Synopsis

A plain guide to HIPAA for medical billing agents, managers and leaders: the rules, safeguards and breach response, seven case studies, a 30 question self assessment and action plans, with sources from HHS, OCR, CMS, NIST and AAPC.

Table of Contents

• 
  1.
  About This Book
  ›
  

  This book answers one question for a medical billing company: how do we protect patient information, and how do we prove it? It joins two earlier works into one. The…

• 
  2.
  Part One: Start Here
  ›
  

  If you are new to medical billing, begin on this page. It gives you the map, the vocabulary and five habits to carry into your first week.Medical billing in plain…

• 
  3.
  Chapter 1: HIPAA Basics for a Medical Billing Company
  ›
  

  Q: What is HIPAA, in one breath?HIPAA is the Health Insurance Portability and Accountability Act of 1996. The rules that matter to a billing company sit in Parts 160, 162…

• 
  4.
  Chapter 2: Prerequisites Before You Start
  ›
  

  Q: What must be in place before we touch a claim?A signed Business Associate Agreement, or BAA, with each client. It must define permitted uses, require safeguards and incident reporting,…

• 
  5.
  Chapter 3: Compliance Program Infrastructure
  ›
  

  Q: What are the seven elements of a compliance program?The General Compliance Program Guidance from HHS OIG, published on November 6, 2023, lists them:Written policies and proceduresCompliance leadership and oversightTraining…

• 
  6.
  Chapter 4: Work Ethics and Professional Conduct
  ›
  

  Q: What ethical standard do we follow?AAPC members, including CPC, CPB and CPCO holders, agree to the AAPC Code of Ethics as a condition of membership. It rests on six…

• 
  7.
  Chapter 5: A Safe Company Environment
  ›
  

  Q: What are physical safeguards?They are the Security Rule's protections for facilities, workstations and devices, found in 45 CFR 164.310. They cover who gets in, how workstations are used, and…

• 
  8.
  Chapter 6: HIPAA Security Rule Standards
  ›
  

  Q: What does the Security Rule require overall?It asks you to protect the confidentiality, integrity and availability of ePHI, to guard against threats you can reasonably anticipate and against impermissible…

• 
  9.
  Chapter 7: The Privacy Rule in Daily Billing Work
  ›
  

  Q: Why may we use PHI at all?Covered entities may use and disclose PHI for treatment, payment and health care operations without patient authorization, under 45 CFR 164.506. Payment includes…

• 
  10.
  Chapter 8: Breach Prevention, Detection and Response
  ›
  

  Q: What counts as a breach?A breach is the acquisition, access, use or disclosure of PHI that the Privacy Rule does not permit and that compromises its security or privacy,…

• 
  11.
  Chapter 9: A HIPAA Organized Workflow and Training
  ›
  

  Q: Where do the controls go in the AR workflow?StageBuilt in HIPAA controlClient onboardingBAA before any data arrives, SFTP or portal transfer, inventory updated, client rules such as Part 2…

• 
  12.
  Chapter 10: QA Audits, Monitoring and Next Steps
  ›
  

  Q: What should QA check in each note?Minimum necessary. No unneeded identifiers or diagnoses, and no sensitive categories such as substance use, HIV, mental health or reproductive care unless the…

• 
  13.
  Part Three: The Leader's Perspective
  ›
  

  Part Two taught the rules. This part asks the harder question that every owner, manager and agent asks sooner or later: are we really compliant, and could we prove it?The…

• 
  14.
  The Honest Self Assessment and Ten Red Flags
  ›
  

  The honest self assessment: 30 questionsTick a box only if you can show proof today: a document, a log, a screenshot or a signed record. "We do that, I think"…

• 
  15.
  Part Four: Case Studies for Patients and Providers
  ›
  

  Rules become real when something goes wrong. This part walks through patients, providers and EDI files, then shows how to talk to a patient whose data was breached and how…

• 
  16.
  EDI Case Studies and What Real OCR Cases Teach
  ›
  

  EDI and covered entity case studiesElectronic files move fast and in bulk, so EDI mistakes involve many patients at once. These two cases show how clinics, billing companies, clearinghouses and…

• 
  17.
  Talking to the Patient Whose Data Was Breached
  ›
  

  A breach letter is hard to receive, and how we speak to the patient decides whether they feel respected or left alone.Who speaks to the patientThe covered entity is ultimately…

• 
  18.
  Provider and Billing Company Views, and How to Stop a Second Breach
  ›
  

  Provider view and billing company view, side by sideTwo organizations, one breach. This table follows the same event through each set of eyes, so a new agent can see where…

• 
  19.
  Part Five: Action Plans by Starting Point and by Role
  ›
  

  This part turns everything before it into work: plans by starting point, a plan for each role, and the evidence you keep so you can prove it.Action plans by starting…

• 
  20.
  The Evidence Binder and the Leader's Sign Off
  ›
  

  Keep these records for at least six years from the date created or last in effect, whichever is later, under 45 CFR 164.316 and 164.530. If a BAA or state…

• 
  21.
  Regulatory Status Tracker and References
  ›
  

  Regulatory status trackerThis table shows what is law, what is only proposed and what a court has struck down. It was checked on October 12 and 13, 2026. Review it…