Backing Up Medical Billing Data

Use more than one copy

Keep production data and backups on separate storage so one device failure does not destroy both.

Protect backup PHI

Backups containing patient information need the same thoughtful access controls and security treatment as production data.

Automate and monitor

A scheduled backup is better than relying on a person to remember, but someone should verify that jobs actually complete.

Test restoration

Periodically restore a sample or test environment so the office knows the backup can be used when needed.

Backup practices worth testing

• Keep more than one protected copy and avoid relying on a single workstation or removable drive.
• Protect backup files containing ePHI with access controls and security appropriate to your environment.
• Test restoration periodically; a backup is not useful if staff cannot restore the records when needed.

A backup is a recovery process, not just a copy

A useful backup plan answers three questions: what data must be recoverable, how quickly the office needs it back, and who can perform the restore. Claim files may be only one part of the record; exported spreadsheets, scanned attachments, payer response files, registration data, and licensing information may matter too. Document where those items live and which ones are included in the backup. If an office uses removable media or cloud storage, the same privacy and security analysis should cover those copies as well as the primary workstation.

Sources and verification

Use the primary source below for the code set, identifier, security standard, or interoperability topic, and apply current payer/organizational rules to the actual workflow.

• HHS HIPAA Security Rule guidance

Related guides

• A Beginner’s Guide to Medical Billing
• Medical Billing Modifiers: A Practical Introduction
• Taxonomy Codes in Medical Billing