A medical billing company never sees a patient in an exam room, yet it holds the same information the practice does: names, diagnoses, insurance numbers and dates of birth. Under HIPAA, that makes it a business associate, and since the HITECH Act business associates have been directly responsible for the HIPAA Security Rule. Your clients know it, and they are starting to ask for proof. Good IT support for medical billing companies starts with that fact.
Zippie IT, a veteran-owned company in Meridian, Idaho, provides IT support for medical billing companies and other healthcare vendors, so they can show clients that the technology is under control.
What your clients will ask you
A busy practice rarely audits its vendors, but it increasingly sends a questionnaire before it signs or renews. Expect questions like these:
- When did you last complete a HIPAA security risk analysis, and can we see a summary?
- Do you use multi-factor authentication on every system that holds patient data?
- Are laptops, phones and backups encrypted?
- Do you have a signed business associate agreement with every vendor that touches our data?
- How do you train staff, and how do you handle a lost device or a stolen password?
- What is your plan if you have an incident, and how fast would we hear about it?
Honest, documented answers win business. Vague ones lose it.
IT support for medical billing companies with remote staff
Billing teams often work from home, on a mix of company and personal computers. That is where patient data most often leaks: a download left on a family laptop, a text message to a coworker or a shared login. We help you set clear rules and the tools to enforce them, such as managed devices, a secure remote desktop or cloud workspace and no patient data on personal machines.
Your own vendors
Your security is only as strong as the clearinghouse, the cloud storage, the transcription service and any overseas coding partners you use. Each needs its own agreement and its own review. We help you list them, check what they hold and spot the ones that should not touch patient data at all. We do not sell services that depend on a vendor’s business associate agreement we have not confirmed.
If something goes wrong
Under the HIPAA Breach Notification Rule, a business associate must tell the covered entity about a breach without unreasonable delay and no later than 60 days after discovery. Your contracts with clients may set a shorter deadline. A written plan that names who decides, who calls the client and what evidence to preserve is the difference between a manageable incident and a crisis.
What our assessment gives you
We perform a HIPAA security risk assessment tailored to a vendor. You receive a written report that lists your systems and where patient data lives, the safeguards you have, the gaps and a prioritized plan to fix them. You can use the results to answer client questionnaires and decide what to fix first. See our compliance consulting page and our work with healthcare practices. For ongoing help, our managed IT services cover the day-to-day security work.
We do not provide legal advice and we cannot certify HIPAA compliance. Our assessment helps you find and fix gaps, and your own counsel decides what the law requires of you.
Get started
For IT support for medical billing companies that clients will trust, a free network and security review is a good first step: we review your devices, remote access and backups and send a written report, with no obligation. Please do not send us patient information. To talk first, contact us or call (208) 810-1795.
We use your details to respond to your request. If you want details, see our Privacy Policy.
Frequently asked questions
What does IT support for medical billing companies include?
Help for office and remote staff, managed and encrypted devices, multi-factor authentication, tested backups and a HIPAA security risk assessment you can summarize for clients.
Is a medical billing company really covered by HIPAA?
If you handle protected health information on behalf of a provider, you are generally a business associate, and the Security Rule applies to you directly. Your own counsel can confirm how it applies to your business.
What is a business associate agreement?
A contract between a covered entity and a business associate that sets out how patient information may be used and protected. Each vendor that touches the data needs its own.
How often should we do a security risk analysis?
HIPAA expects one to be accurate and thorough and kept current. Many organizations review it at least yearly and after major changes such as a new system, a move or a new client.
Can our remote staff keep working from home?
Yes, with the right setup. That usually means company-managed devices, multi-factor authentication, encryption and clear rules on where patient data may live.
Can you give us a certificate that says we are HIPAA compliant?
No. No one can certify HIPAA compliance. We can document what you have, fix the gaps and give you a report you can share with clients.