HIPAA definitions
Billing company vs clearinghouse vs practice management software under HIPAA
Billing company vs clearinghouse under HIPAA depends on what the entity does, not its name. A billing company that handles a practice’s patient data is a business associate because billing and practice management are named functions; it is a clearinghouse, which is a covered entity, only if it also converts nonstandard data into a standard transaction or the reverse. A software vendor that hosts or can access patient data is a business associate. The practice stays the covered entity. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 17, 2026. How we check our numbers.
The labels
Who is what under HIPAA's definitions
| Party | Label the texts support | What decides it |
|---|---|---|
| Party: The practice | Label the texts support: Covered entity | What decides it: A provider that sends health information electronically in a covered transaction (45 CFR 160.103). HHS said in 2000 that a provider cannot avoid the rules by giving the task to a business associate (65 FR 82462). |
| Party: Billing company | Label the texts support: Business associate; a clearinghouse only if it also translates | What decides it: Billing and practice management are listed functions of a business associate (45 CFR 160.103). HHS says a billing service is a clearinghouse only if it performs the clearinghouse functions (65 FR 82462). |
| Party: Clearinghouse | Label the texts support: Covered entity, and the practice's business associate when it works for the practice | What decides it: A covered entity may be a business associate of another covered entity (45 CFR 160.103), and HHS lists a clearinghouse that translates a claim into a standard transaction among its business associate examples (HHS guidance). |
| Party: Practice management software vendor | Label the texts support: Business associate if it hosts the practice's data or needs access to it; not one if it has no access | What decides it: HHS FAQ: hosting the software on its own server or accessing patient information to troubleshoot makes the vendor a business associate. |
| Party: A network or switch that only moves files | Label the texts support: Not a clearinghouse unless it translates; a business associate if it needs routine access to the data | What decides it: 65 FR 82462 and the HHS guidance, which says entities that access protected health information regularly to perform a service are not conduits. |
| Party: Offshore staff working in the practice's own systems | Label the texts support: They do billing and practice management work; they are not the clearinghouse or the software vendor | What decides it: Whether they are the practice’s workforce or a vendor’s people is a separate question, set out on workforce or business associate. |
The test
What makes an entity a clearinghouse
- The definition lists a billing service, a repricing company and similar entities as examples of the kind of entity it covers, then adds a test: the entity converts health information received in a nonstandard format or content into standard data elements or a standard transaction, or takes a standard transaction and converts it into a nonstandard format for the receiver (45 CFR 160.103).
- HHS wrote in 2000 that an entity that does not do format translation and data conversion is not a clearinghouse, and that billing services are often extensions of a provider’s office, primarily performing data entry of claims (65 FR 50312).
- A clearinghouse that works for a practice is still a covered entity (65 FR 82462). In that capacity only a listed set of Privacy Rule sections applies to it (45 CFR 164.500(b)); the Security Rule section read, 45 CFR 164.302, has no similar carve-out.
- The Medicare Claims Processing Manual says billing services are considered provider business associates, and describes a clearinghouse as an entity that moves EDI transactions and generally translates them (chapter 24, section 40.2.2.3, see the manual). Its parenthesis that HIPAA defines a clearinghouse as a business associate is looser than the regulation, which lists a clearinghouse as a covered entity.
Part 162
What the transaction rules ask of the practice
- A covered entity that conducts a covered transaction electronically with another covered entity must use the standard form (45 CFR 162.923(a)). When staff key data into a health plan’s web portal, the data content and conditions apply but the format does not (162.923(b)).
- A covered entity may use a business associate, including a clearinghouse, to conduct the transaction, and must require it, and its agents and subcontractors, to comply with Part 162 (162.923(c)). The regulation does not use the words “remains responsible”.
- CMS guidance letter GL-2022-03 says a provider could be held responsible for a vendor’s noncompliant actions while acting on the provider’s behalf, and also says it does not have the force and effect of law (CMS letter).
- The duty not to delay or reject a transaction because it is standard sits on health plans, not on practices (45 CFR 162.925).
| Transaction | Standard named | Section |
|---|---|---|
| Transaction: Health care claims | Standard named: X12 837 (version 5010): professional, institutional and dental | Section: 45 CFR 162.1102 |
| Transaction: Eligibility for a health plan | Standard named: X12 270/271 (version 5010) | Section: 45 CFR 162.1202 |
| Transaction: Referral certification and authorization | Standard named: X12 278 (version 5010) | Section: 45 CFR 162.1302 |
| Transaction: Claim status | Standard named: X12 276/277 (version 5010) | Section: 45 CFR 162.1402 |
| Transaction: Payment and remittance advice | Standard named: X12 835 (version 5010), with the 835 remittance advice and a NACHA format for the payment | Section: 45 CFR 162.1602 |
Retail pharmacy drug transactions use NCPDP standards and are not covered here. Two dates to watch: the final rule on claims attachments says compliance is required by May 26, 2028 (91 FR 14350), and a proposal to replace the X12 278 with HL7 FHIR implementation guides was published on April 14, 2026 (91 FR 19890). It was a proposal only when this page was written, and the eCFR still lists the X12 278.
Offshore staff
Where offshore billing staff fit
- Staff who key claims, post payments and check eligibility in the practice’s own practice management system, clearinghouse login and payer portals are doing billing and practice management work. By function they are neither the clearinghouse nor the software vendor.
- Nothing in the definitions or Part 162 sections read makes the country where a person or system sits a factor in any of these labels. Medicaid, Medicare Advantage, state contract and Department of Justice rules are separate and are covered on the HIPAA compliant offshore medical billing and restrictions pages.
- For Medicare, a provider may not share its own EDI access number and password with a billing agent or clearinghouse, which must use its own (chapter 24, section 30.1). The practice also needs a Business Associate Agreement with any vendor that touches patient data, and the vendor questions page lists what to ask.
Limits
What was not read or could not be confirmed
- Whether a practice management system’s built-in claim export or scrubbing feature counts as the translation function: no authority was found either way.
- The X12, NCPDP and CAQH CORE technical texts are paid standards and were not read; only the names, versions and dates the eCFR states were checked.
- Whether OCR or CMS has enforced 45 CFR 162.923(c) against a practice was not searched.
- Only US HIPAA text was read. The UK and Ontario rules are on their own pages.
This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- Workforce or business associate
What the HIPAA definitions say, what HHS said about contractors on site, what changes with the label and where the sources stop.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.