Choosing a vendor
Ending a medical billing contract: data return, access removal and payment control
Ending a medical billing contract touches four rules. The business associate must return or destroy protected health information at termination if feasible, and HHS says it may not cut off the practice’s access during a dispute. The practice must be able to end each person’s access. A change of billing agent must be notified to the Medicare contractor in writing in advance. And the Medicare payment account must stay in the provider’s name under its sole control. No rule found sets a deadline or format for data return. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
The contract
Return or destroy, and the right to terminate
| Topic | What the source says | Source |
|---|---|---|
| Topic: Return or destroy | What the source says: At termination, if feasible, the business associate returns or destroys all protected health information it still maintains in any form and keeps no copies. If that is not feasible, the contract's protections continue and further use is limited to the purposes that make return or destruction infeasible. The rule sets no deadline and does not say who chooses between returning and destroying. | Source: 45 CFR 164.504(e)(2)(ii)(J) |
| Topic: Right to terminate | What the source says: The contract must authorize the covered entity to terminate it if the covered entity determines that the business associate has violated a material term. No cure period is written into the rule. | Source: 45 CFR 164.504(e)(2)(iii) |
| Topic: A known pattern of breach | What the source says: A covered entity that knew of a pattern of activity that was a material breach is out of compliance unless it took reasonable steps to cure the breach or end the violation and, if that failed, terminated where feasible. A business associate has the same duty toward its subcontractor. | Source: 45 CFR 164.504(e)(1) |
| Topic: No kill switch | What the source says: HHS says a business associate may not block or end the covered entity's access to protected health information it keeps for it, for example to resolve a payment dispute, and that on termination it must return the information as the contract provides, in a format that preserves accessibility and usability. The covered entity answers for the availability of its own information. | Source: HHS OCR FAQ 2074 |
| Topic: What infeasible means | What the source says: HHS explained in 2002 that return or destruction would be infeasible if other law, such as the Bank Secrecy Act, requires the business associate to retain the information. The protections then extend and use is limited to that purpose. | Source: 67 FR 53181 |
HHS’s sample business associate agreement provisions are a sample and not a rule. They offer two options, return or destruction with no copies, or retention of only what the business associate needs for its own management or legal duties, and note that the agreement could also provide for transmitting the information to another business associate of the covered entity at termination. The practice’s contract terms are described on the business associate agreement page.
After the exit
What the practice still has to be able to do
- Answer patient access requests within 30 days, with one 30-day extension in writing, so the information has to be somewhere the practice can reach (45 CFR 164.524).
- Account for disclosures over six years, including disclosures to or by business associates, so the former vendor’s disclosure log is part of what has to come back or stay reachable (45 CFR 164.528).
- End access to its systems when an arrangement with a workforce member ends. The specification is addressable, and the current text sets no time limit (45 CFR 164.308(a)(3)).
- Keep its HIPAA documentation for six years from creation or last effective date, which covers policies and records of required actions, including the terminated agreement. That period is not a medical-record rule: HHS says the Privacy Rule has no medical-record retention requirement and that State laws generally govern (45 CFR 164.316).
Medicare
Payment account, billing agent and electronic enrolment
| Item | What the text says | Source |
|---|---|---|
| Item: Paying an agent | What the text says: Medicare pays an agent that furnishes billing and collection services only under conditions that include compensation unrelated to the dollars billed or collected, and payment into an account in the provider's or supplier's name. For a physician or practitioner, a supplier, the same conditions are applied through the supplier rule. | Source: 42 CFR 424.73; 424.80 |
| Item: The payment account | What the text says: Payments may go to a bank account only if it is in the provider's name only and only the provider may instruct the bank. A billing agent may draw on funds to pay for billing services subject to the provider's instructions. The EFT form has the provider certify sole control of the account. | Source: Claims Processing Manual, chapter 1, 30.2.5 |
| Item: Changing agent | What the text says: Providers must notify the Medicare contractor in writing in advance of a change in billing agent or clearinghouse and of the date they will stop using the old one. A third party needs its own EDI number, and the provider may not share its own number and password with an agent. | Source: Claims Processing Manual, chapter 24, 30.1 and 30.2 |
| Item: Remittance advice | What the text says: The electronic remittance advice has its own enrolment form, signed by the provider, with the same advance written notice of a change in billing agent or clearinghouse. | Source: Claims Processing Manual, chapter 24, 30.4 |
| Item: Paper checks | What the text says: A provider paid by EFT cannot change back to paper checks, so moving payments means moving the account, not leaving EFT. | Source: Claims Processing Manual, chapter 24, 60.5.3 |
| Item: Billing agencies | What the text says: A billing agency is not enrolled in Medicare. It submits claims in the provider's name and number, and the provider lists the billing agents it uses on its enrolment application. | Source: Program Integrity Manual, chapter 10, 10.6.8 |
In practice
A short exit list built from those rules
- Agree the return format, the timing and the destruction certificate in the contract, because the rule sets none.
- Name the new business associate and sign its agreement before the old vendor hands information across.
- List each account the old vendor’s people hold in the EHR, payer portals and clearinghouse, and end each one.
- Give the Medicare contractor written notice, ahead of time, of the new billing agent and the stop date.
- Check that the bank account on file is in the practice’s name and that only the practice can instruct the bank.
- Keep the terminated agreement and the record of return or destruction with the HIPAA documentation.
The questions to settle before signing are in offshore medical billing vendor questions, the fee rules that affect payment control are on the medical billing percentage of collections page, and the order of the steps is in how to outsource medical billing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- Percentage-of-collections fees
How the fee works, what Medicare, Medicaid and the OIG say about paying a billing agent, and questions to ask before you sign.
- How to outsource medical billing
Five steps from choosing roles to go-live, with the compliance and cost checks in the right order.
- Medicare enrollment effective date
The later-of effective date rule, the retrospective billing window, change reporting, revalidation and deactivation, and the CAQH attestation cycle.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.