Compliance guide

HIPAA for Billing: What Every Mental Health Practice Needs to Know

HIPAA for billing means applying the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules to every claim, statement, and remittance your practice handles. If you use a billing service or clearinghouse, the rules follow the data. This guide covers business associate agreements, minimum necessary access, record requests, breach notices, and psychotherapy notes.

Get a Free Quote Schedule a Consultation

What HIPAA for billing covers in a small practice

Billing is where private information leaves your office most often.

HIPAA for billing is the set of duties that apply when your practice sends claims, posts payments, and answers payer questions. The Privacy Rule applies to health plans, clearinghouses, and providers that send health information electronically for standard transactions such as claims or eligibility checks. If you send claims electronically, the rule applies to you. The HHS summary of the Privacy Rule is short and worth reading once.

Protected health information (PHI) is identifiable information about a person's health, care, or payment for care. A claim is full of it: name, date of birth, diagnosis code, service date, and member ID. Every step of your CMS-1500 claim workflow carries PHI, and so does every payment you post from an electronic remittance advice (ERA).

Good hipaa for billing is mostly habits: who sees what, who signs what, and who acts when something goes wrong. This guide covers the federal rules only. State privacy law is a separate check, and your privacy officer or attorney has the final word. The same baseline applies to psychotherapists and psychiatrists. Unsure of a term? Check the Billing Terms Glossary.

Business associate agreements: HIPAA for billing services and clearinghouses

A billing service touches your PHI every day, so the paperwork comes first.

Do I need a business associate agreement with my billing service?

Yes. HHS lists billing and claims processing among the activities that make a vendor a business associate, so you need a written business associate agreement (BAA) before you share PHI. A clearinghouse that converts your claim into a standard format and forwards it to the payer is also a business associate. This is the core of hipaa for billing. Read the HHS guidance on business associates before you sign.

What the agreement must cover

The vendor's permitted and required uses and disclosures of PHI.
A ban on any other use or disclosure, unless the law requires it.
Under the Security Rule, safeguards for electronic PHI and a duty to report security incidents, including breaches of unsecured PHI, to you.
The same terms for any subcontractor the vendor uses, with its own BAA signed before PHI is shared.

If you learn that a vendor keeps breaking the agreement, HHS says you must take reasonable steps to fix it. If that fails, end the contract where feasible.

When you do not need one

Sending a claim to a health plan and the plan paying it. You and the plan each act for yourselves.
Disclosures to another provider for treatment.
A conduit that only transmits PHI, such as a postal service.
A financial institution that only processes payments.

Whatever vendor you pick, ask to see the BAA before you send a single claim. Learn how medical billing services fit a therapy or psychiatry practice, and what to ask.

Minimum necessary: HIPAA for billing staff access

The minimum necessary rule means each person sees only what the job needs.

HHS describes the minimum necessary standard as a duty to take reasonable steps to limit PHI uses, disclosures, and requests to the least amount needed for the purpose. Your policy should name which roles need which kinds of PHI. If someone needs the entire record, the policy must say so and give a reason.

The standard does not apply to disclosures to another provider for treatment, disclosures to the patient, uses under a signed authorization, or disclosures that other law requires. Everything else in hipaa for billing falls under it.

Minimum necessary in everyday HIPAA for billing tasks (examples only; your written policy decides)
Billing task	Usually enough	Usually too much
Submit a claim	Demographics, insurance ID, service dates, CPT and diagnosis codes	Session content or history notes
Post a payment	ERA or EOB, claim number, paid amount	The full chart
Answer a denial	Denial letter, the claim, and the pages the payer asks for	The whole chart "just in case"
Verify benefits	Name, date of birth, member ID, type of service	Diagnosis narrative
Appeal a claim	Records tied to the denied service	Psychotherapy notes

For appeal packets, send what the payer asks for and no more. Our guide to claim denials and appeals shows what a typical packet needs.

Record requests and breach notices: two clocks in HIPAA for billing

Two deadlines catch small practices off guard.

Right of access

Patients can ask for copies of the PHI in your designated record set. Under 45 CFR 164.524, HIPAA for billing includes a record request clock: you have 30 days to act. You may extend once by up to 30 days if you send written reasons and a completion date within the first 30. You may charge only a reasonable, cost-based fee for labor, supplies, postage, and an agreed summary. Psychotherapy notes sit outside this right. Ask your privacy officer which billing records belong in your designated record set.

Breach notification

A breach is an impermissible use or disclosure that compromises PHI. HHS presumes a breach unless a risk assessment shows a low probability of compromise, using four factors: what the information was, who got it, whether it was actually viewed, and how far the risk was reduced. Every hipaa for billing team should plan for this. A lost laptop with claim files, a fax sent to the wrong number, or an ERA emailed to the wrong office can all start the clock. See the HHS Breach Notification Rule page.

Breach notice deadlines under HHS rules (checked 10/10/26)
Who is told	Deadline	Notes
Affected individuals	60 days from discovery	First-class mail, or email if the person agreed; send as soon as reasonably possible
HHS, 500 or more people	Within 60 days	Filed through the HHS breach report form
HHS, fewer than 500 people	Within 60 days after the calendar year ends	Report the year's breaches together
Media, more than 500 residents of one state	Within 60 days	Usually a press release
You, from a billing vendor	Within 60 days of the vendor's discovery	Vendor should name affected people where it can

Sixty days is a ceiling. Write your BAA so your vendor tells you much sooner.

Psychotherapy notes vs billing records in HIPAA for billing

The two are different under HIPAA, and billing should never need the first.

The rule at 45 CFR 164.501 defines psychotherapy notes as notes by a mental health professional that document or analyze a counseling conversation and are kept separate from the rest of the record. The definition leaves out medication prescription and monitoring, session start and stop times, treatment modalities and frequencies, clinical test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress.

That list matters for hipaa for billing. Nearly everything a claim needs sits on the excluded side: times, modality, diagnosis, and plan. So your billing records are not psychotherapy notes. Psychiatrists should note that medication notes are not psychotherapy notes either, so they stay in the regular record.

HHS says a covered entity needs the patient's authorization to use or disclose psychotherapy notes, with narrow exceptions: the author's own treatment use, the entity's own training, defending itself in a legal action brought by the patient, an HHS compliance review, and uses required by law. Most payment uses also need authorization. Keep the notes apart, and do not upload them to a billing portal or hand them to a vendor.

7 steps to set up HIPAA for billing

Do these in order, and write each one down, so your HIPAA for billing plan holds up.

List every vendor that touches claims or patient accounts: billing service, clearinghouse, practice management software, and any outside coder.
Sign a business associate agreement with each one before PHI moves.
Write role-based access rules: who sees what, and who needs the full chart.
Keep psychotherapy notes apart from the billing record.
Set a written process for record requests, with the 30-day clock.
Write a breach response plan: who decides, who calls the vendor, and who sends notices.
Train staff, and repeat when roles or vendors change.

Add these steps to your practice management checklist so they get reviewed each year.

What to do Monday morning

Five small jobs make your HIPAA for billing plan real.

Pull a list of vendors that see claims and check that each has a signed BAA on file.
Ask who in the office can open a full chart, and remove access that the job does not need.
Confirm psychotherapy notes are stored apart from the billing record.
Write down your breach contacts and the 60-day limits where staff can find them.
Read the claims processing terms so the team uses the same words, then see how we serve psychotherapists and psychiatrists.

Frequently asked questions

What is HIPAA for billing in plain words?

HIPAA for billing is how HIPAA's privacy, security, and breach rules apply to claims, payments, and patient accounts. You limit who sees PHI, sign agreements with vendors who handle it, answer record requests on time, and report breaches when they happen.

Does my billing company need to sign a business associate agreement?

Yes. HHS lists billing and claims processing as business associate activities. You need a written agreement before PHI is shared, and the billing company needs its own agreements with any subcontractors that touch the data.

Under HIPAA for billing, can staff read psychotherapy notes?

They should not need to. Psychotherapy notes need the patient's authorization for most uses, including most payment uses. Claims run on session times, modality, diagnosis, and plan summaries, which the definition excludes from psychotherapy notes.

How long do I have to report a breach under HIPAA for billing rules?

HHS sets 60 days from discovery as the outer limit, and notice should go as soon as reasonably possible. Breaches of 500 or more people must also be reported to HHS within 60 days.

Want someone to handle claims the HIPAA-safe way every week?

Get a free, no-pressure consultation with a specialist who only works mental and behavioral health billing.