Protecting PHI in a Desktop Billing Workflow

Control access

Use individual accounts where feasible, strong authentication, screen locking, and least-necessary access for billing staff.

Protect the device and files

Maintain operating-system updates, endpoint protection, encrypted storage where appropriate, and secure disposal procedures.

Manage paper output

Collect printed claims promptly, secure staging and mailing areas, and shred or otherwise destroy unneeded PHI according to policy.

Plan for backup and recovery

Backups should be protected from unauthorized access and tested so the office knows it can restore data.

Desktop PHI safeguards

• Limit access to billing data according to job need and protect workstations from unauthorized use.
• Include local files, backups, exports, scans, and printed claims in the office’s security risk analysis.
• Use HHS HIPAA Security Rule guidance when evaluating administrative, physical, and technical safeguards for ePHI.

Local storage changes the threat model; it does not remove security duties

Keeping billing data off a vendor cloud can reduce some exposures, but the office still has to protect desktops, laptops, shared folders, exports, backups, scans, and printed claims. HHS describes administrative, physical, and technical safeguards for electronic PHI. The practical starting point is a risk analysis: identify where ePHI is created, received, maintained, or transmitted, then apply reasonable safeguards to those locations and workflows.

Sources and verification

Use the primary source below for the code set, identifier, security standard, or interoperability topic, and apply current payer/organizational rules to the actual workflow.

• HHS HIPAA Security Rule guidance

Related guides

• Building a Corrected-Claim Workflow
• Backing Up Medical Billing Data
• A Beginner’s Guide to Medical Billing