A patient calls the billing office to ask about a balance, and the person who answers confirms the visit date, the procedure and the amount owed before checking who is on the line. It takes ten seconds, and it is a HIPAA disclosure. Medical billing is where protected health information moves the most: from the chart to the coder, from the claim to the clearinghouse, from the payer back to the practice and out again on a patient statement.
HIPAA compliance in medical billing means following the HIPAA Privacy, Security and Breach Notification Rules at every one of those points, using the standard electronic transactions and code sets for every claim and making sure every outside party that touches billing data, from the billing company to the clearinghouse, has signed a business associate agreement. This guide explains each rule in billing terms, the practices that keep a billing operation compliant, the violations regulators find most often and what changed in 2026.
Medical billing teams handle sensitive patient information throughout the revenue cycle. Following HIPAA requirements is essential when managing claims, payment posting and patient accounts. Learn more about our medical billing services and how a structured billing workflow supports accurate claims processing and responsible PHI handling.
Is Billing Information Protected Under HIPAA?
Yes. Billing information is protected health information (PHI) under HIPAA whenever it identifies a patient. HIPAA defines health information to include information about payment for health care, so an itemized statement, a claim, a remittance, an account balance and even the fact that a person is a patient of a specific practice are all PHI when they can be linked to that person.
What counts as PHI in medical billing?
| Billing Data | Why It Is PHI |
|---|---|
| Patient name, address, date of birth and phone number | Identifiers linked to care or payment |
| Insurance member ID and group number | Identifies the patient and their coverage |
| Diagnosis (ICD-10-CM) and procedure (CPT, HCPCS) codes | Describe the care the patient received |
| Dates of service and provider names | Link the patient to specific encounters |
| Claim, remittance and denial details | Show what was billed and paid for the patient’s care |
| Account balances, statements and payment plans | Information about payment for health care |
| Social Security and account numbers on file | Direct identifiers stored with billing records |
Billing data that has been properly de-identified, with all identifiers removed under HIPAA’s de-identification standard, is no longer PHI. Reports that show only totals by payer or by code, with no patient-level detail, usually fall in that category.
What Are the HIPAA Rules for Medical Billing?
HIPAA is a set of rules rather than a single requirement. Five of them shape medical billing directly, and a sixth, the Transactions and Code Sets standards, is the reason every claim looks the way it does.
| HIPAA Rule | What It Requires in Medical Billing |
|---|---|
| Privacy Rule | Limits how PHI is used and disclosed; allows use for payment without patient authorization; requires the minimum necessary |
| Security Rule | Requires administrative, physical and technical safeguards for electronic PHI in billing systems |
| Breach Notification Rule | Requires notice to patients, HHS and sometimes the media after a breach of unsecured PHI |
| Enforcement Rule | Sets how HHS investigates complaints and imposes civil money penalties |
| Omnibus Rule (2013) | Made business associates, including billing companies, directly liable for compliance |
| Transactions and Code Sets | Requires standard electronic transactions (837, 835, 270/271) and code sets (ICD-10, CPT, HCPCS) |
The Privacy Rule: payment is a permitted use
The HIPAA Privacy Rule allows covered entities to use and disclose PHI for treatment, payment and health care operations without the patient’s written authorization, under 45 CFR 164.506. Payment covers the billing work itself: verifying eligibility, submitting claims, obtaining prior authorization, collecting balances and using a collection agency. What the Privacy Rule adds is a limit. For payment, unlike treatment, the minimum necessary standard applies, so each person and each disclosure should involve only the PHI needed for that task.
Two patient rights land directly on the billing office. A patient who pays for a service in full out of pocket can ask the practice not to send information about that service to their health plan, and the practice must agree. Patients can also ask to receive statements and calls at an alternative address or number, and providers must accommodate reasonable requests.
The Security Rule: safeguards for electronic billing data
The HIPAA Security Rule applies to electronic PHI, which in billing means the practice management system, the clearinghouse connection, emailed remittances and every laptop that can open them. It requires three groups of safeguards: administrative (a documented risk analysis, policies, training and business associate oversight), physical (secured workstations and devices) and technical (unique user IDs, access controls, audit logs, automatic logoff and protection of data in transit).
The Breach Notification Rule: what happens when billing data is exposed
Under the Breach Notification Rule, a breach of unsecured PHI requires notice to each affected patient without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within that window and, when they involve more than 500 residents of a state, to prominent media outlets. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. A business associate that discovers a breach must notify the covered entity.
Transactions and code sets: why HIPAA shapes the claim itself
HIPAA’s Administrative Simplification standards require providers that bill electronically to use standard transactions: the 837 for claims, the 835 for remittance advice, the 270 and 271 for eligibility and the 276 and 277 for claim status. They also name the code sets those transactions must use, including ICD-10-CM, ICD-10-PCS, CPT, HCPCS and CDT. That is what “HIPAA coding” means in practice: valid, current codes from the adopted code sets, reported in the standard format, with each provider identified by NPI. When claims contain coding errors or incomplete information, they may be rejected or denied by payers. Effective medical billing denial management helps providers identify denial patterns, correct claim issues and improve reimbursement workflows while maintaining appropriate safeguards for patient information.
| Compliance tip: Payment is a permitted use, but it is not unlimited. A biller who needs a diagnosis code to submit a claim does not need the full progress note, and a collection agency needs the balance and contact details, not the diagnosis. |
Why Is HIPAA Important for Billing and Coding?
HIPAA matters in billing and coding because this is where PHI travels furthest from the exam room. A single claim may pass through the practice management system, a coder, a clearinghouse, the payer and back again. Each handoff creates a potential risk of data being exposed, sent to the wrong party or retained longer than necessary.
HIPAA compliance is essential throughout the billing process, from eligibility verification to payment posting. Integrating privacy and security practices into revenue cycle management services helps healthcare organizations maintain consistent billing workflows while protecting sensitive patient information.
The risk is not theoretical. The February 2024 ransomware attack on Change Healthcare, a claims clearinghouse, affected 192.7 million people, according to UnitedHealth Group’s final count reported in July 2025. It also disrupted claims processing for practices across the country for weeks, highlighting the importance of protecting billing systems and patient data.
HIPAA Compliance for Medical Billing Companies
A medical billing company is a business associate under HIPAA, because it creates, receives, maintains or transmits PHI on behalf of a covered entity. Since the 2013 Omnibus Rule, business associates are directly liable for complying with the Security Rule and with parts of the Privacy Rule, and they can be penalized by HHS on their own.
What a business associate agreement must cover
Before a billing company touches a single claim, the practice and the billing company must sign a business associate agreement (BAA). HHS publishes sample BAA provisions that set out what the contract must include:
| BAA Element | What It Means for Billing |
|---|---|
| Permitted uses and disclosures | The billing company may use PHI only to perform the billing services described |
| Safeguards | The billing company must comply with the Security Rule for electronic PHI |
| Breach reporting | The billing company must report breaches and security incidents to the practice |
| Subcontractors | Any subcontractor, such as a coding vendor, must agree to the same restrictions |
| Patient rights | The billing company must help the practice respond to access and amendment requests |
| Return or destruction | PHI must be returned or destroyed when the contract ends |
Outsourcing healthcare compliance: what changes and what does not
Outsourcing billing shifts the work, not the accountability. The practice remains a covered entity and is responsible for choosing a business associate that can protect PHI, signing a BAA and acting if it learns of a material breach of the agreement. When you evaluate outsourced medical billing services, ask how the company controls access to your data, how it trains its staff and how quickly it will tell you about an incident.
HIPAA does not prohibit business associates or their subcontractors from working outside the United States. Some payer contracts and state programs do restrict offshore access to their members’ data or require it to be disclosed, so practices should confirm those terms before approving an offshore team.
What Makes Medical Billing Software HIPAA Compliant?
No software is HIPAA compliant on its own. HIPAA applies to the people and organizations that handle PHI, so what a vendor can offer is features that support compliance and a willingness to sign a BAA. A billing platform is a sound choice for HIPAA purposes when it does the following:
| Capability | Why It Matters |
|---|---|
| Signs a business associate agreement | Without a BAA, storing PHI in the platform is not compliant |
| Role-based access control (RBAC) | Front desk, coders, billers and managers see only what their role needs, supporting the minimum necessary standard |
| Unique user IDs and multi-factor authentication | Every action is tied to one person, and stolen passwords alone cannot open the system |
| Audit logs | Records who viewed, changed or exported each patient record and claim |
| Encryption in transit and at rest | Protects claims, remittances and statements if a connection or device is compromised |
| Automatic logoff and session controls | Prevents unattended workstations from exposing patient accounts |
| Secure patient statements and invoicing | Sends bills and payment links without exposing diagnoses or detailed PHI |
| Backup and recovery | Keeps billing running after an outage or ransomware attack |
HIPAA compliant AI and automation in medical billing
AI tools for coding suggestions, denial prediction and claim scrubbing are covered by the same rules. If an AI vendor processes PHI on behalf of a practice or billing company, it is a business associate and needs a BAA, and the tool should be included in the organization’s risk analysis. Pasting patient details into a general-purpose AI tool that has not signed a BAA is an impermissible disclosure, no matter how useful the answer is.
Key HIPAA Compliance Practices for Medical Billing
These practices cover the points where billing operations most often go wrong.
1. Keep a current, billing-wide risk analysis
A risk analysis must cover every place billing PHI lives: the practice management system, clearinghouse portals, payer portals, shared drives, email, printed EOBs and the laptops of remote billers. Update it when you add a system, a vendor or a remote team, not just once a year.
2. Control access by role
Give each person a unique login and only the access their role requires. Remove access the day someone leaves, and review user lists every quarter, because former employees with active portal logins are a common finding.
3. Apply the minimum necessary standard to every disclosure
Send payers what the claim or appeal requires, give collection agencies balances rather than clinical details and keep diagnoses off patient statements wherever possible.
4. Verify identity before discussing an account
Confirm at least two identifiers before discussing a balance by phone, and check whether the patient has asked for confidential communications before leaving a voicemail or mailing a statement.
5. Secure every transmission
Use encrypted connections to clearinghouses and payers, secure messaging or encrypted email for PHI and secure portals for patient statements and payments. Never email unencrypted spreadsheets of patient accounts.
6. Manage business associates actively
Keep a list of every vendor that touches billing PHI, including clearinghouses, statement printers, collection agencies, coding vendors and AI tools, with a signed BAA for each.
7. Train billing staff regularly
Train every new biller before they get system access and refresh training at least yearly, with billing-specific scenarios: phone verification, misdirected statements, phishing and handling paper EOBs.
8. Audit billing activity
Review access logs for unusual activity, such as one user opening hundreds of accounts, and audit claims and statements for accuracy. A medical billing audits that checks both compliance and coding accuracy catches problems before regulators or payers do.
9. Have a breach response plan
Decide in advance who investigates, how the four-factor risk assessment is documented and who sends notices, so the 60-day clock does not run out while the team works out who is responsible.
| Compliance tip: Billing compliance and HIPAA compliance overlap. Accurate coding protects you from false claims risk, while HIPAA protects the data behind those codes. Treat them as one program with two goals. |
What Are the Top 5 HIPAA Violations?
The HHS Office for Civil Rights (OCR) publishes the compliance issues it investigates most often in its enforcement highlights. Each one has a direct billing version:
| Violation | What It Looks Like in Medical Billing |
|---|---|
| Impermissible uses and disclosures of PHI | A statement mailed to the wrong address; account details given to a caller who was not verified |
| Lack of safeguards for PHI | Unencrypted laptops with patient ledgers; shared logins for the billing system |
| Lack of patient access to their PHI | Delays in sending a patient their itemized bill or records |
| Lack of administrative safeguards for electronic PHI | No current risk analysis; no business associate agreements with billing vendors |
| Use or disclosure of more than the minimum necessary | Sending full medical records when a payer asked only for one note; diagnoses printed on collection letters |
Two OCR enforcement initiatives target these areas. The Right of Access Initiative, running since 2019, reached its 54th enforcement action in 2025, as Shumaker summarized. The Risk Analysis Initiative, launched in October 2024, focuses on organizations that cannot show an accurate and thorough risk analysis, and OCR has said both will continue in 2026, as the HIPAA Journal reported. Patients must receive access to their records within 30 days, with one 30-day extension allowed.
HIPAA penalties
OCR imposes civil money penalties in four tiers based on the level of culpability, from violations the organization did not know about to willful neglect left uncorrected, and adjusts the amounts for inflation each year. Knowingly obtaining or disclosing PHI in violation of HIPAA is also a federal crime, with penalties up to $250,000 and 10 years in prison when the intent is to sell the information or cause harm. In billing, most enforcement starts with a complaint or a breach report, which is why a misdirected statement can open a full investigation.
What Is the New HIPAA Rule in 2026?
Three developments shape HIPAA compliance in medical billing in 2026, and only one of them is a new requirement already in force.
Updated Notice of Privacy Practices (February 16, 2026)
Covered entities had to update their Notice of Privacy Practices by February 16, 2026, to reflect the 2024 changes aligning 42 CFR Part 2, the federal confidentiality rule for substance use disorder records, with HIPAA. OCR’s authority to enforce Part 2 began the same day, as Nixon Peabody explained. Practices that bill for substance use disorder treatment should confirm their notice, consent forms and billing workflows reflect the new rules.
The proposed Security Rule update is not final
HHS proposed the first major update to the Security Rule since 2013 on January 6, 2025. It would make encryption and multi-factor authentication mandatory, require asset inventories and network segmentation and set annual compliance checks. It is still a proposal. HHS has moved final action to at least July 2027, according to Paubox’s analysis of the federal regulatory agenda, and the current Security Rule remains fully in force. The Change Healthcare attack began through a remote access portal without multi-factor authentication, which is why many billing organizations are adopting MFA and encryption now rather than waiting.
Reproductive health privacy rule vacated
A 2024 Privacy Rule change adding protections for reproductive health care information was largely vacated by a federal court in June 2025. Practices that updated their billing disclosure processes for that rule should review them with counsel.
HIPAA Compliance Checklist for Medical Billing
| Area | Check |
|---|---|
| Risk analysis | Covers every billing system, portal, device and remote worker; updated after changes |
| Business associates | Signed BAA with the billing company, clearinghouse, statement vendor, collection agency and AI tools |
| Access | Unique logins, role-based access, MFA and quarterly access reviews |
| Transmission | Encrypted clearinghouse, payer and email connections |
| Minimum necessary | Disclosures limited to what each claim, appeal or collection needs |
| Patient rights | Self-pay restrictions, confidential communications and 30-day access process in place |
| Notice of Privacy Practices | Updated for the February 16, 2026 Part 2 changes |
| Training | Billing-specific training at hire and at least yearly |
| Breach response | Written plan with owners and the 60-day notification timeline |
| Records | Policies, risk analyses and training records kept for six years |
How iSolve RCM Supports HIPAA-Compliant Medical Billing
iSolve RCM is a medical billing company that provides billing and coding services as a business associate under a signed Business Associate Agreement (BAA). According to its Privacy Policy, iSolve RCM states that it complies with HIPAA requirements and follows industry best practices and federal standards to protect personal information. The company uses secure methods for data transmission and storage and may handle Protected Health Information (PHI) to provide medical billing and data services. iSolve RCM may also use de-identified data to improve its software, services, technical support, and operational processes in accordance with applicable HIPAA regulations under 45 CFR § 164.514(a)–(c).
FAQs
What are the HIPAA rules for medical billing?
The Privacy Rule allows PHI to be used for payment but limits disclosures to the minimum necessary. The Security Rule requires safeguards for electronic billing data. The Breach Notification Rule requires notice after a breach. Business associates such as billing companies must sign a BAA, and claims must use HIPAA’s standard transactions and code sets.
What are the 5 HIPAA rules?
The five rules most often listed are the Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule and the Omnibus Rule of 2013. HIPAA’s Administrative Simplification provisions also include the Transactions and Code Sets standards and the unique identifier rules, such as the NPI.
What is the new HIPAA rule in 2026?
The only new requirement in force in 2026 is the updated Notice of Privacy Practices, due February 16, 2026, which reflects changes to the Part 2 substance use disorder rules. The proposed HIPAA Security Rule update is not final; HHS has moved its target to at least July 2027.
What are the top 5 HIPAA violations?
According to OCR, the most common issues are impermissible uses and disclosures of PHI, lack of safeguards for PHI, lack of patient access to records, lack of administrative safeguards for electronic PHI and disclosures of more than the minimum necessary.
Is billing information protected under HIPAA?
Yes. HIPAA’s definition of health information includes payment for health care, so claims, remittances, statements and account balances are protected health information when they identify a patient.
Does a medical billing company need to be HIPAA compliant?
Yes. A billing company is a business associate, must sign a BAA with each practice it serves and is directly liable for complying with the Security Rule and parts of the Privacy Rule.
Is any medical billing software HIPAA compliant?
Software alone cannot be HIPAA compliant, because HIPAA applies to the organizations using it. Look for a vendor that signs a BAA and offers role-based access, multi-factor authentication, audit logs, encryption and secure patient billing.
Can a medical practice share billing information with a collection agency?
Yes. Collection is part of payment, so a practice can disclose the information an agency needs under a BAA. The minimum necessary standard still applies, so diagnoses and clinical details should not be shared.
