How do I ensure my claim submission workflow with revenue cycle management software is HIPAA compliant?

To keep a claim submission workflow HIPAA compliant when using revenue cycle management (RCM) software, focus on privacy, security, access control, and vendor management. Here’s a practical checklist:

1) Use only HIPAA-ready vendors

• Make sure the RCM software vendor will sign a Business Associate Agreement (BAA).
• Confirm any connected services also sign BAAs, including:
  • clearinghouses
  • billing companies
  • cloud hosting providers
  • support/maintenance vendors with PHI access

2) Limit access to the minimum necessary

• Give users access only to the PHI they need for their job.
• Use role-based access control for billing staff, coders, supervisors, and auditors.
• Review permissions regularly and remove access quickly when staff change roles or leave.

3) Require strong authentication

• Use unique user IDs for every employee.
• Enable multi-factor authentication (MFA) wherever possible.
• Enforce strong password rules and session timeouts.

4) Protect PHI in transit and at rest

• Ensure claims data is encrypted:
  • while stored in the RCM system
  • while transmitted to clearinghouses/payers
• Use secure protocols like TLS for transmissions.
• Avoid sending PHI by unencrypted email or unsecured file transfer.

5) Log and monitor activity

• Turn on audit logs for:
  • claim creation
  • edits
  • submissions
  • access to patient records
  • exports/downloads
• Review logs for suspicious activity and unauthorized access.

6) Establish written policies and training

• Maintain HIPAA policies for:
  • claim submission
  • data access
  • remote work
  • incident reporting
  • device use
• Train staff regularly on:
  • handling PHI
  • phishing awareness
  • secure claim workflows
  • what to do if PHI is sent incorrectly

7) Verify secure claim transmission workflows

• Use approved, secure interfaces for claims submission.
• Validate that EDI transactions (like 837 claims) are sent through secure channels.
• Avoid exporting PHI to spreadsheets or local files unless necessary and protected.

8) Have an incident response plan

• Define how to respond to:
  • misdirected claims
  • unauthorized access
  • ransomware
  • lost/stolen devices
  • vendor breaches
• Know how to assess whether an incident is a reportable breach under HIPAA.

9) Control devices and remote access

• Require device encryption on laptops and mobile devices.
• Use endpoint protection and patch management.
• If staff work remotely, require secure VPN or approved secure access methods.

10) Perform periodic risk assessments

• HIPAA requires a regular security risk analysis.
• Review risks specific to claim submission workflows, such as:
  • exposed PHI in attachments
  • weak permissions
  • insecure integrations
  • outdated software
  • shared accounts

11) Minimize PHI when possible

• Only include the PHI needed for billing and claims purposes.
• Don’t store unnecessary clinical details in billing notes or attachments.
• Retain records according to your legal and business retention rules, then securely dispose of them.

12) Make sure integrations are secure

If your RCM software connects to an EHR, practice management system, clearinghouse, or payer portal:

• confirm secure APIs and authentication
• restrict data flows to what’s necessary
• test for misconfigurations
• document who is responsible for each system

Practical HIPAA compliance checklist for claim submission

Before going live, confirm:

• BAA signed with every vendor touching PHI
• MFA enabled
• Role-based access configured
• Encryption in transit and at rest verified
• Audit logs enabled and reviewed
• Staff trained
• Incident response plan documented
• Risk assessment completed
• Secure claim transmission tested
• Offboarding/access removal process in place

Important note

HIPAA compliance depends not just on the software, but on how your organization uses it. A “HIPAA-compliant” vendor does not automatically make your workflow compliant.

If you want, I can also give you:

1. a HIPAA compliance checklist for RCM workflows,
2. a sample policy for claim submission, or
3. a vendor due diligence questionnaire.