Which apply to your practice depends on where you operate and whose data you hold, so it is a question for your own adviser rather than something a billing partner should answer for you.
What should we do if we suspect a data incident? #
Follow your practice's incident response process and involve your compliance adviser or counsel immediately, before making external statements. Any billing partner should be contractually required to notify you promptly and cooperate fully — worth confirming that obligation exists before you need it.
Not answered here? Ask us directly. We would rather tell you something useful than have you guess — including when the answer is that we are not the right fit.
Get a Free Assessment Book a Consultation