How to evaluate medical billing companies for transparency and compliance

What does medical billing compliance mean when you outsource billing?

Medical billing compliance means every claim sent under your NPI is coded from the documentation, billed to the right payer, protected under HIPAA and corrected when it is wrong. Outsourcing moves the work to a billing company. It does not move the liability. Medicare pays the practice, the claim carries your provider number, and the False Claims Act treats reckless disregard as knowing, with no proof of intent to defraud required.

Two rules make this sharper than most vendor pitches admit. Since January 1, 2025, CMS says a practice has identified an overpayment when it knowingly receives or retains one, using the False Claims Act definition, with a 6-year lookback and a 60-day deadline to report and return. And the OIG’s Compliance Program Guidance for Third-Party Medical Billing Companies, published in 1998 and still the only guidance written for billing vendors, lists seven elements a billing company should run: written policies, a compliance officer, training, a hotline, discipline, audits and monitoring, and correction of systemic problems, including a policy against employing sanctioned people.

So the evaluation question is not whether a vendor says it is compliant. It is whether it can show you each of those seven elements, and whether you can see enough of your own data to catch a problem before it becomes an overpayment you knowingly kept.

Who is liable if your billing company upcodes?

Both of you can be, and the practice is the easier target because it received the money. The OIG guidance names the risk areas it expects billing companies to police, including billing for services not documented, unbundling, upcoding, duplicate billing, failure to use modifiers correctly and inadequate resolution of overpayments. It also warns that percentage billing arrangements may increase the risk of upcoding. A clause saying the vendor indemnifies you helps with cost, not with exposure: the payer still recoups from your practice.

The stakes are specific. HIPAA penalties in tiers 1 to 3 reach $73,011 per violation, each False Claims Act claim carries $14,308 to $28,619 plus three times the damages, and contracting with an excluded person or keeping a known overpayment each carry $25,595 per item.

How do you evaluate a billing company for compliance, step by step?

Evaluate a billing company by asking for documents and access, then checking them yourself. This order works in about two weeks of calls and document review:

1. Read their business associate agreement before your own counsel does. Check it against the required elements in 45 CFR 164.504(e), listed below.
2. Ask for the latest HIPAA security risk analysis and a third-party report. A SOC 2 Type 2 report or a HITRUST i1 or r2 certification, dated within the last year for SOC 2 and i1.
3. Ask for the compliance program. The name of the compliance officer, the written policies, the training log and the last internal audit, mapped to the OIG’s seven elements.
4. Ask how often they screen staff against the OIG exclusion list. The OIG updates the list monthly and recommends that providers screen billing or coding contractors, so monthly screening of every person on your account is the standard.
5. Check coder credentials by name. Coders should hold an AAPC CPC or AHIMA CCS, and an outside coding audit should run at least once a year.
6. Map where the money lands. Payer deposits and ERAs should go to an account and a clearinghouse enrollment you own.
7. Ask who else touches your data. Every subcontractor and offshore team, in writing, with the BAA that covers them.
8. Read the overpayment and write-off policy. Who approves an adjustment, and how fast the vendor tells you about an overpayment.
9. Confirm audit rights and exit terms. Your right to audit their work on your claims, and a full data export in a usable format when you leave.

What should a HIPAA compliant medical billing company put in writing?

A HIPAA compliant medical billing company signs a BAA that covers every element in 45 CFR 164.504(e): permitted uses only, appropriate safeguards and compliance with the Security Rule, reporting of any non-permitted use including breaches, the same terms flowed down to subcontractors, support for patient access, amendment and accounting of disclosures, books open to HHS, and return or destruction of all PHI at termination. HHS lists billing as business associate work, so there is no exception for small vendors.

Two more lines matter in practice. The vendor must notify you of a breach without unreasonable delay and in no case later than 60 calendar days after discovery. And the vendor must run its own risk analysis under 45 CFR 164.308. A SOC 2 Type 2 report shows its controls operated over a period; it is not a HIPAA certification, because no such federal certification exists.

Is a percentage-of-collections fee compliant?

Usually yes, when payer money goes into the practice’s own account. When Medicare pays a billing agent directly, 42 CFR 424.73 and 424.80 require that the agent’s pay is not related in any way to the dollar amounts billed or collected, and Medicaid’s rule at 42 CFR 447.10 says the same. Most percentage contracts stay outside those rules because the payer deposits to the practice and the vendor invoices separately. The fee shape still matters: 44% could not name the fee basis in their current billing contract, which means they cannot tell whether the vendor is paid on charges, collections or net collections. For how fee models compare on cost, see our guide on what billing companies charge and how to compare them.

What does medical billing transparency look like after you sign?

Medical billing transparency means you can see your raw data without asking the vendor to pull it. Reports summarize; raw access lets you check the summary. The minimum is a read-only login to your clearinghouse, every 835 ERA, a write-off and adjustment log showing who approved each entry, a denial report by CARC reason code, and an underpayment report against your contracted rates.

This is where vendors differ most. The top three denial reasons accounted for 58% of denied dollars in the average practice we reviewed, yet 63% could not name their top three denial reasons. 52% of practices that switched billing vendors cited missing denial reporting as the main reason. A vendor that reports denials by reason, with dollars and the fix owned by a named person, is doing the part most practices never see. Our denial and AR recovery work starts from that report.

In the Luxen claim audit of 61,400 claims, eligibility and coverage errors caused 24% of denials, coding and modifier errors 21%, missing or invalid prior authorization 17%, duplicate claims 9% and timely filing 6%, leaving 23% for all other causes.

Duplicates and timely filing are the two causes that point straight at vendor process. Duplicates come mostly from resubmitting instead of correcting. Timely filing losses are nearly permanent: Medicare’s limit is one calendar year from the date of service, and only 4% of timely filing denials were recovered.

How do you run a medical billing audit on your current billing company?

A medical billing audit of your vendor takes one staff day a quarter and a sample of your own claims. Do it this way:

1. Pull 30 random paid claims, 20 denied claims and every write-off over $250 from the last 90 days.
2. For the paid claims, compare each CPT code and modifier with the visit note. Send any disagreement to an outside coder, or to a certified coding review.
3. Match each 835 ERA to what was posted. Check allowed amounts against your fee schedule for the top five payers.
4. For each denial, check the date it was worked and whether it was corrected, appealed or written off, and who approved the write-off.
5. Ask for the exclusion screening log for everyone who touched those claims.

Underpayments against contracted rates appeared on 7.8% of paid claims in our audit, and the average underpaid claim was short by $38. Most practices never see either number because nobody compares the ERA with the contract.

What does weak billing transparency cost? A worked example

Take a practice with 3 providers collecting $90,000 a month on 800 paid claims, an average of $112.50 a claim. At 7.8% underpaid and $38 short each, 62.4 claims a month lose $2,371, or $28,454 a year. At the 14.2% first-pass denial rate our client practices started with, 113.6 claims a month are denied. If 19% of those are never reworked, 21.6 claims a month at $112.50 is $2,428, or $29,138 a year.

That is $57,592 a year of leakage against a vendor fee of $54,000 at 5% of collections. The chart shows the vendor fee at $54,000, underpaid claims at $28,454 and denials never reworked at $29,138 a year.

The compliance side of the same practice is worse. If an outside audit finds 60 claims upcoded, the False Claims Act minimum of $14,308 per claim is $858,480 before treble damages. That is why the audit rights and the monthly raw data matter more than the fee.

What compliance mistakes do practices make with billing vendors?

• Signing the vendor’s BAA unread. Missing subcontractor flow-down and PHI return at termination are the common gaps.
• Treating a SOC 2 logo as HIPAA compliance. Ask for the report itself and read the exceptions section.
• Letting the vendor write off without approval. Set a dollar threshold above which you sign off.
• Not asking about offshore work. Medicare Advantage plans must report offshore subcontractors that handle beneficiary PHI to CMS, and many pass an offshore attestation down to providers in their contracts.
• Nobody owning the vendor relationship. 42% of practice managers said nobody owns denial follow-up full time, so nobody reads the vendor’s reports either.
• Checking AR only when cash drops. Practices that reviewed AR ageing monthly carried 12 fewer days in AR.

Should you keep billing in-house or outsource for compliance?

Compliance duties are the same either way; what changes is who runs them and what they cost. Fully loaded in-house billing cost 7.9% of collections for practices under $2M, across 96 practices that shared payroll data, against 3% to 6% of collections for an outsourced service. In-house, you still need the seven elements, a risk analysis and exclusion screening for your own staff, and 34% of practice managers replaced a biller in the past two years, which resets training and access control each time.

Outsourcing makes sense when the vendor can show every document in the checklist above and gives you raw access. Keep billing in-house when you already have a certified coder, a compliance lead and someone who reads denials weekly. If you are comparing vendors now, our comparison of medical billing companies covers the market, and how the full revenue cycle works shows where a vendor’s work starts and stops. A full-service billing arrangement should include every step above. To see where your own claims stand, book a free billing review and send your AR ageing report.

Which compliance documents should a billing company show you?

Ask for each of these before you sign, and read what each one does not prove. No single document covers HIPAA, OIG and coding risk together.

Dental

Dental billing runs on CDT codes and the ADA claim form, but the compliance checks are the same: a BAA, a risk analysis and screened staff. The transparency test is PPO fee checking. 12% of paid PPO dental claims came in below the contracted fee, and dental practices wrote off a median $23,400 a year in restorative claims denied for missing narratives or X-rays. Ask the vendor for a PPO underpayment report and a list of denied restorative claims by reason. In our dental practice case study, reworking old claims recovered $86,000.

Physical therapy

Therapy billing carries Medicare rules a vendor must track per patient: the 8-minute rule for timed units, the KX modifier past the annual threshold and plan of care certification. The KX modifier was missing on 21% of Medicare therapy claims past the threshold, and 8-minute rule unit errors appeared on 9% of therapy claims. Ask the vendor how it tracks each patient’s threshold and who checks units against minutes before submission. See our physical therapy billing page for the full rule set.

Behavioral health

Behavioral health adds two compliance layers. Substance use disorder records fall under 42 CFR Part 2, and the HHS final rule of February 8, 2024 set a compliance date of February 16, 2026, allowing a single patient consent for treatment, payment and operations. A vendor handling those records must follow Part 2, not just HIPAA. The coding risk is time: 18% of 90837 claims had documented session time under 53 minutes, and claims sent to the medical plan instead of the behavioral health carve-out caused 12% of behavioral health denials. More on psychiatry billing.

Ambulance

Ambulance billing compliance turns on documentation the crew and the facility produce, not the biller. Physician Certification Statements were missing or unsigned on 18% of non-emergency transports, and ambulance agencies carried 37% of AR past 90 days. Ask the vendor how it holds a claim until the PCS is signed and how it reports aged transports by payer. In our King-American Ambulance case study, days in AR went from 71 to 38.

Primary care

Primary care compliance risk sits in modifiers and time-based services. Problem-oriented visits billed with an annual wellness visit lacked modifier 25 on 12% of claims, and chronic care management time went uncaptured for 58% of eligible patients. A vendor should show you both numbers each quarter, because one is a denial risk and the other is revenue you earned but never billed. See our primary care billing page for code-level detail.