What is HIPAA?
Also called: HIPAA compliance · protected health information · PHI
A billing company is a business associate, not a covered entity, and may use PHI only as the Business Associate Agreement permits. That agreement is not a formality — it is the instrument that defines and limits what your vendor may do with your patients' data.
The Security Rule requires an actual risk analysis, not a checklist. Ask any prospective vendor when theirs was last performed and by whom.
Where Vizora handles this
Primary sources
Where "HIPAA" is defined by the bodies that set the rules, rather than by us.
- HIPAA for professionals (opens in a new tab)
HHS Office for Civil Rights — The Privacy, Security and Breach Notification Rules in their authoritative form, including what a billing vendor is permitted to do with PHI.
- HIPAA breach portal (opens in a new tab)
HHS Office for Civil Rights — Public record of reported breaches affecting 500+ individuals. Worth searching any vendor you are about to hand PHI to.
Last reviewed August 20, 2026
Related terms
Business Associate Agreement
A Business Associate Agreement is the HIPAA-required contract between a covered entity and a vendor handling protected health information on its behalf. It defines permitted uses, mandates safeguards, sets breach notification obligations, and governs return or destruction of PHI when the relationship ends.
Minimum Necessary
The minimum necessary standard requires that uses and disclosures of protected health information be limited to the least amount needed to accomplish the purpose. It applies directly to billing operations, where the temptation to move whole charts rather than the relevant documentation is constant.
Credentialing
Credentialing is the verification of a provider's qualifications by a payer, and enrollment is the resulting contract that permits billing under that plan. The process commonly takes 90 to 180 days, and claims for services delivered before the effective date are generally not payable.
Find out what your denials are costing you
A free billing audit reviews your denial rate, AR aging and clean claim rate against industry benchmarks. Takes about two minutes to request. No sales pitch.
No setup fees · You pay when we collect · Pricing from 3% of net collections