Does an outside bookkeeper need a HIPAA business associate agreement?
If an outside bookkeeper creates, receives, or has access to protected health information while doing work for your practice, they are a business associate under HIPAA. You need a signed business associate agreement in place before they start. HIPAA’s definition of a business associate specifically names accounting services, so once PHI is involved this isn’t a gray area.
The real question is whether your bookkeeper will touch PHI at all. Good bookkeeping doesn’t require patient names or diagnoses. Revenue can be recorded from deposit totals, payer summaries, and daily batch reports. Many engagements keep PHI out of the accounting records completely, and that’s the right goal.
In practice, PHI tends to show up in places owners don’t expect. Electronic remittance advice files (ERAs) list patient names, dates of service, and procedure codes alongside the payment amounts. Aging and collections reports from your billing system often show patient-level detail. Patient refunds carry a name tied to a visit. And if your bookkeeper has a login to your practice management system or EHR to pull reports, they can see PHI even if they never open a chart. That access counts, even when it’s incidental to the financial work.
Insurance reconciliation is where this comes up most often. Part of our monthly bookkeeping for practices that bill insurance is checking that what the billing system says was collected actually reached the bank. That check can usually be done with payer-level totals and deposit dates. When a gap needs to be traced back to individual claims, though, patient detail may come into view. It’s better to plan for that up front than to discover it in the middle of a cleanup.
For most practices, the sensible approach is to do both things. Set up reporting so the bookkeeper works from summary data whenever possible, and sign a BAA anyway so you’re covered when patient-level detail becomes unavoidable. The agreement should spell out how the bookkeeper may use and disclose PHI, what safeguards they’ll keep in place, how quickly they must report a breach, that any subcontractors with access agree to the same terms, and that PHI is returned or destroyed when the engagement ends.
Keep patient information out of QuickBooks Online itself. Record a refund as “patient refund” with a reference number from your billing system instead of the patient’s name. Accounting software isn’t built to hold medical information, and the less PHI living there, the smaller your exposure.
The practice carries responsibility here, not just the vendor. HHS has fined covered entities for sharing PHI with vendors who never signed a BAA. If you’re comparing firms that offer medical practice bookkeeping and tax services, ask how they handle PHI and whether they have a BAA ready to sign. A firm that works with healthcare practices regularly should answer that without hesitation. For the legal details of your specific situation, have your healthcare attorney or compliance advisor review the agreement.
A Family-Run Firm Since 1995
Let's Talk About
Your Practice
Tell us about your practice and where you could use some help.
Other Common Questions
How should a medical practice owner pay themselves: salary, distributions, or both?
It depends on how the practice is taxed. Sole proprietors and partners take draws and pay self-employment tax on profit. S-corp owners need a reasonable salary through payroll and can take the rest as distributions, but the tax savings are usually smaller than physicians expect.
Read answerHow much does bookkeeping cost for a medical practice?
Most independent medical practices pay $500 to $1,500 a month for bookkeeping, depending on providers, entities, transaction volume, and whether the books are current. Bundled with payroll and tax, solo practices typically run $750 to $1,200 a month and groups of two to six providers run $1,500 to $2,750.
Read answerShould med spa nurse injectors be W-2 employees or 1099 contractors?
In most med spas, nurse injectors should be W-2 employees. Classification depends on how the work actually happens, not what the contract says. A 1099 arrangement is only defensible when the injector truly runs an independent business.
Read answerShould a medical practice use cash or accrual accounting?
Most independent practices are best served filing taxes on the cash basis, which is simpler and only taxes money that has actually been collected. Cash numbers can hide unpaid insurance claims, prepaid memberships, and bills owed, so it helps to also review accrual-style reports for management decisions, loans, partner buy-ins, and sales.
Read answerDo optometrists have to charge sales tax on glasses and contact lenses?
It depends on the state. Most states exempt prescription eyeglasses, but frames, contact lenses, and non-prescription items are treated differently from state to state, and exam fees are generally not taxable. California has its own rule that puts the tax on the optometrist's purchases instead of the patient's bill.
Read answerWhat does it really cost to add a therapist to a group practice?
Most owners find that the true first-year cost of a new therapist runs well above the salary. Payroll taxes, benefits, paid time off, malpractice, software, and office space all add to it. The bigger expense is often the months of credentialing and caseload building before the new clinician brings in steady revenue.
Read answer
