HIPAA Medical Billing Compliance Checklist

A billing-specific HIPAA compliance checklist covering TPO, BAAs, minimum necessary, statement design, and offshore billing considerations.

Short answer

A billing-focused HIPAA checklist covering TPO disclosures, billing-vendor BAAs, minimum necessary, statement design, and offshore considerations.

What is inside

Confirm TPO disclosures are within the payment exception in § 164.506
Inventory billing-related business associates and BAA dates
Apply minimum necessary to coding and claim attachments
Audit patient statement envelopes and portal access controls
Document offshore billing operations against your risk analysis
Common billing-related compliance gaps to fix this quarter

We publish the same practical templates and decision tools that clinics use to structure recurring HIPAA work. No enterprise gate. No resource-library gimmicks. Just practical material delivered quickly.

Editorial details

Written by: Angel Campa

Reviewed by: PHIGuard Compliance Research

Updated: April 28, 2026

Best next step: Open the matching product path

Sources

45 CFR § 164.508 — Uses and disclosures requiring authorization | Electronic Code of Federal Regulations
45 CFR Part 162 — Administrative Requirements | Electronic Code of Federal Regulations
HIPAA for Professionals | U.S. Department of Health and Human Services

Download the PDF

Close the HIPAA gaps your billing operation creates without you noticing

Enter your email and we will send the PDF.

Questions

Is this free?

Yes. Enter your email and we will send the full resource to your inbox.

Do we need a BAA with our clearinghouse?

Yes. A clearinghouse handles PHI on your behalf and is a business associate under § 160.103. The BAA must be executed before any PHI is exchanged.

Can we put a diagnosis on a patient invoice?

Only the minimum necessary to communicate the charge. Most practices include CPT and amount but exclude clinical diagnosis context. Including narrative diagnosis on a patient-facing invoice is a frequent minimum-necessary failure.