HIPAA at your kitchen table

The practice is a covered entity under HIPAA. You, the billing service, are its business associate, and HHS names billing companies as business associates explicitly. That single word changes your legal position: you carry direct obligations under the Privacy and Security Rules, enforceable against you, not just against the practice that hired you.

The BAA comes first

Before a single patient record reaches you, you and the practice sign a Business Associate Agreement. The BAA says what PHI you may receive, what you may do with it, how you will protect it, what happens in a breach, and what happens at the end of the relationship. Most practices have a template; if they do not, you bring one, and you have it reviewed before you sign anything a lawyer has not read. HHS publishes sample BAA provisions that show what belongs in the document.

The chain continues downward: your clearinghouse and software vendors also handle PHI, and the practice's BAA with you must permit your use of subcontractors who carry their own obligations. In practice your vendors will already have their BAAs ready to sign; a vendor who cannot produce one is disqualifying itself.

Minimum necessary, and what it means at a desk

HIPAA's minimum necessary standard says you use and disclose only the PHI the task requires. For billing, the task requires a lot: diagnoses, procedures, demographics, policy numbers. It does not require gossip, curiosity, or telling your spouse about the local celebrity who came in Tuesday. Breaches of confidentiality get people fired and sued in this industry, and the textbook case every trainee learns is the coder who told a friend's spouse about a patient's diagnosis and got the employer sued.

Your home office is now a regulated facility in the practical sense:

• One work computer, password-protected, full-disk encrypted, automatic screen lock. No family use, ever.
• PHI moves through your billing software and its secure channels only. Not personal email. Not texts. Not a USB stick in a purse.
• Paper, when it exists, lives in a locked drawer and gets cross-cut shredded.
• Access logs and unique logins for anyone who ever touches the system, including your future first hire.

Breaches and penalties, briefly

If PHI leaks, there is a notification chain with deadlines, and the fines are real: federal civil penalties scale by culpability, and the enforcement record includes HHS's four point three million dollar civil penalty against Cignet Health for privacy violations, including refusing to turn over patients' records when they asked and then stonewalling the investigation. You will carry errors and omissions insurance, which the course prices out later. It does not cover intentional misconduct, and that line gets drawn later in this course too.

Keep the records

CMS requires providers to retain claims and their source documents for six years, which is also HIPAA's documentation retention period for policies and agreements. Practically: your contract file and your claims archive live longer than most of your client relationships will. Build the filing structure on day one, not after the first audit letter.

None of this is optional overhead. It is half of what the practice is buying. A billing service that can show a clean compliance posture wins deals against cheaper competitors, because the office manager signing your contract is personally answerable for choosing you. That is the moat working.

From here the stakes climb, from fines toward prison, and the course draws those lines later.