HIPAA for billing and practice management vendors

Does HIPAA apply to a billing or practice management company, and what does it require?

Yes, in most cases. A billing, revenue cycle or practice management company that creates, receives, maintains or transmits protected health information for a covered entity is a business associate under 45 CFR 160.103, and the regulation names billing and practice management among the regulated functions. That status makes the company directly bound by the Security Rule for electronic protected health information, whatever the contract says. The answer depends on the services you perform, which data you touch and where it is hosted. A company that only sees de-identified data or never holds PHI may fall outside the definition, so confirm the data flows for each client and product line before assuming either way.

There is no HIPAA certificate for this obligation. HHS does not recognize private certifications, and no Security Rule standard requires an entity to certify compliance. Your organization owns its controls, including the risk analysis, policies, access rules and audit logging that the Security Rule requires. A partner such as DeployOpen can prepare systems, configurations and evidence for a review, but only an independent assessor or auditor issues a report, and that report describes what was tested, not a government approval. Ask any consultant to show you the evidence they will produce and the boundaries of their work in writing before the engagement begins.

Start with a written inventory of every system that holds client PHI, including claims platforms, clearinghouse connections, file transfer servers, backups and any hosted environment, then decide which ones your own risk analysis must cover. Each system's configuration changes your risk picture, so the hosting model is part of the scope question, not an afterthought. Confirm with each covered entity which contract terms and breach duties apply to you, because they set the clock for notifying clients of a breach of unsecured PHI. The Security Rule and its documentation requirements apply to you directly regardless of what your clients ask for.

What a HIPAA Security Rule readiness engagement costs and who is paid

This table separates the cost components of a Security Rule readiness effort by who is paid for each one, whether the cost is one-time or recurring, and what drives it up. Use it to build a quote request that compares like with like, since no HIPAA certification exists to buy. No fees or durations are stated because none were supplied for this topic, so each row names what to ask for.

Cost component	Who is paid	One-time or recurring	What drives the cost
Internal staff time for the risk analysis and policy work	Your own workforce (salary and time, not an outside invoice)	Both: initial effort, then periodic updates	Number of billing platforms, clearinghouse connections and locations holding ePHI
Risk analysis and risk management plan	Outside assessor or consultant, or internal staff using the free HHS tool	One-time, then recurring updates	Count of systems, subcontractors and data flows; ask whether the quote covers the required annual-style updates
Implementation partner for hosted systems, logging and evidence	Implementation firm, such as DeployOpen on a fixed written scope	One-time build, plus optional retainer	Number of practice management or billing applications, hosting model and audit log retention design
Security tooling and licenses	Software vendors or open-source maintenance by your team or a partner	Mostly recurring (subscriptions, hosting, support)	User count, log volume, encryption and backup tooling chosen
Cloud or hosting charges under a business associate agreement	Cloud provider or hosting company	Recurring	Storage volume, region, backup frequency and whether the provider signs the required terms
Independent third-party assessment, if a customer requests one	Independent assessor chosen by you	Per engagement, repeated when the customer asks	Scope of systems tested and whether the assessor needs remediation evidence first
Breach response and client notice readiness	Counsel, forensic firm or internal staff on an incident	One-time plan, cost arises only on an event	Time to detect, number of individuals affected and 60-day client notice workload

What makes a billing vendor's Security Rule work more expensive or slower

A billing or practice management vendor's Security Rule effort grows with the number of systems holding ePHI, the number of covered entity clients and their contract demands, how the platform is hosted, who else touches the data, how files move, and how much evidence already exists. Each factor below is a place to cut scope, standardize, or document early.

Scope of ePHI systems

Every application, database, reporting tool, backup and staging copy that stores or processes claims data falls inside the risk analysis. Vendors often find test environments, exported spreadsheets and old claim archives during scoping. Inventory where ePHI is created, stored and transmitted before you price or schedule the work, and retire data you no longer need so fewer systems carry the Security Rule burden.

Covered entity clients and contracts

Each covered entity client may bring its own business associate agreement, security questionnaire, audit right and breach reporting expectation. Ten clients with ten different templates create ten sets of commitments to track. Count your clients and their contract terms early, map the common requirements, and standardize one control set that your agreements can point to.

Hosting model

A billing platform hosted in a vendor's own data center, a single cloud account, or several accounts across regions each needs a different risk analysis and configuration review. OCR's cloud guidance notes that the cloud configuration affects the risk analysis of every party. Confirm which provider signs a business associate agreement, which shared responsibilities you own, and whether a self-hosted design keeps the scope narrower.

Subcontractors and clearinghouses

Clearinghouses, print and mail houses, collection agencies, offshore coders and cloud storage providers can each receive PHI from you. Each one that creates, receives, maintains or transmits PHI must sign a written subcontractor agreement with you, and your own risk analysis must cover how their access is controlled. Keep a current register of subcontractors with their agreements and data flows, and remove vendors that do not need PHI.

Legacy file transfers

Batch files sent by FTP, shared drives and emailed remittance files are a common source of exposure in enforcement cases. Legacy transfers often survive because a clearinghouse or payer has never asked to change them. Inventory every file transfer path, replace unencrypted methods with managed encrypted transfer, and set a dated plan for each remaining legacy channel so the gap is documented.

Evidence maturity

A vendor that already keeps current policies, a dated risk analysis, reviewed access reports and tested incident procedures spends far less time answering client audits. Vendors starting from nothing often must reconstruct logs and decisions after the fact. Begin by collecting the records the Security Rule requires you to keep, including the review of information system activity, and store them in one place where a client or assessor can see them.

How a billing vendor gets ready for a covered entity review

This sequence takes a billing, revenue cycle or practice management company from an unclear picture of its ePHI to a documented, tested set of safeguards and an evidence file a covered entity can review. Each phase produces an artifact that the next phase depends on.

Scope systems and map data flows
Start by listing every system that creates, receives, maintains or transmits PHI for covered entities: clearinghouse links, claims platforms, practice management databases, file transfer servers, email, endpoints, backups and any hosting or cloud accounts. Map how each data set enters, moves between systems, and leaves, including exports to clients and to your own subcontractors. The output is a current inventory with an owner for each system and a data flow diagram that the risk analysis can use. Confirm the inventory with the people who run the systems, since shadow exports and old file servers are the most common gaps.
Perform the enterprise-wide risk analysis
As a business associate, you must run your own risk analysis rather than rely on the covered entity's. Identify the threats and vulnerabilities to each ePHI system, rate the likelihood and impact, and record the current security measures that reduce them. HHS offers a free risk assessment tool that can structure the work. The output is a written analysis covering every system in the inventory, signed off by management, with the date and the people who did it. OCR enforcement cases against billing and practice management vendors have cited analyses that were missing or not accurate and thorough, so the document should show the method and the data behind each rating.
Build the risk management plan
Turn each risk rated as unacceptable into a dated action with an owner, such as closing an internet-facing file transfer service, enforcing multi-factor authentication on remote access, or restricting service accounts. Decide which risks you accept and record the reason. Where a change depends on a vendor or a cloud configuration, record that dependency, because OCR guidance notes that the cloud configuration affects the risk analysis of every party. The output is a risk management plan that links each finding to a control change and to evidence that the change was made, with progress reviewed by the security official.
Establish activity review and incident detection
Configure audit logging on ePHI systems, define which records are reviewed (access reports, authentication failures, privileged activity, data exports and security incident tickets), and assign who reviews them and how often. The required activity review specification in the Security Rule exists because intrusions in OCR cases went unnoticed for months. Test the process by checking that a known test event appears in the logs and reaches the reviewer. The output is a log retention and review procedure, a log source list, and a dated record of reviews showing findings and follow-up.
Write policies, procedures and documentation
Write the policies and procedures that describe how the controls from the risk management plan actually operate, including access provisioning, incident response, contingency planning, backup and restore, workforce training, device and media disposal, and encryption. Keep each document current, assign an owner, and retain the required documentation for six years, which is the period the Security Rule's documentation standard sets. The output is a version-controlled policy set with approval dates and a change log, and a cross-reference from each Security Rule requirement to the document that covers it.
Put subcontractor agreements in place
List every vendor that creates, receives, maintains or transmits PHI on your behalf, such as clearinghouses, offshore coders, cloud or hosting providers, and transcription services, and confirm each one is a subcontractor business associate. Execute written business associate agreements with each before PHI flows to them, and check that the terms match the Security Rule obligations you accepted from your covered entities. One OCR resolution agreement cited a business associate for failing to enter an agreement with a subcontractor. The output is a register of subcontractors with the agreement date, the scope of PHI and the contact responsible for each relationship.
Package evidence for the covered entity review
Assemble a review pack that a covered entity's security or compliance team can test: the system inventory, the current risk analysis and risk management plan, a sample of activity review records, the policy index, training records, the subcontractor register, backup restore test results, and the breach notification procedure that meets the 60-day outer limit for notifying the covered entity. Check that each item is dated, current and matches what the systems actually do. The output is a single indexed package, with a named contact who can answer follow-up questions. Ask the covered entity which format and reporting cycle it expects before you build the pack.

What OCR cases show about failures at billing and practice management vendors

Three OCR resolution agreements with billing and practice management business associates point to the same weak spots: no accurate risk analysis, no regular review of system activity, and data left exposed on servers that were reachable from the internet. Comstar, a business associate providing billing, collection and ePCR hosting for ambulance services, paid $75,000 in a 2025 resolution agreement after a March 2022 ransomware attack affecting 585,621 individuals. The company detected the attack a week later only when its IT vendor received support tickets. OCR cited a failure to conduct an accurate and thorough risk analysis. For a billing vendor, the practical gap is that detection depended on a third party noticing symptoms, not on the company's own monitoring.

Doctors' Management Services, a practice management business associate, agreed to pay $100,000 in 2023 after GandCrab ransomware affected about 206,695 individuals. Intruders entered in April 2017 but were not detected until December 2018, roughly twenty months later. OCR cited a missing risk analysis, no information system activity review and missing policies. The activity review is the control that would have surfaced the intrusion earlier: the required procedure to regularly review audit logs, access reports and security incident tracking reports under 45 CFR 164.308(a)(1)(ii)(D). Vendors should confirm who reviews these records, how often, and what the review would have flagged.

MedEvolve, a business associate providing practice management and revenue cycle software, paid $350,000 in 2023 after an FTP server holding PHI of 230,572 individuals at two covered entities was accessible on the Internet. OCR also cited a failure to enter a business associate agreement with a subcontractor. Together these cases show that exposure can come from a single misconfigured file server and from a vendor-of-a-vendor relationship that was never papered. Before any file transfer service goes live, confirm that it is not reachable from the public internet, that access is limited to named accounts, and that every subcontractor touching client files has a signed business associate agreement. The risk analysis should list each of these locations explicitly.

What must be in place before a customer or auditor review

Billing, revenue cycle and practice management vendors are usually asked for the same short list of artifacts before a covered entity signs or an investigator opens a file. Each item below is a control OCR has cited in resolution agreements, and each one can be checked with a document, a log export or a test you run yourself.

Current, accurate risk analysis

Your own risk analysis must cover every system that creates, receives, maintains or transmits client PHI, including claims clearinghouse connections, billing databases, scanned remittances and any hosted ePCR or practice management instances. Check that the analysis names each asset, its threats and its likelihood and impact, and that it was updated after your last major system change. Ask whether the analysis is dated, signed and reviewed by the security official. OCR's cited failures in this sector began with a missing or inaccurate analysis.

Risk management plan with dated actions

A risk analysis only helps if it produces a plan. The risk management plan should list each identified risk, the security measure chosen to reduce it, an owner and a completion date. Check that open items are tracked to closure and that accepted risks carry a documented rationale signed by management. Reviewers often ask for the last two cycles of the plan to see whether actions actually closed.

Activity review of audit logs and access reports

Under 45 CFR 164.308(a)(1)(ii)(D), you must have procedures to regularly review records of information system activity, including audit logs, access reports and security incident tracking reports. This is a required implementation specification, so it cannot be skipped. Check for a written procedure, a named reviewer, a review cadence, and signed or ticketed evidence of each review. An intrusion that sat undetected for months in a past OCR case was a failure of this review, not of the logging itself.

Encryption and audit controls under 164.312

The technical safeguards in 45 CFR 164.312 cover access control, audit controls, integrity, authentication and transmission security. Confirm that ePHI is encrypted in transit and at rest where your risk analysis calls for it, and that the decision is documented if you chose an alternative for an addressable specification. For audit controls under 164.312(b), export a sample of logs from a production system to show which events are captured, how long they are kept and who can alter them.

Business associate agreements with subcontractors

If a subcontractor such as a hosting provider, transcription service or offshore coder receives PHI from you, you need a written business associate agreement with it before the data flows. The MedEvolve settlement cited a missing agreement with a subcontractor as one of its findings. Check your subcontractor list against your data flow diagram, and confirm each agreement covers permitted uses, safeguards, reporting and return or destruction of PHI.

Breach notice procedure within 60 days

Under 45 CFR 164.410, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery, identifying each affected individual where possible. The outer limit is not a target. Check that your procedure defines when discovery occurs, who decides, how affected records are identified from your systems, and how the notice is sent. Run a tabletop exercise and keep the output as evidence.

Who owns the controls, who prepares evidence and who issues a report

Your organization owns the Security Rule program for the systems and processes it runs. That includes the security official, the enterprise risk analysis and risk management plan, workforce policies, and the decisions about which safeguards are reasonable and appropriate. The organization also signs the business associate agreements its covered entity clients require, answers for its subcontractors, and decides on breach notices to each client within the 60-day outer limit that applies to business associates.

Security official and accountability: Name the person who answers for the program and give them authority over the billing, revenue cycle and practice management systems.
Risk analysis: Run and keep current the risk analysis, mapping where ePHI sits across clearinghouse links, billing platforms, file shares, email and laptops.
Log review and detection: Assign who reviews audit logs, access reports and security incident tracking reports, as the required implementation specification in 45 CFR 164.308(a)(1)(ii)(D) calls for.
Subcontractor and client agreements: Keep written assurances and flow-down terms current for every subcontractor that touches client PHI.
Breach decisions: Own the four-factor risk assessment and the notice to each affected covered entity.

Check that each of these duties has a named owner, a written procedure and a dated record before engaging any outside party.

How to choose a HIPAA consultant or assessor for a billing vendor

A billing or practice management vendor that brings in outside help needs to know what the consultant can prepare and what only an independent assessor can attest to. The cards below cover the checks that matter before signing, from experience with PHI-heavy billing workflows to the scope and deliverables written into the agreement.

Billing and practice management experience

Ask whether the consultant has worked on systems that hold claims, remittance data, patient demographics and scheduling records, not only on generic IT environments. Ask for named examples of how they mapped ePHI flows through clearinghouse connections, clinic portals and reporting tools. Experience with the ransomware and unauthorized access patterns seen in OCR cases against billing vendors is a useful signal. Request references you can call.

Independence from the build team

If the same team configures your billing platform and then tests its security, the findings carry little weight with customers or auditors. Ask who will perform the risk analysis and whether they had any role in designing, hosting or operating the systems in scope. Separate preparation work from independent testing, and document who made each decision.

Clear statement of deliverables

Confirm in writing what you receive: a risk analysis document, a risk management plan, updated policies, evidence binders, configuration baselines or a test report. Be wary of proposals that promise that you will be HIPAA compliant or certified. Under HHS's position, no HIPAA certificate exists, so a consultant should describe their output as preparation and evidence, not as a compliance stamp.

Fixed written scope

Define which applications, interfaces, hosting environments, subcontractors and locations are in scope before work starts. Ask how the consultant will handle systems you add later, such as a new clearinghouse connection or a practice management module. A fixed-scope agreement with agreed deliverables and timelines makes change requests visible and lets you compare quotes on the same basis.

Whether customers will accept the report

Before buying an assessment, ask your largest covered entity customers what evidence they require and whether they accept reports from a particular assessor. Some contracts specify an independent third-party review, while others accept your own documented risk analysis. Confirm the assessor's work product fits those contract terms. Note that a third-party HIPAA assessment shows what was tested at a point in time, not that a standard has been met for all time.

Questions to ask before signing

Ask who will do the work, what they have delivered for vendors like yours, how they will document excluded systems, how they will handle findings and who owns the remediation plan. Ask how they will deal with subcontractors that touch PHI, and whether they will sign a business associate agreement with you. Get answers in writing, and compare them with the scope and deliverables in the proposal.

Common questions from billing and practice management vendors

Is there a HIPAA certification my billing company can earn?

No. There is no HIPAA certification that HHS recognizes. HHS has stated that no Security Rule standard requires an entity to certify compliance, that it does not endorse or recognize private certifications, and that such certificates do not stop HHS from later finding a violation. Clients and their auditors may still ask for an independent assessment report, or for evidence of a current risk analysis, so the practical question is what evidence you can show. A vendor badge or certificate from a private firm proves little on its own. Ask any assessor to state the scope, the criteria used and the limits of the work in writing.

How long does HIPAA Security Rule readiness take for a billing vendor?

The duration depends on how many systems hold ePHI, how many clients you serve, how much documentation already exists and how many subcontractors touch the data. The largest single item is usually the risk analysis, which must cover where ePHI is created, received, maintained and transmitted, including hosting and backups. Missing policies, unmanaged file transfers and undocumented access are common reasons work runs long. Ask any consultant or implementation partner for a written schedule that lists each dependency, such as access to cloud accounts, staff interviews and the business associate agreements that must be reviewed. No duration should be accepted without a stated scope.

What does HIPAA readiness require from our own staff?

Readiness is mostly a staff task, with outside help supporting it. Your organization owns its controls, so the people who run billing, claims, clearinghouse connections and the server estate must take part. Expect to provide:

Current system inventories, including hosted applications, file transfer points and endpoints
Access lists and the process used to grant, change and remove user access
Logs, backup records and incident records for the past year or more
Named owners for the Security Rule policies and for the annual review
Time for interviews and for approving the risk management plan

An implementation partner can prepare systems and evidence, but only your leadership can accept residual risk and sign the policies.

Can a small billing company handle HIPAA compliance alone?

A small team can do much of the work itself, provided someone is named as the security official and has time for the duties. The Security Rule is scalable, so the expectations for a five-person billing firm differ from those for a large clearinghouse, but the required safeguards still apply. Tasks that small teams most often underestimate are the risk analysis, the review of system activity records and the written contracts with subcontractors. HHS offers a free risk analysis tool and NIST SP 800-66 Rev. 2 gives sample questions for each standard. Outside help is most useful for an independent review of the analysis, technical hardening and testing, which a small team may not have in-house.

What does the 60-day breach notice to clients require from us?

As a business associate, you must notify the covered entity client of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after you discover it. Where possible, you must identify each affected individual. The 60 days is an outer limit, not a target, and the clock starts at discovery. Practically, you need logging and monitoring that would reveal an intrusion, a documented intake path for suspected incidents, and contract terms that state how and when you will report. Ask your clients which contact, format and timing they expect, and test the process before an incident occurs.

Does a penetration test satisfy the HIPAA risk analysis?

No. A penetration test is one input to the risk analysis, not a replacement for it. The risk analysis must identify where ePHI lives, the threats and vulnerabilities to it, the likelihood and impact of harm, and the measures chosen to reduce risk, and it must be updated as the environment changes. A test can confirm whether specific weaknesses are exploitable, which is useful evidence for the analysis, but it does not cover policies, workforce practices, subcontractors or the review of system activity records. Enforcement cases against billing and practice management vendors cited missing or inaccurate risk analyses, so a test alone is not a defense.

What drives the cost of a HIPAA security project for a billing vendor?

The cost is driven by the number of systems and data flows that hold ePHI, the state of existing documentation, the number of subcontractors and the depth of technical work required. The main cost components are internal staff time, outside assessment or consulting fees, technical implementation and testing, and recurring costs such as log storage, backup, monitoring and annual reviews. Some costs are one-time, such as the first risk analysis, while others recur every year. The Office for Civil Rights penalty range is a reminder that the stakes are high: the inflation-adjusted civil money penalty runs from $145 per violation with no knowledge to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294 (45 CFR 102.3, 91 FR 3666). In a quote, ask for the scope, the deliverables, the assumptions about your environment and the items that are excluded.

Does an audit log review requirement apply to our practice management software?

Yes. The Security Rule requires procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports. This is a required implementation specification, not an option. Practice management and billing systems often generate logs that nobody reads, which was a finding in an enforcement case involving a practice management business associate that was not detected for many months. Engineers should confirm that logs capture user logins, record access and administrative changes, that they are retained and protected from tampering, and that a named person reviews them on a defined schedule. Confirm with your software vendor which events are logged by default.

How DeployOpen prepares billing platforms and evidence for review

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including the billing, revenue cycle and practice management systems that hold ePHI. We prepare the systems, safeguards and evidence that a risk analysis and an independent assessor will examine, while the company keeps ownership of its own Security Rule decisions.

How we scope

Engagements are fixed-scope, with the systems, data flows and deliverables agreed in writing before work starts.
The written scope lists which billing, claims and practice management applications, hosts and backups hold ePHI.
Scope names the subcontractors and cloud or data center environments that create, receive, maintain or transmit ePHI.
The company stays responsible for its risk analysis, risk management plan and workforce decisions, which we support but do not own.

How we build

We deploy open-source platforms in the client's cloud accounts, data center or air-gapped network, not in DeployOpen's environment.
Configuration covers access control, audit logging, encryption in transit and at rest, and backup and recovery settings.
We document system inventories and data flow maps so the risk analysis reflects where ePHI actually lives.
Security testing of applications, APIs and infrastructure can be scoped alongside the build to check the safeguards we implement.

How we hand over

Handover includes written configuration records, runbooks and the evidence each safeguard generates, such as audit log samples.
Documentation maps implemented controls to the Security Rule standards named in the written scope, for the client to review.
We walk the client's security official and engineers through administration, log review and incident procedures before closing.
Deliverables do not include an audit report, attestation or certificate, because only an independent assessor can issue those.

How we support

Ongoing support, upgrades, backup testing and continuous security testing are available as a retainer after handover.
Retainers cover platform patching and configuration changes so that evidence stays current between assessments.
Before any assessment, confirm with your assessor which evidence they expect and whether it matches what we delivered.
Ask for a written quote that lists scope, deliverables, exclusions and any retainer terms before work begins.