Business Associate Agreement Requirements for Ambulance Billing Companies

An ambulance billing company may handle patient identifiers, transport details, diagnosis codes, and claim information. When it performs billing or claims work involving protected health information (PHI) on behalf of a HIPAA covered entity, the parties generally need a written business associate agreement (BAA) that sets out how that information may be used and protected. HHS guidance on covered entities and business associates explains when these relationships trigger HIPAA obligations.

When an ambulance billing company needs a business associate agreement

An ambulance provider may be a HIPAA covered entity if it meets the applicable definition, including by conducting certain covered electronic transactions. If that provider hires an outside company to perform billing or claims processing that involves PHI on the provider’s behalf, the billing company generally acts as a business associate. The covered entity must obtain written assurances in a BAA or other permitted written arrangement before sharing PHI for that work.

The agreement should identify the services being performed and the PHI the billing company may receive, create, maintain, or transmit. HIPAA does not make every ambulance-related vendor a business associate; the relationship and the vendor’s role matter. HHS business associate guidance describes the contract requirement and the activities that can qualify.

What permitted uses and disclosures of PHI should the agreement define

Define the billing company’s permitted and required uses and disclosures with enough detail to guide daily work. For ambulance claims, that may include preparing and submitting claims, checking eligibility, responding to payer requests, correcting denials, and handling payment-related follow-up, when those activities are within the contracted services.

The BAA should prohibit other uses or disclosures unless the agreement permits them or the law requires them. It should also limit PHI requests, uses, and disclosures to what is reasonably necessary for the intended purpose, consistent with the covered entity’s minimum necessary policies. Any permitted use for the billing company’s own management or legal responsibilities should be expressly limited and subject to HIPAA’s conditions. HHS sample business associate agreement provisions outline required contract terms.

Which safeguards and incident reporting duties must it require

The BAA must require appropriate safeguards against uses and disclosures that the agreement does not permit. For electronic protected health information (ePHI), it must also require the business associate to comply with the applicable requirements of the HIPAA Security Rule. The parties can use the agreement to specify practical controls for access, secure transmission, workforce handling, and protecting records used for billing.

The agreement must require the billing company to report impermissible uses or disclosures, including breaches of unsecured PHI, and other security incidents. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The parties may set a shorter operational reporting deadline in the BAA so the covered entity has time to investigate and meet its own obligations; the 60-day limit is not a recommended response target. HHS Breach Notification Rule guidance explains business associate reporting duties.

How the agreement supports individual rights and compliance reviews

A BAA should explain how the billing company will help the covered entity respond to individual rights requests when the billing company holds relevant PHI. Depending on the services and records involved, the agreement may require it to make PHI available for access requests, support amendments, and provide information needed for an accounting of disclosures. The covered entity remains responsible for meeting its Privacy Rule duties to individuals.

The agreement must also require the business associate to make relevant internal practices, books, and records available to the Secretary of Health and Human Services for compliance review. It should establish how the billing company will promptly assist with document requests and inquiries about its handling of PHI. HHS guidance on required business associate agreement elements covers these record-access and individual-rights provisions.

What written obligations apply to subcontractors handling PHI

If the ambulance billing company hires a subcontractor that creates, receives, maintains, or transmits PHI on its behalf, it must obtain written assurances from that subcontractor. The subcontractor business associate agreement must impose the same applicable restrictions, conditions, and safeguards that bind the billing company for that PHI.

The billing company should identify subcontracted functions—such as claim software hosting, document storage, or outsourced payment follow-up—and ensure the written terms cover the PHI each subcontractor may handle. A vendor’s general promise to protect data does not replace the required written HIPAA obligations. HHS sample BAA provisions include the subcontractor requirement.

What termination and PHI disposition terms should the agreement include

At the end of the BAA, the agreement must require the billing company, if feasible, to return or destroy PHI received from or created or received on behalf of the covered entity. It should address both paper and electronic information, including copies held in systems used for claims, records, and backups.

If returning or destroying PHI is infeasible, the agreement must require the billing company to continue protecting it and limit further uses and disclosures to the purposes that make its continued retention infeasible. The BAA should also authorize the covered entity to terminate the agreement for a material breach, consistent with HIPAA’s contract requirements. HHS sample BAA provisions describe PHI return or destruction and termination terms.

In short, an ambulance billing BAA should define the billing work and permitted PHI flows, require appropriate privacy and security protections, set clear incident and subcontractor duties, support individual rights and compliance reviews, and specify what happens to PHI when the relationship ends.

FAQs.

Does an ambulance billing company need a business associate agreement to process claims?

Generally, yes, when a HIPAA covered ambulance provider engages an outside billing company to process claims on its behalf and the work involves PHI. The covered entity must have the required written assurances in a BAA or other permitted written arrangement. Whether HIPAA applies depends on the parties’ roles and activities.

What PHI uses and disclosures should the agreement permit?

It should permit only uses and disclosures needed for the contracted billing and claims services, such as preparing and submitting claims, resolving denials, and handling payment-related follow-up. It should restrict other uses and disclosures, require compliance with applicable law, and limit PHI to what is reasonably necessary for the intended purpose.

What incident reporting duties should the agreement require?

The agreement should require reporting of impermissible uses or disclosures, breaches of unsecured PHI, and other security incidents. For a breach of unsecured PHI, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The parties can set a shorter reporting deadline in the agreement.

What happens to PHI when the business associate agreement ends?

If feasible, the billing company must return or destroy PHI received from or created or received on behalf of the covered entity. If that is infeasible, it must continue to protect the PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.