What a HIPAA compliant medical billing company actually has to do
When practices search for a HIPAA compliant medical billing company, they are usually asking four questions. Here are our answers.
| The question | Our answer |
|---|---|
| Will you sign a BAA before you touch anything? | Yes. It is inside the intake form. You sign it online before any access is granted, and you get a signed copy by email. |
| Where does our patient data go? | It stays in your practice management or EHR system. We log in with our own user accounts and work there. We do not export your patient database to our systems. |
| Who can see it? | Only the people assigned to your account, each with their own login, limited to the screens their role needs. |
| What happens if something goes wrong? | We tell you in writing within 5 business days of confirming an incident, help you assess it, and support any notification you have to make. |
The Business Associate Agreement
A Business Associate Agreement is the contract HIPAA requires between a covered entity (your practice) and a vendor that handles protected health information on its behalf (us). Ours is signed electronically as part of the intake form, in the same session as the Service Agreement, before any access is set up.
What our BAA commits us to:
- Use and disclose protected health information only to do the work you hired us for, and as the law requires.
- Apply administrative, physical and technical safeguards to protect it.
- Report any use or disclosure not allowed by the agreement, and any security incident, within the period stated in the BAA.
- Make sure any subcontractor who handles your information signs an agreement with the same obligations.
- Give you access to information you need to respond to a patient's request for their records, an amendment or an accounting of disclosures.
- Make our practices available to the Department of Health and Human Services if it asks.
- At the end of the agreement, return or destroy the protected health information we hold, and keep nothing we do not have to.
You can read the full BAA before you sign it. If your counsel wants changes, send them and we will respond in writing.
Where your data lives and how we reach it
It stays in your system. We bill inside Kareo/Tebra, AdvancedMD, athenahealth, DrChrono, SimplePractice, TherapyNotes and other practice management systems. Your practice owns the system and the data in it. If you leave us, you remove our logins and nothing has to be handed back, because nothing left.
Named user accounts. Every team member on your account has their own login in your system. No shared passwords. You can see in your own audit log who did what and when, and you can remove any user at any time.
Minimum necessary. Each role sees only what it needs. A payment poster does not need clinical notes. A credentialing coordinator does not need patient ledgers. Access is set by role and reviewed quarterly.
What we do store. Working files such as your status sheet, weekly reports and credentialing documents. These are kept on encrypted, access-controlled systems, with multi-factor authentication on every account. Clearinghouse and payer portal access is under named accounts with the same controls.
Emailing us. Please do not email patient information. If you need to send us something that contains it, use the secure upload link in your onboarding email, or ask your account lead for one.
The safeguards, in plain terms
HIPAA's Security Rule asks for three kinds of safeguard. This is what each one looks like at Northgate.
Administrative
- A named privacy and security officer who owns this program. Pending: name and title
- A written risk analysis, reviewed annually and after any significant change.
- Written policies for access, incident response, sanctions and data retention. Staff sign them.
- HIPAA training before any access is granted, and again every year. Completion is recorded.
- Background checks for every team member before access.
- A sanctions policy. Breaking the rules has consequences up to termination.
Physical
- Work is done on company-managed devices with full-disk encryption, screen lock and remote wipe.
- No patient information is printed or kept on paper.
- Office access is controlled and visitors are escorted.
Technical
- Encrypted connections to every system we use. Encrypted storage for anything we hold.
- Multi-factor authentication on every account that can reach patient information.
- Role-based access, reviewed on a schedule and when someone's role changes.
- Logging of access to the systems we control, kept for six years.
- Automatic session timeouts and device lockouts.
- No patient information on personal devices, personal email or messaging apps.
What happens if there is a breach
We do not promise that nothing will ever go wrong. We promise what we will do if it does.
- Contain it. Remove the access or stop the process involved.
- Tell you. Written notice within 5 business days of confirming an incident that involves your information, with what we know so far.
- Assess it with you. We give you what you need to decide whether it is a reportable breach under the Breach Notification Rule: what was involved, who had access, whether it was viewed, and what was done.
- Support the notification. If patients, HHS or the media have to be notified, we help with the facts, the timeline and the cost of our part.
- Fix the cause. We write up what happened and what changed so it does not happen again, and share it with you.
Who else is involved
We do the billing work ourselves. The systems that support it, such as encrypted file storage, electronic signature, email and the clearinghouse, are provided by companies that sign Business Associate Agreements with us where they handle protected health information. We keep a list and share it with you on request.
Why we do not call ourselves "HIPAA certified"
There is no official HIPAA certification. The Department of Health and Human Services does not certify vendors, and no badge from a private company changes a vendor's legal obligations. A billing company is compliant because of what it signs and what it does every day, not because of a logo. If a vendor shows you a certification seal, ask to see their BAA, their last risk analysis date and their training records instead. Ours are available to clients on request.
Sending reports for a free billing audit
The free billing audit is designed to work from summary-level reports that contain no patient identifiers. If your export does include identifiers, the form asks you to tick a box, and a Business Associate Agreement is sent for signature before the upload field unlocks. Reports are stored encrypted, used only for the audit, and deleted 30 days after the report is delivered unless you become a client.
HIPAA questions practices ask a billing company
Is Northgate Billing HIPAA compliant?
We operate as a HIPAA business associate under a signed Business Associate Agreement with every client, work inside the client's own software, restrict access by role with individual logins and multi-factor authentication, and train every team member before they touch a record and again each year. HIPAA has no official certification, so no vendor can truthfully claim to be certified.
Do you sign a Business Associate Agreement?
Yes, with every client, before any access is granted. It is signed online inside the intake form and you receive a copy by email. You can read it in full before you sign and send redlines to your counsel if you want them.
Do you need access to our EHR?
Yes, for billing. We work inside your practice management or EHR system under named user accounts that you create and can remove at any time. We do not export your patient database. For the free billing audit, no system access is needed.
Where is our patient data stored?
In your own system, where it already is. The working files we keep, such as status sheets and credentialing documents, are stored on encrypted systems in the United States with access limited by role.
Is your staff trained on HIPAA?
Every team member completes HIPAA privacy and security training before being given access to any client system, and repeats it every year. Completion records are kept and are available to clients on request.
What happens to our data if we leave?
You remove our logins and the data stays where it always was. Any working files we hold are returned to you or destroyed as the BAA requires, and we confirm that in writing.
Last updated 12 October 2026. Reviewed by Name, Privacy and Security Officer, Northgate Billing.
Check us against any vendor
Send us the questions your compliance advisor wants answered. You get written answers from the person responsible, not a brochure. Or start with the free billing audit, which needs no system access at all.