HIPAA and Your Billing Vendor: What the BAA Should Actually Say

A signed BAA is the start of diligence, not the end of it. That is the uncomfortable part of HIPAA billing vendor: the loss is rarely dramatic enough to trigger an investigation, so it becomes the baseline. A practice running a 14% denial rate for three years stops describing it as a problem and starts describing it as normal.

The purpose of this guide is narrow and practical. Not a survey of everything that can go wrong, but the specific failure points that recur across the practices we work with, and what each one costs when it is left alone. Medxcode maintains 99% first-pass claim acceptance and an average of 42 days in A/R across our client base, and none of that comes from working harder on appeals. It comes from removing the causes listed below.

Read this alongside your own numbers. If you cannot state your first-pass acceptance rate, your percentage of A/R over 90 days and your top three denial reasons from memory, that is the first finding.

Across engagements, HIPAA billing vendor problems concentrate in four places. They are not exotic. They are the points where a process depends on a person remembering something, and where nothing catches the miss until a remit arrives weeks later.

Sequence matters more than effort here. Minimum necessary access should be role-based and auditable — this is the change to make first, because it is the one that stops new losses from being created while you work through the backlog. Any programme that starts with recovery and never reaches prevention refills the same pool it just emptied.

Second, address the process behind it: breach notification timelines and responsibilities must be explicit. This is usually a workflow and ownership question rather than a knowledge question. Someone has to own it by name, with a cadence, and the work has to be visible enough that a gap shows up within days rather than at the end of a quarter.

Third, close the structural gaps: subcontractor obligations flow down and should be named, and data return or destruction at termination needs a written process. These two are where practices most often assume they are compliant because nobody has complained. Test the assumption with a sample of your own claims before you rely on it.

Finally, measure the fix. Pick one number per change, record it before you start, and re-read it 30 and 90 days later. A fix that cannot be shown in a number will quietly revert as soon as attention moves elsewhere.

For most outpatient practices, healthy performance in this area means first-pass claim acceptance above 97%, initial denial rate under 6%, A/R over 90 days under 15% of total A/R, and a net collection rate above 96% of allowed amounts. Days in A/R varies by specialty and payer mix, but 42 days is achievable in most outpatient settings and is a reasonable target to hold a partner to.

Note what is not on that list: gross collection rate, total A/R, and claim counts. Each can move in the right direction while the practice collects less money. When you review performance — internally or with a vendor — insist on the same metric definitions every month, and on written commentary explaining any movement, including the movement nobody wants to discuss.

Our approach on medical billing accounts is deliberately unglamorous. We tag every denial by root cause rather than by code, rank causes by dollars rather than by count, convert the top causes into pre-submission rules, and then report the repeat-denial rate so you can see whether prevention is working. Coders are assigned by specialty, not rotated, so the code families and payer edits specific to your work are familiar rather than researched.

You get the same four figures every month — first-pass acceptance, days in A/R, net collection rate and aging movement — with written commentary, and access to the claim-level detail behind them on request. Agreements are month-to-month with no setup fee, because a partner who is producing should not need a contract to keep the business.

If you want this modelled on your own numbers first, the free analysis takes your claim volume, payer mix and current aging and returns a written estimate of what is recoverable, in one business day, with no obligation attached to it.