HIPAA Policy Templates for Medical Billing Companies
Medical billing companies that serve covered entities are business associates. These templates are built around billing workflows, not a hospital’s or a practice’s.
Written for the business of billing.
These policies are designed to meet the regulatory requirements of medical billing companies that provide services to physician practices, hospitals, insurance plans, other covered entities, and other business associates. Under HIPAA, billing companies are business associates themselves and are obligated to have written policies and procedures.
They are completely different from policies designed for medical practices, hospitals, or insurance companies, and are built specifically around the services billing companies provide.
What you get.
Quickly bring your organization into compliance with HIPAA rules for business associates.
Saves thousands of dollars in consulting fees.
Customize in Microsoft Word to fit your business.
Satisfaction guaranteed by Eagle, a leading consultant for IT security policies in healthcare.
Business associates are audited and fined too.
OCR began its first random audits of HIPAA business associates in 2016. OCR can impose civil money penalties in four tiers based on culpability, from violations the organization did not know about to willful neglect that was never corrected. Amounts are adjusted for inflation each year, annual caps per violation type reach into the millions, and state attorneys general can bring their own actions. Written policies and procedures are one of the first things investigators ask to see.
What’s included.
Every policy is delivered in Microsoft Word, organized by audience so staff read only what applies to them.
Policies for all staff
- 1000Confidentiality, Privacy and Computer Security Definitions
- 1010HIPAA: General Rules
- 1020Minimum Necessary Policy
- 1030Confidentiality Safeguards (Oral and Written)
- 1040Speaking with the Family and Friends of a Patient Receiving Services
- 1050Authorizations
- 1060Verification
- 1070Minors, Personal Representatives and Deceased Patients
- 1080Duty to Report Violations and Security Incidents
- 1090Disclosures that do Not Require an Authorization
- 1095Patient Portal
Patient rights
- 1200Patient’s Right to Access Records
- 1210Patient’s Right to Request Amendment of Records
- 1220Patient’s Right to Receive an Accounting of Disclosures
- 1230Patient’s Right to Request Additional Restrictions
- 1240Patient’s Right to Request Confidential Communications
Confidentiality policies for supervisors
- 1300Mitigation
- 1320Non-intimidation and Non-retaliation
Shared privacy and security policies
- 1340Policy Updating and Staff Training
- 1350Sanctions for Staff Violations of Privacy/Security Policies
- 1360Business Associate Contracts
- 1370HIPAA Assignments and Documentation
Security policies for the CEO and HIPAA Officer
- 2000HIPAA Officer and Security Management Process
- 2010Data Backup Policy
- 2020Disaster Recovery Plan and Emergency Mode Operation
- 2030Facility Security and Access Control
- 2040Annual Security Evaluation
- 2050Audit Control and Activity Review Policy
- 2060Malicious Software Protection Policy
- 2070Security Awareness Program
- 2080Device and Media Disposal and Re-Use
- 2090Technical Safeguards
- 2100Breach Reporting
Office manager and supervisors
- 3010Employee System Access and Termination Procedures
Security policies for all staff
- 3080Computer Usage
- 3082Use of Social Media
- 3085Portable Computing Devices
- 3087Home Offices
- 3090Security Incident Response and Reporting
Appendices and forms
- Appendix A: Identifying Business Associates
- Appendix B: Sample HIPAA Business Associate Agreement
- Appendix C: Sample Privacy and HIPAA Officer Duties
- Appendix D: Facility Security and Safeguards for Oral and Written PHI
- Appendix E: Workforce Access to PHI and Safeguards
- Appendix F: Minimum Necessary: Procedures for Routine Disclosures and Requests
- Appendix G: Miscellaneous
- Disclosure Log
- Confidentiality Agreement for Cleaning Agency
Gary Pritts, Founder and President
Gary Pritts is Founder and President of Eagle Consulting Partners. He began his HIPAA work providing technical input during the federal government's original drafting of the HIPAA regulations, and has since served more than 1,000 organizations as a consultant, as well as serving as a hospital trustee and as CSO for a cloud healthcare messaging company. Gary studied computer science at Purdue University and holds an MBA from Harvard Business School.
Gary’s experience includes serving as an executive in a health claims clearinghouse, giving him first-hand knowledge of how billing and claims operations handle PHI.
HIPAA Policy Templates for Medical Billing Companies
Instant download in Microsoft Word. Perpetual license for a single organization. Satisfaction guaranteed.
Save 20% ($100) with code Save-20 at checkout
Need policies built around your organization?
Eagle can tailor any template to your risk assessment, or write custom policies from the ground up. Call us, or send a note and we will follow up.
Talk to Eagle