Who is covered?
Covered entities include health plans, healthcare clearinghouses, and healthcare providers that conduct specified electronic transactions. Business associates perform certain functions involving protected health information on behalf of covered entities.
Simply handling health-related information does not make every organization a regulated entity. A bank or technology provider's role requires analysis. See HHS guidance on coverage.
What this means for billing and collections
Identifiable information about healthcare or payment can be protected health information (PHI). HIPAA permits specified payment activities, including billing and collection, subject to applicable conditions.
For payment and healthcare operations, apply the minimum necessary standard where required. A permitted payment purpose does not justify sharing a complete medical record. See HHS guidance on payment disclosures.
Controls to examine
- Required business associate agreements and permitted uses.
- Access limited to appropriate workforce roles.
- Risk analysis and administrative, physical, and technical safeguards for electronic PHI.
- Approved communication channels and confidential-contact requests.
- Incident assessment, escalation, and applicable breach notifications.
- Workforce training and documented procedures.
The HHS Security Rule summary distinguishes current requirements from proposed changes.
Practical example
A billing inquiry may require the service date, account reference, and amount. It does not necessarily require diagnostic details in an outbound message. Determine what is necessary, who may receive it, and how it should be delivered.
A vendor agreement or security feature alone does not establish full compliance. Other privacy and collection laws may also apply.