# Giving a medical billing company access to your practice's systems

A billing company that handles patient data is a HIPAA business associate. Sign a BAA, give each biller their own login, and remove it when they leave.

Updated: October 16, 2026

An outside medical billing company that works with your patients' health information is a business associate under HIPAA. Before it starts, you sign a business associate agreement (BAA): a contract that says what the company may do with the information and how it must protect it. Then treat the logins in your own systems as yours to control. Each biller gets their own login, limited to the billing work, and loses it when they stop doing your billing.

## Why a billing company is a business associate

Under HIPAA's definitions in 45 CFR 160.103, a firm that handles protected health information for a covered entity is a business associate. Your practice is the covered entity. The list of functions that qualify includes "claims processing or administration", "billing" and "practice management". HHS's business associate guidance uses billing and practice management as examples, too. For the definition in full, see [What is a HIPAA business associate?](/guides/healthcare-access/what-is-a-hipaa-business-associate).

A business associate is different from your workforce. HIPAA's workforce is the people whose work is "under the direct control" of your practice, whether or not you pay them. A biller you hire through a staffing agency and supervise yourself may be part of your workforce. A company that runs your billing with its own staff and methods is a business associate. The difference matters because a business associate needs a BAA and your workforce does not.

The billing company's own subcontractors are business associates too. If it sends work to a coding firm or another vendor, it must first get the same written promises from that firm (45 CFR 164.502(e)(1)(ii) and 164.504(e)(2)(ii)(D)).

## What the business associate agreement has to say

The Privacy Rule lists what the contract must contain (45 CFR 164.504(e)(2)). These are the parts that matter most when a firm works inside your systems:

- The company uses and discloses the information only as the contract allows or as the law requires.
- It uses appropriate safeguards and, for electronic records, complies with the Security Rule.
- It reports to you any use or disclosure the contract doesn't allow, including breaches.
- Its subcontractors agree to the same restrictions.
- At the end of the contract, it returns or destroys the information where that's feasible.
- You may end the contract if the company violates a material term.

The Security Rule adds its own version (45 CFR 164.314(a)(2)(i)). The company must comply with the Security Rule, bind its subcontractors to it, and report any security incident it becomes aware of.

HHS's FAQ says your practice isn't required to monitor how a business associate carries out its privacy safeguards. But if you learn of a pattern of activity that is a material breach of the agreement, you must take reasonable steps to fix it. If those steps fail, you end the contract where that's feasible (45 CFR 164.504(e)(1)(ii)). For the account terms to write into a vendor contract, see [What your vendor contract should say about accounts](/guides/outsourcing-access/contract-clauses-for-accounts).

## The logins in your own systems stay yours to control

A billing company's staff may sign in to systems your practice runs: the practice management system, the EHR, a clearinghouse or a payer portal. The Security Rule's technical safeguards apply to those systems whoever signs in. Your system must allow access only to people who have been granted it (45 CFR 164.312(a)(1)). It must also assign "a unique name and/or number for identifying and tracking user identity" (164.312(a)(2)(i)), and that implementation specification is "Required".

So the billing company's staff should each have their own login. With one shared login, every biller's work shows up under the same name in the system's activity record (164.312(b), audit controls). After a wrong charge or an odd export, you can't tell which person did it. You would have to ask the billing company to match times against its own schedules.

Shared logins are also harder to close. HHS's 405(d) guide for small healthcare organizations says to avoid shared or generic accounts. It explains why: updating one password for many users is hard enough that a stolen password can stay active for a long time. If a vendor's team already works from one login, [What to check when a vendor says its team uses one shared login](/guides/outsourcing-access/when-contractor-uses-shared-id) lists the questions to ask.

## Limit each login to what billing needs

HIPAA's minimum necessary standard (45 CFR 164.502(b)) applies to what you share with a business associate. You must make reasonable efforts to limit the information to the minimum needed for the purpose. HHS's guidance says routine, recurring disclosures can follow a standard protocol instead of a review of each one. The protocol must limit what is shared to the minimum for that type of disclosure. Ongoing billing work is that kind of disclosure.

In practice, the protocol is the access you set up for the billing role. Check what your practice management system and EHR let you limit for each user. Give billers the screens and actions billing needs: demographics, insurance, charges, claims and payments. Hold back full chart access unless the work truly needs it. The Security Rule's access authorization and modification specifications (164.308(a)(4)(ii)(B) and (C)) are "Addressable". You put them in place if they're reasonable for your practice. If not, you document why and use an equivalent measure where one is reasonable (164.306(d)(3)).

## When billing staff change or the contract ends

Staff turnover at the billing company is the case to plan for. You can't see when a biller leaves the company or moves to another client. So the contract should require the billing company to tell you, and you remove that person's login when it does. HHS proposed in January 2025 that firms notify each other within 24 hours of such a change (proposed 45 CFR 164.308(a)(9)(ii)(D)). That proposal has not been finalized, so the deadline has to come from your contract for now.

Compare the list of billing company users in each of your systems against the staff list the company reports. Any login with no matching person should be disabled. When the contract ends, disable every user the company has, then confirm the return or destruction of patient information that the BAA requires. The order of steps is in the [checklist for taking back access when a vendor contract ends](/guides/outsourcing-access/access-recovery-at-contract-end).


## Frequently asked questions

**Is a medical billing company a business associate?**

Yes, when it handles your patients' health information. HIPAA's definition of a business associate lists billing among the functions that make an outside firm one. That means you need a business associate agreement before it starts.

**Can our billers share one login to the practice management system?**

Avoid it. The Security Rule requires a unique name or number for each user of a system that holds patient data. With one shared login, the system's record can't tell you which biller did what.

**Do we have to audit how our billing company protects data?**

HHS says a practice isn't required to monitor how a business associate carries out its privacy safeguards. If you learn of a material breach of the agreement, though, you must try to fix it and, if that fails, end the contract where feasible.

**Will HIPAA require a billing company to tell us when a biller leaves?**

Not today. HHS proposed in January 2025 that a firm notify you within 24 hours when it changes or ends a staff member's access to your systems. The rule isn't final, so put a notice deadline in your contract.

## Sources

- [45 CFR 160.103, Definitions (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103)
- [45 CFR 164.308, Administrative safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308)
- [45 CFR 164.306, Security standards: General rules (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.306)
- [45 CFR 164.312, Technical safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)
- [45 CFR 164.314, Organizational requirements (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.314)
- [45 CFR 164.502, Uses and disclosures of protected health information: General rules (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502)
- [45 CFR 164.504, Uses and disclosures: Organizational requirements (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504)
- [HHS: Business Associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html)
- [HHS: Is a covered entity liable for, or required to monitor, the actions of its business associates?](https://www.hhs.gov/hipaa/for-professionals/faq/236/covered-entity-liable-for-action/index.html)
- [HHS: Minimum Necessary Requirement](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html)
- [HHS 405(d): Technical Volume 1, Cybersecurity Practices for Small Healthcare Organizations (2023 Edition)](https://hhscyber.hhs.gov/Documents/HICP/tech-vol1-508.pdf)
- [Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, January 6, 2025)](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information)

## How Junify handles this

**Doing this by hand** You give every clinician and staff member their own login, open and close access for each per-diem shift and vendor staff change, and keep a record of who used which system and when for someone to review.

**With Junify** Your admin adds the practice management and payer portal logins to Junify and assigns them to each person at the billing company. Billers verify on their own phone and click to sign in. Junify fills in the username and password, so they never see it, and each use is recorded under their own name, even on a shared login. When someone leaves the billing team, the admin removes their assignment and they can't sign in.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=healthcare&from=guide&cluster=healthcare-access&slug=medical-billing-company-access)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Can staff use personal devices to access clinical systems?](/guides/healthcare-access/byod-for-clinical-systems): HIPAA allows it with safeguards. Treat each personal laptop or phone as a workstation, write a device policy, and protect both the device and the login.
- [Who is responsible for user accounts in your practice's cloud software?](/guides/healthcare-access/clinic-saas-responsibility-split): The vendor secures its service. Your practice decides who gets a login and removes it when they leave. HHS says to sign a BAA and put the split in writing.
- [The HHS cybersecurity performance goals for accounts and logins](/guides/healthcare-access/hhs-cybersecurity-performance-goals-accounts): Four of HHS's 10 essential goals cover logins: MFA, revoking departing staff's access, unique credentials and separate admin accounts. HHS calls them voluntary.