Who Is Responsible When Your Billing Company Is Breached?

Short answer: both of you, in different ways, and your responsibility does not end because the failure happened somewhere else.

This comes up every time a healthcare vendor makes the news. A billing company, a transcription service, or a scheduling platform is compromised, and the practices that used it spend the following week working out what they owe their patients.

Here is how the responsibility divides.

Your vendor's obligations

A vendor handling patient information on your behalf is a business associate. Business associates are directly regulated. They must safeguard the information, and when a breach happens on their side they must notify you without unreasonable delay and no later than 60 days from discovery, under 45 CFR §164.410.

They can face enforcement directly. The Office for Civil Rights has taken action against business associates, not only against the practices that hired them.

Your obligations

Yours do not transfer. Three things remain with you.

Notifying patients. Unless your agreement says otherwise, notifying affected individuals is the covered entity's duty, which means yours. The clock and the content are set by the Breach Notification Rule, and your vendor's notification to you is the starting gun rather than the finish.

Having had an agreement in place. A signed Business Associate Agreement is required before the vendor touches the information. Discovering during a breach that the agreement was never signed, or was signed in 2019 with a company that has since been acquired, is its own finding separate from the breach.

Having assessed the arrangement. Your Security Risk Analysis is supposed to account for the risks of sending patient information outside your walls. A vendor relationship that never appeared in your assessment is a gap that predates the incident.

The part that decides how bad it gets

When OCR reviews a third-party breach, the questions tend to be the same.

• Was there a current signed agreement with this vendor?
• Did your risk analysis account for this relationship?
• What information did the vendor hold, and why did they need that much?
• How quickly did you notify once they told you?
• Do you have a record of any of this?

Notice that four of the five are answerable before an incident. The organizations that come through a vendor breach reasonably well are usually the ones that could produce those answers from a file rather than reconstruct them under pressure.

What to do this quarter

Not a project. A short list.

1. Pull every vendor that touches patient information and confirm a current signed agreement exists for each one. Include the ones you inherited and the ones that changed ownership.
2. For each, write down what data they receive and why. Anything they do not need is risk you are carrying for no benefit.
3. Confirm each agreement names a notification timeline and a contact who still works there.
4. Make sure your Security Risk Analysis reflects this list rather than a version from two years ago.
5. Decide now who at your organization makes the notification call, so that decision is not being made for the first time on the day it matters.

Step one usually takes longer than people expect, and the reason is worth knowing: agreements tend to live in whoever's filing system signed them, which is rarely one place.

A note on the 2026 rule changes

You may have seen vendors citing new HIPAA Security Rule requirements. The updated Security Rule is a proposal. It has not been finalized, and nothing in it is a requirement today. Some of what it proposes would tighten expectations around vendor oversight, so it is worth watching, but you are not behind on rules that do not yet exist.

What is true today is that risk analysis is already required, and that vendor relationships belong inside it.

If the list is longer than you thought

Most organizations find more vendors than they expected, and the tracking becomes real work somewhere around the point where renewal dates stop fitting in one person's memory.

We build Medcurity for this kind of work, including Security Risk Analysis and Business Associate tracking, with advisors available through the year rather than only at assessment time. The self-serve Security Risk Analysis starts at $499/year for organizations up to 20 staff and scales with organization size. If you want it scoped against your real vendor count, start a conversation with our team.

Whichever way you handle it, do the vendor list before you need it. It is the cheapest hour in compliance and it is the first thing anyone asks for.