HIPAA when you sell a medical billing company

A billing company is a business associate of each practice it works for. You hold patient data on your clients’ behalf, under agreements that say what you can do with it. That doesn’t stop you selling your company, but it does shape how you go about it. This is a general guide, so have a healthcare attorney look at your own situation.

During due diligence

Your Business Associate Agreements say what you may use patient data for, and showing it to someone who wants to buy your business probably isn’t on the list. So plan to keep it out completely.

A buyer can judge your business from totals: revenue by client, claim counts and denial rates. If a report has patient names, dates of birth, member IDs or anything else that could identify someone, take them out or leave that report out. Don’t give a buyer a login “just to look around”, and don’t let them watch over your shoulder while you work in an account.

When the clients move

The practices are the covered entities, so they decide who gets access to their patients’ data. A buyer needs its own Business Associate Agreement with each practice before it can touch that data.

You might be able to assign your existing BAA if it allows that, but a new agreement directly between the practice and the buyer is usually cleaner. Either way, line it up with the handover, so there’s a signed agreement in place before anyone from the buyer logs in.

Handing over access

Move people over properly during the handover:

1. The practice’s administrator creates named accounts for the buyer’s staff.
2. Your staff’s access comes off on an agreed date, account by account.
3. Clearinghouse and payer portal logins get checked, and anything in your name moves to the practice or the buyer.
4. Shared logins get retired. If you’ve been using one, this is a good moment to stop.

Keep a simple record of who had access to what, and when it ended.

The data you’ve still got

This is the part that owners forget. HIPAA requires a BAA to say that when the contract ends, the business associate will return or destroy the protected health information it still holds, if feasible. That includes old paper files, spreadsheets on your laptop, faxes and backups.

Go through what you hold for each client, and agree with each practice whether it comes back or gets destroyed. Keep written confirmation. If returning or destroying it isn’t feasible for some records, your BAA’s protections continue for as long as you hold them, so talk to your attorney.

Records you should keep

Separately, HIPAA’s security rule says required documentation has to be kept for 6 years from when it was created or last in effect. That covers things like your policies and risk assessments, and you shouldn’t throw them out just because you’ve sold. Other laws or your contracts may require other records too, so ask your attorney before you shred anything.

Past problems

If you’ve had a breach or a security incident, tell the buyer during diligence. It’s far better for them to hear it from you, and a stock sale in particular may bring that history along with it.

Also check your vendors. If you used a subcontractor who could see patient data, such as an offshore biller or a scanning service, they should have had an agreement with you, and that relationship has to end properly as well.

Questions to ask a buyer

• Will you sign a BAA with each of my clients before you get access?
• Who’d have access to my clients’ data, and where will they be?
• What safeguards do you have in place, and can you show me?
• How would you tell my clients about any of this?

Fieldstone may be a buyer in a sale like this, so read this guide with that in mind. It's general information, and it isn't legal or tax advice.