HIPAA Privacy and Security in the Billing and Coding Workflow

Why HIPAA Matters in Billing and Coding

Every time you assign a diagnosis code, prepare a claim, or review a remittance advice, you are handling information that belongs to a patient. The Health Insurance Portability and Accountability Act (HIPAA) sets the federal floor for how that information must be protected. Violations can result in civil and criminal penalties for your employer and for you personally. More importantly, a breach of patient privacy can cause real harm — damaged reputations, insurance discrimination, and loss of trust in the healthcare system. Understanding HIPAA is not just a compliance checkbox; it is a core professional responsibility.

The Privacy Rule: Protected Health Information

The HIPAA Privacy Rule governs the use and disclosure of protected health information (PHI). PHI is any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity (such as a physician practice, hospital, or health plan) or their business associates.

HHS has defined 18 categories of identifiers that, when paired with health information, make data individually identifiable. These include names, geographic data smaller than a state, all dates except year (for patients over 89), phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate and license numbers, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying number or code. If even one of these identifiers appears alongside health information, the record is PHI.

Covered entities may use or disclose PHI without patient authorization for treatment, payment, and healthcare operations (TPO). Billing and coding activities fall within payment and operations — this is why coders can access the clinical record to assign codes. All other disclosures generally require a valid written authorization from the patient.

Minimum Necessary Standard

Even within TPO, covered entities must apply the minimum necessary standard: access only the PHI actually needed to do the job. A coder reviewing a claim for an orthopedic procedure does not need access to a patient's psychiatric history. A biller confirming an address does not need to see operative notes. Limiting access reduces the risk of accidental disclosure and is required by the Privacy Rule.

The Security Rule: Electronic PHI

The HIPAA Security Rule applies specifically to electronic protected health information (ePHI) — PHI stored or transmitted electronically. It requires covered entities and business associates to implement three categories of safeguards:

• Administrative safeguards: policies, workforce training, risk analysis, and access management procedures.
• Physical safeguards: workstation controls, device and media controls, and facility access controls that prevent unauthorized physical access to systems holding ePHI.
• Technical safeguards: access controls (unique user IDs, automatic logoff), audit controls, integrity controls, and transmission security (encryption of data sent over open networks).

In a billing and coding office, practical examples include logging out of practice management software when stepping away from a workstation, never sharing login credentials, encrypting files before emailing them to a payer, and shredding paper that contains PHI rather than placing it in a regular trash bin.

Breach Notification

A breach is the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the information. When a potential breach is discovered, covered entities must perform a four-factor risk assessment to determine whether the incident poses a significant risk of harm to individuals. The four factors are: the nature and extent of the PHI involved; the identity of who used or received the information; whether the PHI was actually acquired or viewed; and the extent to which the risk has been mitigated.

If the risk assessment cannot rule out significant risk, the incident is a reportable breach and notification is required:

• Individuals must be notified without unreasonable delay and no later than 60 days after discovery.
• HHS must be notified; small breaches (fewer than 500 individuals) may be logged and reported annually, while breaches affecting 500 or more individuals in a state or jurisdiction require prompt HHS notification and media notice.
• Business associates must notify the covered entity promptly upon discovering a breach.

Three important exceptions exist: the breach notification rule does not apply to an unintentional acquisition by a workforce member acting in good faith within the scope of authority (if not further disclosed), an inadvertent disclosure between two authorized persons at the same entity (if not further disclosed), or a disclosure where the covered entity believes the unauthorized person could not reasonably have retained the information.

Safety and Scope-of-Practice Reminders

Coders and billers are not clinicians, but they handle the same sensitive records. Always follow your organization's policies before accessing any patient record. If you discover a potential breach, report it immediately to your supervisor or privacy officer — do not attempt to investigate or resolve it independently. Never query a patient record out of personal curiosity; workforce snooping is a common source of disciplinary action and termination. Protecting PHI is both a legal obligation and an ethical one under every professional coding credential.