Medical Billing Contract: What to Check Before You Sign

A medical billing contract should answer ten questions in writing before you sign. What does the company do? What is its fee charged on? Where do Medicare payments go? How can either side leave, and who works your accounts receivable (A/R) afterward? Who owns your data, and how does it come back? What can you audit? How are overpayments handled? What does the business associate agreement (BAA) say? And who pays when the company makes a mistake?

Those answers matter more than the sales pitch, because the contract is the part you can enforce. The HHS Office of Inspector General (OIG) told billing companies to put each side’s duties in writing. Once responsibilities are clear, “they should be formalized in the written contract between the provider and the billing company” (OIG Compliance Program Guidance for Third-Party Medical Billing Companies, 63 FR 70139, December 18, 1998). OIG now keeps that guidance in its archive, but it has issued nothing newer for billing companies.

This guide walks through the ten clauses, what good language covers and the red flags to push back on. If you have not decided whether to outsource at all, start with our comparison of in-house vs outsourced medical billing.

This article explains federal rules and common contract terms in general terms. It is not legal advice. Have a healthcare attorney review any contract before you sign it.

Key Takeaways

• Medicare holds you responsible for the claims a billing company files for you, so the contract is your main protection when the company gets something wrong.
• Define the fee base in writing: which receipts count as a “collection”, how refunds are treated and whether old A/R is included. In our example, the definition alone moves one month’s invoice by $1,080.
• Keep Medicare deposits in your practice’s name and account. Medicare lets a billing agent receive payments only under instructions you can change or revoke at any time.
• Write down how the relationship ends: notice, who works the old A/R, and a full data export in usable formats before anything is destroyed.
• The BAA covers patient information, not money. Reports, audit rights, overpayment handling, exclusion screening and who pays for errors belong in the services agreement.

Why does the written contract matter so much?

Because Medicare treats the claims as yours. Form CMS-855I is Medicare’s enrollment application for physicians and other practitioners. Its section 8 states: “Even if you use a billing agency/agent, you remain responsible for the accuracy of the claims submitted on your behalf” (Form CMS-855I, revision 05/23). Payment to a billing agent “will always be made in the name of the supplier” (42 CFR 424.80(b)(5)). When a claim turns out to be wrong, the refund request comes to the practice.

So the contract is where you set what the company must do, what it must tell you and what it owes you when its work causes a loss. OIG recommends that the contract “enumerate those functions that are shared responsibilities and those that are the sole responsibility of either the billing company or the provider” (63 FR 70139).

Before you start, ask for every document you will be asked to sign: the services agreement, each exhibit and fee schedule it refers to, any service-level terms and the BAA. Most billing relationships run on two main documents, and each has a different job.

Step 1: Pin down the scope of work

By the end of this step, you should know which tasks the company owns, which ones you keep and which cost extra. Ask for a written list of services, not a phrase like “full revenue cycle management.” Check that the list covers:

• Coding. Does the company code from your documentation, or bill the codes your clinicians choose? OIG’s guidance gives billing companies that code their own set of risk areas, so the contract should say who assigns codes.
• Claims and appeals. Submission, follow-up, and appeals up to which level.
• Payment posting, including patient payments.
• Patient statements and patient billing calls.
• Eligibility checks and prior authorizations.
• Credentialing and payer enrollment, including who updates your Medicare enrollment when you add or drop a billing agency, which section 8 of the CMS-855I asks about.
• Old A/R from before the start date.

Then check your side of the deal. The contract should say how fast you send charges and documentation, who forwards payer letters and what happens when documentation is missing. A company cannot fairly be held to a turnaround target if the contract never says when it receives your charges.

Red flag: services described only in a proposal or marketing sheet that the signed contract does not include.

Step 2: Define what the fee is charged on

The rate matters less than the base it is applied to. A percentage fee needs a written definition of “collections” that answers these questions:

1. Are patient payments taken at your front desk included, or only money from claims the company filed?
2. Are refunds and recoupments subtracted before the fee is figured?
3. Does the fee apply to old A/R from before the start date, and at what rate?
4. Are incentive, capitation or settlement payments included?
5. What happens to the fee on money that arrives after the contract ends?

Here is how far the definition can move the bill. The figures are an example, not Summit’s pricing.

Same month, same deposits and the same 6% example rate, yet the invoice runs from $5,040 to $6,120 depending on what counts as a collection. Over a year, that gap is $12,960. Ask the company to apply its definition to one of your recent months before you sign.

Also look for fees outside the rate: setup, monthly minimums, statement printing, credentialing, and termination or run-out fees. Our guide to how much medical billing companies charge compares the pricing models and shows how to turn two quotes into one effective rate.

Red flag: “collections” left undefined, or defined as every deposit into your bank account.

Step 3: Keep Medicare payments in your name and under your control

Medicare pays the practice, not the billing company. A billing agent may receive Medicare payments for you only under the conditions in 42 CFR 424.73(b)(3), which 424.80(b)(5) applies to physicians and other suppliers. The agent’s pay must not be “related in any way to the dollar amounts billed or collected” and must not depend on collection. The agent also “acts under payment disposition instructions that the provider may modify or revoke at any time.”

Those conditions apply when the agent receives the money. The Medicare Claims Processing Manual, chapter 1, section 30.2.4 says they “do not apply if the agent merely prepares bills for the provider and does not receive and negotiate the checks.”

In practice, a company paid a percentage of collections should prepare and send the claims, while Medicare deposits go into a bank account in your practice’s name. The contract should say:

• whose name is on every account that receives payer deposits, including any lockbox;
• that you control electronic funds transfer (EFT) and remittance settings with each payer and can change them at any time;
• that the company never endorses or cashes checks made out to you.

Medicare can ask to see the agreement itself. If a Medicare contractor sees evidence the conditions are not met, “the agent must document the agreement by submitting to the contractor a copy of the written agreement” (section 30.2.4.C).

Red flag: payer deposits routed to an account the company owns, or a clause that locks your payment instructions for the length of the contract.

Step 4: Read the term, renewal and termination clauses

You should be able to leave a company that is not performing without paying to get out. Check:

• Initial term and automatic renewal: how long each term runs and how much notice stops a renewal.
• Termination without cause: whether it is allowed, how much notice it takes and whether there is a fee.
• Termination for cause: what counts as cause and how long the company gets to fix a problem first. Cause is far easier to show when the contract has measurable targets, such as how fast claims go out after charges arrive, a clean-claim rate and a ceiling on A/R older than 90 days.
• HIPAA breaches: the BAA must let you end the contract if the company violates a material term (45 CFR 164.504(e)(2)(iii)). Make sure the services agreement does not charge an early termination fee in that case.
• Duties during notice: the company keeps filing claims, posting payments and working denials until the last day.

HIPAA gives you a reason to keep that exit open. If you know of “a pattern of activity or practice” by your business associate that is a material breach, you must take reasonable steps to fix it. If those fail, you must end the contract where feasible (45 CFR 164.504(e)(1)(ii)).

Red flag: a multi-year term with no exit except for cause, and “cause” defined so narrowly that it never applies.

Step 5: Decide who works your A/R after you leave

When you change companies, some claims are still unpaid. The contract should say who works them and what that costs. One common setup is a run-out period, in which the old company keeps working the claims it filed. Another is a clean handoff, in which the new company takes over the open A/R on a set date. Either can work if it is written down. Check:

• how long any run-out lasts and what fee applies to money collected during it;
• that the old company keeps working denials and appeals during the run-out, not just posting payments that happen to arrive;
• the date after which the old company stops filing new claims;
• a final A/R aging report and a list of open appeals on the last day.

If some old claims have already aged past 90 days, an A/R recovery project can work them separately from day-to-day billing.

Red flag: the company keeps a share of everything collected for months after you leave, with no duty to work the claims.

Step 6: State that the data is yours and how it comes back

The contract should say plainly that your claims data, remittances, patient account history, payer letters and reports belong to the practice. It should also say the company may not hold them back during a fee dispute.

The BAA alone will not get your data back in a usable form. HIPAA requires it to say that at termination the business associate will, “if feasible, return or destroy” the protected health information it holds (45 CFR 164.504(e)(2)(ii)(J)). Destroying the data is allowed. So the services agreement should require, before anything is destroyed:

• a full export within a set number of days after the last day;
• formats another system can load, such as standard claim (837) and electronic remittance (835) files and account histories, plus copies of payer letters;
• written confirmation of destruction only after you accept the export.

Keep that history for years. Medicare’s overpayment rule reaches back 6 years from the date a payment was received (42 CFR 401.305(f)). A False Claims Act case can be brought up to 6 years after a violation, and in some cases up to 10 (31 U.S.C. 3731(b)). The old company may be long gone when an auditor asks.

Also check whether the company may de-identify your data for its own purposes, such as benchmarking or training software. The BAA sets the uses that are allowed (45 CFR 164.504(e)(2)(i)), so ask for any such permission to be spelled out, and decide whether you want to give it.

Red flag: data returned “in the company’s standard format” with no file types named, or a per-record fee to get your own data back.

Step 7: Write in your reports and audit rights

You cannot check what you cannot see. The contract should list the reports you get each month: for example charges, payments, adjustments and write-offs, denials by reason, A/R aging by payer, and refunds. It should also give you read-only access to the billing system or clearinghouse.

It should give you the right to audit the company’s work too, yourself or through an outside reviewer, with access to claims, remittances and account notes. The BAA does not give you this right. HIPAA requires the business associate to open its books and records to the HHS Secretary (45 CFR 164.504(e)(2)(ii)(I)), not to you.

OIG’s guidance expects billing companies to share audit results and overpayment findings with their clients, and “at a minimum” to send each client a copy of their compliance program (63 FR 70139, notes 6 and 7). Ask for that compliance program before you sign, and ask who the compliance officer is. An independent medical billing audit is one way to use your audit right without asking the company to grade its own work.

Red flag: reports available only “on request” or for an extra charge, or audits limited to the company’s own internal review.

Step 8: Agree how overpayments and credit balances are handled

Billing companies often spot overpayments first, but the practice has to return them. Under Medicare’s rule, an overpayment must be reported and returned within 60 days after it is identified (42 CFR 401.305). If the company sits on a finding for a month, half that time is gone. The contract should set:

• how fast the company must tell you, in writing, about a suspected overpayment or a pattern of billing errors;
• who investigates, who prepares each refund and who approves it;
• how credit balances are tracked and reported to you, since OIG asks billing companies to keep “a complete audit trail of all credit balances” (63 FR 70145);
• what the company does if it finds what looks like a billing problem on your side. OIG’s guidance tells it to stop sending the questionable claims and notify you in writing within 30 days (63 FR 70151).

Our guide to medical billing company liability explains the 60-day clock, the pause of up to 180 days for a good-faith investigation and the 6-year lookback.

Red flag: no written notice deadline at all, or refunds sent without your approval.

Step 9: Read the business associate agreement line by line

Your billing company handles protected health information, so HIPAA requires a written BAA before it starts (45 CFR 164.502(e)). The terms it must contain are listed in 45 CFR 164.504(e)(2) and summarized in the chart near the top of this guide. Check that each one is there, including the duty to bind any subcontractor that touches your patients’ information to the same terms.

Those terms are a floor, not a ceiling. The breach deadline is the clearest example. A business associate must notify you “without unreasonable delay and in no case later than 60 calendar days after discovery” (45 CFR 164.410(b)). If the company acts as your agent, its discovery of a breach can count as yours, which starts your own 60-day clock to notify patients (45 CFR 164.404(a)(2)). Ask for a much shorter notice period in the BAA, such as a few business days, plus prompt word of security incidents that may not turn out to be breaches. For the rest of your HIPAA program, see our HIPAA compliance checklist.

Red flag: a template BAA that still allows the full 60 days for breach notice and says nothing about subcontractors.

Step 10: Decide who pays when the company makes a mistake

When a billing error costs money, Medicare and other payers recover it from the practice, because the claims were paid in your name. Your only route back to the company is the contract. Check:

• Indemnification. Does the company cover losses caused by its own errors, such as refunds with interest, penalties tied to its conduct and the cost of answering an audit?
• Limitation of liability. Many contracts cap what the company owes. If the cap equals a few months of fees, compare it with a refund that could reach back 6 years.
• Insurance. Ask for proof of professional liability (errors and omissions) and cyber coverage, and for notice if either lapses.
• Exclusion screening. OIG lists “billing and accounting” among the services a person excluded from federal health care programs may not provide, unless the work is wholly unrelated to those programs. OIG recommends that providers screen billing or coding contractors, or “validate that the contractor is conducting such screening,” for example by keeping its screening records. It updates its exclusion list monthly, so monthly screening “best minimizes potential overpayment and CMP liability” (OIG Special Advisory Bulletin on the Effect of Exclusion, May 8, 2013). Write monthly screening of everyone on your account, with copies of the results, into the contract.

Red flag: a cap of one month’s fees, or a clause that excludes billing errors from the company’s liability altogether.

Medical billing contract checklist

How Summit Billing Solutions works with practices

Summit Billing Solutions was founded in 2023. It is headquartered in Salem, New Hampshire, and serves practices in all 50 states. We sign a business associate agreement with every practice before we handle any patient information, and we work inside your existing EHR and practice management system, in any specialty. Our first-pass claim rate is 95% to 98%. Our medical billing services page sets out the full scope.

Frequently Asked Questions About Medical Billing Contracts