General information about the HIPAA rules, not legal advice. Your obligations depend on whether you are a covered entity or a business associate, on your business associate agreements, and on state law.
Understanding HIPAA in Healthcare Collections
The HIPAA Privacy, Security and Breach Notification Rules, at 45 CFR part 164, set national standards for protecting health information held by covered entities - health plans, clearinghouses and most providers - and by their business associates. Collecting a patient balance is a payment activity, and a covered entity may use and disclose protected health information for payment (45 CFR 164.506). Collections is therefore permitted. How it is done is what the rules govern.
What Constitutes PHI in Collections?
When a covered entity or business associate holds it, information that identifies a patient and relates to their care or to payment for it is protected health information. In a collections file that typically includes:
- Patient names linked to healthcare services
- Dates of service, admission, or discharge
- Account numbers and medical record numbers
- Social Security numbers
- Insurance information and policy numbers
- Diagnosis codes and treatment descriptions
- Payment history and financial information
The Minimum Necessary Standard
When using or disclosing PHI, or requesting it from another covered entity or business associate, you must make reasonable efforts to limit it to the minimum necessary to accomplish the purpose (45 CFR 164.502(b)). Payment is not exempt from that standard.
For collections staff:
- Work the accounts assigned to you
- View only what the current task needs - a balance call rarely needs the diagnosis
- Share only essential details with third parties
- Avoid copying or downloading data you do not need
For systems and processes:
- Role-based access, so the minimum is enforced rather than requested
- Audit logging of PHI access
- Masking of sensitive fields where the full value is not needed
- Automatic session timeouts
Communicating With Patients
The Security Rule requires technical measures to guard against unauthorised access to electronic PHI in transit (45 CFR 164.312(e)). Encryption under that standard is "addressable": you must implement it where it is reasonable and appropriate, or document why not and what you do instead. Patients may also ask to receive communications by alternative means or at alternative locations, and a covered provider must accommodate reasonable requests (45 CFR 164.522(b)).
Practical defaults:
- Prefer a patient portal or other encrypted channel for anything that names services or diagnoses
- Keep account detail out of text messages and email subject lines
- Record each patient's preferred channel and any channel they have asked you not to use
- Keep voicemails to a name, a callback number and a request to call back
Phone communication:
- Verify identity using more than one identifier
- Confirm you are speaking with the patient or an authorised representative
- Ask before leaving messages
- Limit voicemail content to a callback request
Business Associates and Collection Agencies
A collection agency that receives PHI to collect on a provider's behalf is a business associate. Before disclosing PHI to it, the covered entity needs satisfactory assurance in a written business associate agreement (45 CFR 164.502(e), 164.504(e)).
The agreement must, among other things:
- Establish the permitted uses and disclosures
- Require the business associate to report uses or disclosures not provided for by the contract, including breaches of unsecured PHI
Due diligence before signing:
- Review the vendor's security policies and its most recent risk analysis
- Ask for any independent attestation reports it holds - a SOC 2 report is an auditor's attestation, not a certification, and HIPAA does not require one
- Confirm its workforce training
- Ask how it encrypts data at rest and in transit
Audit Trails and Documentation
The Security Rule requires audit controls that record and examine activity in systems containing electronic PHI (45 CFR 164.312(b)), and procedures to regularly review that activity (45 CFR 164.308(a)(1)).
Worth logging in a collections system:
- PHI access events
- Authentication attempts
- Data modifications
- Report generation
- File downloads and exports
- Communication history
Retention:
- Required Security Rule documentation must be kept for six years from creation or from the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)); the Privacy Rule sets the same period for its documentation (45 CFR 164.530(j))
- Medical-record retention is set by state law and is often longer
- Protect audit logs from alteration - HIPAA's integrity standard is about PHI, but a log that can be edited is not evidence
- Back up, and test recovery
Staff Training
A covered entity must train all workforce members on its HIPAA policies and procedures as necessary and appropriate for their functions (45 CFR 164.530(b)), and must have a security awareness and training program for the whole workforce (45 CFR 164.308(a)(5)).
Initial training should cover:
- The Privacy and Security Rules as they apply to the role
- Your organisation's policies
- PHI handling procedures
- Incident reporting
- Sanctions for violations
Ongoing:
- Refreshers on a schedule you set and document
- Updates when the rules or your policies change
- Role-specific modules
- Records of completion
Breach Response Procedures
Immediate steps:
- Contain the incident and stop further exposure
- Document everything known about it
- Notify the privacy officer
- Preserve evidence for investigation
Notification requirements (45 CFR 164.404 to 164.410):
- Affected individuals - every breach of unsecured PHI, regardless of size: without unreasonable delay and no later than 60 calendar days after discovery (§164.404)
- Prominent media outlets: when the breach involves more than 500 residents of a State or jurisdiction (§164.406)
- HHS, 500 or more individuals: at the same time as notice to individuals (§164.408(b))
- HHS, fewer than 500 individuals: keep a log and report within 60 days after the end of the calendar year (§164.408(c))
- A business associate - such as a collection agency - notifies the covered entity, without unreasonable delay and no later than 60 calendar days after discovery; notifying individuals, the media and HHS is the covered entity's duty unless the agreement delegates it (§164.410)
- State laws may add requirements or shorter deadlines
Documentation:
- Nature of the breach
- PHI types involved
- Who accessed the information
- Remediation steps taken
- The risk assessment
Technology Safeguards
Technical safeguards ([45 CFR 164.312](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)):
- Access control, including unique user identification (required) and automatic logoff (addressable)
- Audit controls
- Integrity controls
- Person or entity authentication
- Transmission security, with encryption addressable
Encryption at rest and in transit, multi-factor authentication and network segmentation are common ways of meeting those standards. They are choices your risk analysis should justify, not items the current rule lists by name.
Administrative safeguards ([45 CFR 164.308](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308)):
- A risk analysis and risk management (both required)
- A sanction policy
- Regular information system activity review
- A designated security official
- Security awareness and training
- Incident procedures and contingency planning
Common Compliance Mistakes
Avoid these errors:
- Discussing patient information in public areas
- Leaving workstations unlocked
- Sending PHI to personal email accounts
- Failing to verify caller identity
- Sharing login credentials
- Disposing of PHI improperly
- Taking physical documents home
Penalties for Non-Compliance
45 CFR 160.404(b)(2) sets civil money penalties in four tiers by culpability. The base amounts in the regulation text are:
- Did not know, and with reasonable diligence would not have known: $100 to $50,000 per violation
- Reasonable cause, not willful neglect: $1,000 to $50,000 per violation
- Willful neglect, corrected within 30 days: $10,000 to $50,000 per violation
- Willful neglect, not corrected within 30 days: at least $50,000 per violation
Each tier is capped at $1,500,000 for identical violations in a calendar year. Those figures are adjusted for inflation each year in the table at 45 CFR 102.3, so check the current table rather than relying on the base amounts.
Compliance Checklist
Use this checklist for your collections operation:
- Not done: Business associate agreements with every vendor that receives PHI
- Not done: Role-based access controls implemented
- Not done: Encryption decisions documented for PHI in transit and at rest
- Not done: Audit logging enabled and regularly reviewed
- Not done: Staff training completed and documented
- Not done: Written policies and procedures in place
- Not done: Incident response plan tested
- Not done: Risk analysis current
- Not done: Workstation security controls active
- Not done: Secure destruction procedures for PHI
Where ArkCloud fits
Software can make the technical safeguards structural rather than procedural. In ArkCloud RCM, designated protected health information fields are encrypted at the field with AES-256-GCM and access to PHI is written to a dedicated PHI access log. That supports your HIPAA program; it does not constitute one, and the administrative and physical safeguards above remain yours.
Conclusion
HIPAA does not stop a collections team from doing its job: payment is a permitted purpose. What it requires is that the team uses the minimum PHI necessary, works through safeguarded systems, has an agreement in place with anyone it shares PHI with, and knows exactly who to notify, and by when, when something goes wrong.
Resources
- 45 CFR part 164 on eCFR - the Privacy, Security and Breach Notification Rules
- Contact ArkCloud to talk about your collections workflow
- FDCPA compliance in healthcare collections - the other regime a collections team works under
- Healthcare collections best practices - where these requirements meet day-to-day operations
