In-house therapy billing or a billing service

For OT, PT and SLP practice owners seeing children, adults or both: keep billing in-house when trained staff can submit, post and work denials on time; hire a service for capacity you lack. Either way the practice answers for its claims, needs business associate agreements with its vendors, and keeps payer deposits in its own account.⁠^1,2,3

Billing here means the work between a signed treatment note and money in the bank: claims, posted payments, denials, patient balances and the reports that show them. Credentialing comes first and is a separate decision, covered in the credentialing services guide; setting fees and explaining them to families is in the payment guide.

What does a billing service do for a therapy practice?

It turns finished visits into paid claims, and the scope varies more than the name suggests. CMS describes a billing service as an entity that markets claim preparation to providers and should also handle related transactions such as eligibility and claim status inquiries; it may submit claims only, or provide full financial accounting and other services.⁠⁴ Read any quote against each step below.

A service does not furnish care, write documentation, or decide what a session was worth. The code, units and diagnosis follow what the clinician did and documented, never what a payer pays more for, and a biller who thinks a code is wrong asks the clinician rather than changing it. Timed units are in the eight-minute rule guide, diagnosis codes in the ICD-10-CM guide, and the procedure code maps in the OT procedure codes guide and the speech therapy CPT codes guide.

How is a clearinghouse different from a billing service?

A clearinghouse moves and translates claim transactions; a billing service does the billing work. CMS describes a clearinghouse as moving EDI transactions for a provider or billing service, generally translating them, and often running general and payer-specific edits.⁠⁴ Under HIPAA, a health care clearinghouse is a covered entity in its own right, and the definition names a billing service among the entities that count as one when it converts nonstandard data into a standard transaction.⁠⁶

A clearinghouse working for a practice is also its business associate, since one covered entity can be another’s business associate. HHS lists a clearinghouse that translates a provider’s claim into a standard transaction among its examples, and a clearinghouse acting as a business associate may use or disclose the information only as that contract permits.⁠^6,7,16 A practice billing in-house through a clearinghouse already has a business associate, and must require it to follow the HIPAA transaction rules.⁠¹⁷

Does a billing service handle insurance credentialing too?

Only if the contract names it, and it is a different job. Medicare’s enrollment form defines a billing agency as a company or individual the practice contracts with to prepare and submit its claims, work that starts once the practice and each clinician can bill.⁠¹ Enrollment and plan credentialing run on their own rules, set out in the credentialing services guide. If one vendor does both, price and report them as two lines.

Is the practice responsible for claims a billing service submits?

Yes. Both Medicare enrollment applications, the CMS-855I for individual practitioners and the CMS-855B for groups, say that a practice using a billing agency remains responsible for the accuracy of the claims submitted on its behalf.⁠^1,5 The EDI enrollment form a provider signs before its Medicare contractor accepts electronic claims says the same: the provider is responsible for all Medicare claims submitted by itself, its employees or its agents.⁠¹⁴

OIG’s compliance guidance for physician practices, issued in 2000 and now in its archive of earlier guidance, applies the point to bills sent in a physician’s name, even when the physician had no actual knowledge of a billing impropriety.⁠¹² Responsibility does not move with the work, so keep checks the practice runs itself:

• A monthly sample of claims compared with the notes behind them: codes, units, modifiers, diagnosis and dates.
• The denial report read by reason, with the owner deciding which denials to appeal.
• Write-offs above an amount the owner sets, approved in writing before they are posted.
• No code changed without the treating clinician’s agreement, logged with the reason.

Is a therapy billing company a HIPAA business associate?

Yes, whenever it handles patients’ information for the practice, which billing always does. HIPAA defines a business associate as a person who, on behalf of a covered entity and outside its workforce, creates, receives, maintains or transmits protected health information for functions that include claims processing, billing and practice management.⁠⁶ HHS names billing and practice management among its examples, and CMS’s EDI chapter says billing services are considered provider business associates.⁠^4,7

The practice is a covered entity if it transmits health information electronically in connection with a covered transaction, and the transactions include claims and payment and remittance advice.⁠⁶ Before the company receives any information, the practice needs satisfactory assurance that it is going to safeguard it, documented in a written contract that meets the rule.⁠² The company needs the same written assurance from each subcontractor that touches the information, such as its clearinghouse or an outside coding firm, before disclosing anything to it.⁠^2,7 No such agreement is needed with the payers: a provider sending a claim and a plan paying it each act on their own behalf.⁠⁷

What must a business associate agreement with a biller include?

The terms the Privacy Rule lists, at a minimum. The contract must set out the uses and disclosures the company may make, and must require it to:⁠⁸

• Use appropriate safeguards, and comply with the Security Rule for electronic information.⁠⁸
• Report any use or disclosure the contract does not allow, including breaches of unsecured information, which a business associate must report without unreasonable delay and no later than 60 calendar days after discovery.⁠^8,18
• Bind its subcontractors to the same restrictions and conditions.⁠⁸
• Make information available when a patient asks for access to their records.⁠⁸
• At the end of the contract, return or destroy the information where feasible and keep no copies.⁠⁸
• Let the practice end the contract if the company violates a material term.⁠⁸

HHS’s sample provisions are optional language, not a required form, and note that the parties may set a stricter time for reporting a potential breach; a practice that wants to know within days writes that time in.⁠¹⁹ The practice keeps a duty of its own: if it knows of a pattern of activity by the company that materially breaches the agreement, it must take reasonable steps to cure the breach or end the violation and, if those fail, end the contract where feasible.⁠⁸

Who may receive Medicare and Medicaid payments for your claims?

The practice, in its own name, with narrow exceptions. Medicare does not pay amounts due a supplier to anyone else under a reassignment, power of attorney or other direct arrangement, except as the regulation lists.⁠⁹ One exception covers billing agents: Medicare may pay an agent that furnishes billing and collection services, always in the provider’s or supplier’s name, only when all five conditions hold:⁠^9,10

• The agent receives the payment under an agency agreement with the practice.⁠¹⁰
• The agent’s compensation is “not related in any way to the dollar amounts billed or collected”.⁠¹⁰
• The agent’s compensation is not dependent on the actual collection of payment.⁠¹⁰
• The agent acts under payment instructions the practice may change or revoke at any time.⁠¹⁰
• In receiving the payment, the agent acts only on the practice’s behalf.⁠¹⁰

CMS’s claims manual draws the line in practical terms. A payment counts as made directly to an ineligible party if that party can convert it to its own use and control before it passes through the provider’s control, and the agent conditions do not apply to an agent that merely prepares bills and does not receive and negotiate the provider’s payments.⁠²⁰ Medicare pays by electronic funds transfer, set up on Form CMS-588, into an account that must bear the enrolled provider’s name and that the provider alone controls.⁠^3,21 A provider who keeps a prohibited arrangement going after being advised of it may lose the right to receive assigned payment.⁠²⁰

Medicaid has its own version for the payments a state agency makes. The agency may pay only the provider, apart from listed exceptions; a business agent such as a billing service may receive payment in the provider’s name only if its compensation is related to the cost of processing the billing, not related on a percentage or other basis to the amount billed or collected, and not dependent on collection; and no payment may go to or through a factor that advances money against the practice’s receivables.⁠¹¹ For each Medicaid managed care plan, read the provider contract and ask the plan in writing what it requires before an agent submits or receives anything for the practice.

Medicare also needs to know who bills for you. Section 8 of the CMS-855I and of the CMS-855B is where a billing agency is listed, with the effective date of any change; an individual who reassigns all Medicare benefits to a group skips it, and the group lists the agency on its own form.⁠^1,5 Enrollment changes other than a change of ownership, an adverse legal action or a practice location change must be reported within 90 days.⁠²²

Can a billing service charge a percentage of what it collects?

Only on terms that keep Medicare and Medicaid money out of its hands, and OIG has long been wary of the model. The agent conditions bite when the service receives payment: Medicare’s manual says they do not apply to an agent that merely prepares bills, and Medicaid’s rule governs payments made to a business agent.⁠^11,20 OIG’s guidance to physician practices says percentage-based billing arrangements are not illegal per se and that a practice may contract with a billing service on that basis, but that such a service cannot receive Medicare funds directly into a bank account it solely controls; the payments belong in an account over which the provider has signature control.⁠¹² That guidance and OIG’s guidance for billing companies record a longstanding concern that percentage arrangements may increase the risk of upcoding and similar abusive billing, and warn that for a billing company that also markets the practice, a percentage arrangement may implicate the anti-kickback statute.⁠^12,23

So keep every payer’s deposits in the practice’s account, give the service read access to remittances rather than control of the money, and take the fee clause to a health care lawyer before signing, with the Medicare and Medicaid agent conditions beside it.⁠^10,11 Ask your state Medicaid agency and each commercial plan whether its own rules or agreement say anything about an agent’s fee.

How are billing service fees structured, and what does each one mean?

A quote can combine a share of collections, a fee per claim, a flat monthly fee, hourly or project charges, and setup and add-on fees. This guide quotes no market rate for any of them; what matters is what each fee counts, what it leaves out, and how it meets the payment rules above.

Ask too how a fee treats work the service did not do: a payment the front desk collected, a refund the practice owes a payer, a claim the practice resubmitted itself.

How do you compare a billing quote with in-house costs?

Price the same scope for the same period both ways: what the practice spends to do the work itself, against the vendor’s full quote plus the work the practice keeps. CMS’s advice to providers choosing an EDI or practice management vendor runs the same way: write down which parts of the practice need vendor support, consider what in-house staff could easily do, count costs such as training and conversion, and compare proposals on a weighted checklist against those requirements.⁠²⁴

Measure the in-house side rather than estimating it. Have whoever bills log their time for four weeks by task: charge entry, submission, posting, denials, statements and calls. Loaded hourly cost is pay plus payroll taxes and benefits, divided by the hours paid. The practice’s time never drops to zero with a service: someone still codes, answers the vendor’s questions, approves write-offs and reads the reports.

The startup budget worksheet holds the other monthly lines, and the rate negotiation guide covers the contracted rates every collection figure starts from.

How do you put a cost on a denied claim?

Count the work and the money separately. Every denial or adjustment on a remittance advice carries a group code assigning financial responsibility and a claim adjustment reason code giving the general reason the payment differs from the bill, from code sets every payer uses under HIPAA.⁠¹³ Sort a quarter’s denials by reason code, time a sample of each kind from first look to resolution at the loaded hourly cost, then add what each kind left unpaid or written off.

Deadlines turn slow work into lost money. A Medicare claim must be filed within 1 calendar year after the date of service, a state Medicaid agency must require claims within 12 months of the date of service, and a commercial plan’s limit is in its contract or provider manual.⁠^25,26 A Medicare redetermination request is due within 120 calendar days of receiving the initial determination.⁠²⁷ Whoever works denials needs those clocks in the system, payer by payer.

Which billing numbers should a therapy practice measure itself?

Four core numbers, defined in writing and computed the same way for staff and vendor: days in accounts receivable, first-pass acceptance, denial rate and net collection rate. This guide states no benchmark for any of them. Set your baseline from your own reports and remittances over the last two quarters, then compare each month against it.

Read each number by payer, because the programs run on different clocks. Medicare’s contractors may not finalize a clean electronic claim during a 13-day waiting period after receipt and must pay or deny clean claims within 30 days; a state Medicaid agency must pay 90 percent of clean claims from practitioners within 30 days of receipt; for a commercial plan, read the payment terms in its contract.⁠^26,28 A payer whose claims sit well past its own clock is a list of claims to open, not a statistic to report.

What reports should a practice be able to run without its biller?

The ones that show where the money is: aging by payer, the denial log by reason code, payments by payer by month, visits not yet billed, and adjustments and write-offs with who approved each. Run them in the practice’s own system, on its own login, without asking the vendor, and each month match posted payments against the deposits in the practice’s bank account.

The audit trail matters when a payer’s reviewer asks who changed a claim. HIPAA requires a unique name or number for each user and mechanisms that record and examine activity in systems holding electronic health information, which is what shows who edited a claim, a posting or a write-off, and when.⁠²⁹ Ask the vendor to show that log on a test claim before go-live; what a reviewer asks for in the record itself is in the documentation audit guide.

Who should own the billing software, the data and the logins?

The practice. Hold the practice management system and the clearinghouse account in the practice’s name, add the vendor’s staff as users with their own logins, and keep the administrator role. HIPAA’s technical safeguards already require a unique identity for every user, which a shared login defeats.⁠²⁹

Medicare is stricter still. A provider’s EDI number and password serve as its electronic signature; it may not share them with a billing agent or clearinghouse, which must obtain their own from the Medicare contractor, and the provider is liable if anyone it improperly shared them with uses them for an illegal action.⁠^4,14 A billing agent or clearinghouse may receive the practice’s Medicare remittance advice only if the practice has specifically authorized it.⁠⁴

When the vendor supplies the software, the data still belongs to the practice. HHS lists an IT vendor supporting systems that hold electronic health information among business associates, and says a business associate may not block or terminate a practice’s access to resolve a payment dispute, and must return the information as the agreement provides, in a format that keeps it accessible and usable.⁠^7,15 HHS adds that the practice remains responsible for the availability of its own information, so write the export into the contract: the format, how often, and a test export before go-live.⁠¹⁵

How do pediatric and adult practices differ when outsourcing billing?

The codes are the same at every age; the payers, their authorizations and their clocks are not. A service has to show it knows the programs your caseload uses, or the practice keeps those tasks itself.

For a pediatric practice, settle the authorization trail first: requests, approvals with their dates and visit counts, and renewals before they lapse. EPSDT coverage, prior authorization and appeals are in the EPSDT guide, and enrolling with the state and its plans in the Medicaid enrollment guide.

For an adult practice, settle the Medicare record: certification and recertification dates, each patient’s progress toward the KX threshold and the $3,000 targeted medical review threshold, and the assistant’s minutes behind each CQ or CO line.⁠^33,34 The modifiers are in the therapy modifiers guide, and coverage from the patient’s side in the Medicare therapy coverage guide. A practice seeing both ages needs both skills; ask a service to work one test claim from each part of your caseload, and keep in-house any line it cannot show.

In-house, a billing service or a hybrid: who does which step?

In-house keeps every step and every risk with your staff; a full service moves the work but not the responsibility; a hybrid splits the steps, and the split has to be written down claim by claim.

What should you ask a billing company before you sign?

Questions whose answers you can check against the payment rules, the HIPAA terms and your own numbers. CMS’s vendor guidance suggests demonstrations from two or three vendors, reference checks, and asking the vendor’s current clients about problems and how long start-up took, with every agreement in writing.⁠²⁴

Score the answers against the contract checklist below, not the sales call. The answer that passes question 3 is “your account, which only you control”, and to question 9, “yes, and never”.⁠^3,14

What should a billing service contract spell out?

Every step by payer, the fee and what it counts, where the money goes, who may touch which system, how fast each step happens, and how the relationship ends. A blank left open is a term the vendor sets later.

• Scope: each step from the step table, each payer, and what is excluded, such as old claims, later appeals or authorizations.
• Fee: the model, what it counts, add-ons, and what is owed on payments after the end date.
• Deposits: every payment to the practice’s own account, and no power of attorney over the practice’s payments.⁠^3,9
• Coding: no code, unit or diagnosis changed without the treating clinician’s agreement, and each query logged.
• Turnaround: claims out within [number] business days of a signed note, denials worked within [number] days, appeals inside each payer’s deadline.
• Reports and access: monthly reports with each measure’s formula attached; named users with their own logins; the practice as administrator.⁠²⁹
• Business associate agreement: every required term, a breach-reporting time shorter than the rule’s outer limit if you want one, and named subcontractors.⁠^8,19
• Reviews: the practice may sample claims at any time, and the vendor helps answer any payer review of claims it sent.
• Exit: the steps in the checklist below, with their dates.

How do you leave a billing service without losing claims or data?

Write the exit into the contract before signing, then run it as a project with a cut-off date. The business associate agreement already requires the vendor to return or destroy the practice’s information at the end where feasible, and HHS’s sample language notes that an agreement can have the vendor send it to the practice’s next business associate instead.⁠^8,19 When the agreement provides for return, HHS expects the information back in a format that keeps it accessible and usable.⁠¹⁵

Medicare needs notice too. Providers must tell their Medicare contractor in writing, in advance, about a change of billing agent or clearinghouse and the date they stop using one, and the enrollment’s billing agency section is updated with its effective date.⁠^1,5,14 Because deposits went to the practice’s own account all along, no payment has to be redirected.

How does the choice play out for a pediatric and an adult practice?

Differently, because the payers and the people differ. Both practices are hypothetical; their hours, wages, volumes and fees are worksheet inputs, not figures any vendor charges or any practice should expect.

The pediatric owner bought capacity for the one step that was losing money; the adult owner had the skills in-house and needed a person, not a vendor. Neither handed over the deposits, the data or the responsibility for the claims.

Does a DrSensory listing show how a clinic bills for therapy?

No. A DrSensory listing carries nothing about how a clinic codes, bills or collects, and a billing service has no role in it. Families use DrSensory free to search for occupational, physical and speech therapy clinics in all 50 states and Washington, DC. It lists clinics, not individual therapists, one listing to a practice at one address, and every clinic has a basic listing free of charge.⁠³⁵ A paid listing, $29.99 a month or $349.99 a year for the first location and $9.99 a month or $99.99 a year for each additional one, adds the clinic’s own description, logo, photos, hours and reviews with replies, and brings family inquiries to the clinic.⁠^35,36

On a paid listing, a family’s message sent from the clinic’s profile stays inside the clinic’s portal rather than landing in an inbox, since a parent’s description of a child counts as health information; the clinic answers from its own address.⁠^35,36 That reply belongs to the practice’s own staff, who can explain fees and coverage in the practice’s words: the payment guide covers what to say, and the out-of-network benefits guide the superbill for a family whose plan the practice is not in.

Sources

1. Centers for Medicare & Medicaid Services. Medicare Enrollment Application: Physicians and Non-Physician Practitioners, CMS-855I (version 05/23; Section 8, Billing Agency/Agent Information). Checked October 26, 2026.
   Show the passageHide the passage

   “A billing agency/agent is a company or individual that you contract with to prepare and submit your claims.”; “If you use a billing agency/agent you must complete this section. Even if you use a billing agency/agent, you remain responsible for the accuracy of the claims submitted on your behalf.”; “NOTE: You do not need to complete this section if you are reassigning 100% of your Medicare benefits.”; “If you are changing information about your current billing agency/agent or adding or removing a billing agency/agent information, check the applicable box, furnish the effective date, and complete the appropriate fields in this section.”.
2. 45 CFR. §164.502, Uses and disclosures of protected health information: General rules (eCFR; Title 45 up to date as of October 22, 2026; paragraph (e)). Checked October 26, 2026.
   Show the passageHide the passage

   (e)(1)(i): “A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information.”; (e)(1)(ii): “A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with § 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.”; (e)(2): “The satisfactory assurances required by paragraph (e)(1) of this section must be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of § 164.504(e).”.
3. Centers for Medicare & Medicaid Services. Electronic Funds Transfer (EFT) Authorization Agreement, Form CMS-588, and its instructions (Rev. 11/2023). Checked October 26, 2026.
   Show the passageHide the passage

   Part II: “The account to which EFT payments made must bear the name of the physician or individual practitioner, or the legal business name of the person or entity enrolled with Medicare.”; Part V: “The person or entity has sole control of the account to which EFT deposits are made in accordance with all applicable Medicare regulations and instructions.”.
4. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 24, General EDI and EDI Support Requirements, Electronic Claims, and Mandatory Electronic Filing of Medicare Claims (§40.2.2.3, Security-Related Requirements for A/B MACs, and CEDI Arrangements With Clearinghouses and Billing Services, Rev. 3346). Checked October 26, 2026.
   Show the passageHide the passage

   “A billing service is an entity that markets claim preparation services to providers and should also be able to perform related transactions for providers, such as eligibility and claim status inquiries.”; “A billing service may submit claims only, or provide full financial accounting and/or other services.”; “Billing services are considered to be provider business associates.”; “A clearinghouse transfers or moves EDI transactions for a provider or billing service, and generally translates the EDI transactions from or into a proprietary format.”; “Clearinghouses often perform general and payer-specific edits on claims, and may handle multiple types of EDI transactions for a given provider.”; “Each clearinghouse/VAN that will submit or receive Medicare EDI transactions is prohibited from using the EDI number or password issued to any of the providers they serve.”; “Their access is limited to submission of transactions and receipt of transactions for those providers that are their clients, but only if those providers authorized the billing agent and/or clearinghouse/VAN to submit or receive each transaction.”; “Likewise, the billing agent or clearinghouse/VAN cannot be sent remittance advice transactions for a provider unless specifically authorized to do so by that provider.”; “Providers must submit these authorizations to their A/B MACs, DME MACs, CEDI or other contractors if designated by CMS in writing”.
5. Centers for Medicare & Medicaid Services. Medicare Enrollment Application: Clinics/Group Practices and Certain Other Suppliers, CMS-855B (version 12/2025; Section 8, Billing Agency/Agent Information). Checked October 26, 2026.
   Show the passageHide the passage

   “A billing agency/agent is a company or individual that you contract with to prepare and submit your claims.”; “If you use a billing agency/agent you must complete this section. Even if you use a billing agency/agent, you remain responsible for the accuracy of the claims submitted on your behalf.”.
6. 45 CFR. §160.103, Definitions (eCFR; Title 45 up to date as of October 22, 2026; Business associate, Covered entity, Health care clearinghouse, Subcontractor). Checked October 26, 2026.
   Show the passageHide the passage

   A business associate is a person who, “On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing”; “A covered entity may be a business associate of another covered entity.”; business associate includes “A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.”; “Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”; “Transaction means the transmission of information between two parties to carry out financial or administrative activities related to health care. It includes the following types of information transmissions: (1) Health care claims or equivalent encounter information. (2) Health care payment and remittance advice.”; “Health care clearinghouse means a public or private entity, including a billing service, repricing company, community health management information system or community health information system, and “value-added” networks and switches, that does either of the following functions: (1) Processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction.”.
7. U.S. Department of Health and Human Services, Office for Civil Rights. Business Associates Frequently Asked Questions (FAQs) (HIPAA for Professionals; content last reviewed October 21, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   “Some examples of activities performed on behalf of a covered entity by a business associate include claims processing or administration, data analysis, billing, and practice management.”; among its examples of business associates, “IT contractor or vendor (e.g., EHR vendor, Managed Services Provider) that provides maintenance and/or support services (either in person or remotely) for information systems that require the contractor or vendor to create, receive, maintain, or transmit ePHI.” and “Health care clearinghouse that translates a claim from a non-standard format into a standard transaction on behalf of a health care provider and forwards the processed transaction to a payer.”; “A business associate must establish a BAA with its subcontractor before disclosing PHI to the subcontractor for work to be done for a covered entity.”; a BAA is not required “When a health care provider discloses PHI to a health plan for payment purposes”; “A provider that submits a claim to a health plan and a health plan that assesses and pays the claim are each acting on its own behalf as a covered entity, and not as the “business associate” of the other.”.
8. 45 CFR. §164.504, Uses and disclosures: Organizational requirements (eCFR; Title 45 up to date as of October 22, 2026; paragraph (e), business associate contracts). Checked October 26, 2026.
   Show the passageHide the passage

   (e)(1)(ii): “A covered entity is not in compliance with the standards in § 164.502(e) and this paragraph, if the covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate’s obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.”; (e)(2)(i): the contract must “Establish the permitted and required uses and disclosures of protected health information by the business associate.”; (e)(2)(ii)(B): “Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract;”; (C): “Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410;”; (D): “ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;”; (E): “Make available protected health information in accordance with § 164.524;”; (J): “At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information”; (e)(2)(iii): “Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract.”.
9. 42 CFR. §424.80, Prohibition of reassignment of claims by suppliers (eCFR; Title 42 up to date as of October 22, 2026; paragraphs (a) and (b)(5)). Checked October 26, 2026.
   Show the passageHide the passage

   (a): “Except as specified in paragraph (b) of this section, Medicare does not pay amounts that are due a supplier under an assignment to any other person under reassignment, power of attorney, or any other direct arrangement.”; (b)(5): “Medicare may pay an agent who furnishes billing and collection services to the supplier, or to the employer, facility, or system specified in paragraphs (b) (1), (2) and (3) of this section, if the conditions of § 424.73(b)(3) for payment to a provider’s agent are met by the agent of the supplier or of the employer, facility, or system. Payment to an agent will always be made in the name of the supplier or the employer, facility, or system.”.
10. 42 CFR. §424.73, Prohibition of assignment of claims by providers (eCFR; Title 42 up to date as of October 22, 2026; paragraph (b)(3), Payment to an agent). Checked October 26, 2026.
    Show the passageHide the passage

    “Medicare may pay an agent who furnishes billing and collection services to the provider if the following conditions are met: (i) The agent receives the payment under an agency agreement with the provider; (ii) The agent’s compensation is not related in any way to the dollar amounts billed or collected; (iii) The agent’s compensation is not dependent upon the actual collection of payment; (iv) The agent acts under payment disposition instructions that the provider may modify or revoke at any time; and (v) The agent, in receiving the payment, acts only on behalf of the provider. Payment to an agent will always be made in the name of the provider.”.
11. 42 CFR. §447.10, Prohibition against reassignment of provider claims (Medicaid; eCFR; Title 42 up to date as of October 22, 2026; paragraphs (b), (d), (f) and (h)). Checked October 26, 2026.
    Show the passageHide the passage

    (d): “Payment may be made only” “(1) To the provider; or”; (f): “Business agents. Payment may be made to a business agent, such as a billing service or an accounting firm, that furnishes statements and receives payments in the name of the provider, if the agent’s compensation for this service is” “(1) Related to the cost of processing the billing; (2) Not related on a percentage or other basis to the amount that is billed or collected; and (3) Not dependent upon the collection of the payment.”; (b): a factor is “an individual or an organization, such as a collection agency or service bureau, that advances money to a provider for accounts receivable that the provider has assigned, sold or transferred to the individual organization for an added fee or a deduction of a portion of the accounts receivable”; (h): “Payment for any service furnished to a beneficiary by a provider may not be made to or through a factor, either directly or by power of attorney.”.
12. HHS Office of Inspector General. Compliance Program Guidance for Individual and Small Group Physician Practices (65 Fed. Reg. 59434, October 5, 2000; section III.A, Third-Party Billing Services; listed in the CPG Archive on OIG’s Compliance Guidance page, which offers its existing CPGs “as an ongoing resource to help identify risk areas in particular industry segments”). Checked October 26, 2026.
    Show the passageHide the passage

    “Physicians should remember that they remain responsible to the Medicare program for bills sent in the physician’s name or containing the physician’s signature, even if the physician had no actual knowledge of a billing impropriety.”; “Although percentage based billing arrangements are not illegal per se, the Office of Inspector General has a longstanding concern that such arrangements may increase the risk of intentional upcoding and similar abusive billing practices.”; “A physician may contract with a billing service on a percentage basis. However, the billing service cannot directly receive the payment of Medicare funds into a bank account that it solely controls.”; “The Medicare payments should instead be deposited into a bank account over which the provider has signature control.”.
13. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 1, General Billing Requirements (§01.1, Remittance Advice Coding Used in this Manual, Rev. 10236, effective August 31, 2020). Checked October 26, 2026.
    Show the passageHide the passage

    “When Medicare denies coverage or adjusts the payment amount for items or services, these actions are documented using codes reported on the provider’s remittance advice.”; “Medicare, like all other health insurance payers, uses remittance advice codes in combination to create one message. This combination includes a Claim Adjustment Group Code (Group Code) and a Claim Adjustment Reason Code (CARC).”; “Group Codes assign financial responsibility to the provider or the beneficiary”; “CARCs communicate the general reason why the payment is different from the billed amount”; “Remittance advice codes are identified in standard code sets that are used by all payers, as required by HIPAA.”.
14. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 24, General EDI and EDI Support Requirements, Electronic Claims, and Mandatory Electronic Filing of Medicare Claims (chapter Rev. 13105, issued April 10, 2025; §30.1, EDI Enrollment, Rev. 4388; §30.2, New Enrollments and Maintenance of Existing Enrollments, Rev. 13105; §30.4, ERA Enrollment Form). Checked October 26, 2026.
    Show the passageHide the passage

    §30.1: “A provider’s EDI number and password serve as a provider’s electronic signature and the provider would be liable if any entity with which the provider improperly shared the ID and password performed an illegal action while using that ID and password.”; “If providers elect to submit/receive transactions electronically using a third party such as a billing agent or a clearinghouse, the A/B MACs or CEDI must notify those providers that they are required to have an agreement signed by that third party.”; “The providers must also be informed that they are not permitted to share their personal EDI access number and password with any billing agent or clearinghouse.”; “Clearinghouse and other third party representatives must obtain and use their own unique EDI access number and password”; §30.2, the EDI Enrollment Form: “That it will be responsible for all Medicare claims submitted to CMS or a designated CMS contractor by itself, its employees, or its agents;”; “providers are obligated to notify their A/B MAC or CEDI in writing in advance of a change that involves a change in the billing agent(s) or clearinghouse(s) used by the provider, the effective date on which the provider will discontinue using a specific billing agent and/or clearinghouse”; §30.4: “Each provider that will use ERA either directly or through a billing agent or clearinghouse with Medicare must sign the ERA Enrollment Form”.
15. U.S. Department of Health and Human Services, Office for Civil Rights. May a business associate of a HIPAA covered entity block or terminate access by the covered entity to the protected health information (PHI) maintained by the business associate for or on behalf of the covered entity? (FAQ 2074; content last reviewed January 9, 2023). Checked October 26, 2026.
    Show the passageHide the passage

    “For example, a business associate blocking access by a covered entity to PHI (such as where an Electronic Health Record (EHR) developer activates a “kill switch” embedded in its software that renders the data inaccessible to its provider client) to resolve a payment dispute with the covered entity is an impermissible use of PHI.”; “Similarly, in the event of termination of the agreement by either party, a business associate must return PHI as provided for by the business associate agreement.”; “This also includes, in cases where the business associate agreement specifies that PHI is to be returned at termination of the agreement, returning the PHI to the covered entity in a format that is reasonable in light of the agreement to preserve its accessibility and usability.”; “Finally, OCR notes that a covered entity is responsible for ensuring the availability of its own PHI.”.
16. 45 CFR. §164.500, Applicability (eCFR; Title 45 up to date as of October 22, 2026; paragraph (b)(1)). Checked October 26, 2026.
    Show the passageHide the passage

    “When a health care clearinghouse creates or receives protected health information as a business associate of another covered entity, the clearinghouse must comply with:”; and, in (b)(1)(iii) and (v), “except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;”.
17. 45 CFR. §162.923, Requirements for covered entities (eCFR; Title 45 up to date as of October 22, 2026; paragraph (c), Use of a business associate). Checked October 26, 2026.
    Show the passageHide the passage

    “A covered entity may use a business associate, including a health care clearinghouse, to conduct a transaction covered by this part. If a covered entity chooses to use a business associate to conduct all or part of a transaction on behalf of the covered entity, the covered entity must require the business associate to do the following: (1) Comply with all applicable requirements of this part.”.
18. 45 CFR. §164.410, Notification by a business associate (eCFR; Title 45 up to date as of October 22, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    (a)(1): “A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity of such breach.”; (b): “Except as provided in § 164.412, a business associate shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.”.
19. U.S. Department of Health and Human Services, Office for Civil Rights. Sample Business Associate Agreement Provisions (published January 25, 2013; content last reviewed June 16, 2017). Checked October 26, 2026.
    Show the passageHide the passage

    “This is only sample language and use of these sample provisions is not required for compliance with the HIPAA Rules.”; “The parties may wish to add additional specificity regarding the breach notification obligations of the business associate, such as a stricter timeframe for the business associate to report a potential breach to the covered entity”; “The agreement also could provide that the business associate will transmit the protected health information to another business associate of the covered entity at termination”.
20. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 1, General Billing Requirements (chapter Rev. 13725, issued April 10, 2026; §30.2, Assignment of Provider’s Right to Payment; §30.2.4, Payment to Agent; §30.2.14, Correcting Unacceptable Payment Arrangements). Checked October 26, 2026.
    Show the passageHide the passage

    §30.2: “Payment is considered to be made directly to an ineligible person or organization if that person or organization can convert the payment to its own use and control without the payment first passing through the control of the provider or other party eligible to receive the payment under the exceptions in §30.2.1.”; §30.2.4(B): “The conditions for payment insure that the billing agent has no financial interest in how much is billed or collected and is not acting on behalf of someone who has such an interest, other than the provider/supplier itself.”; “The conditions specified in subsection A do not apply if the agent merely prepares bills for the provider and does not receive and negotiate the checks payable to the provider/supplier.”; §30.2.14: “A physician or other eligible recipient of assigned payment who hereafter enters into or continues such a prohibited payment arrangement may have the right to receive assigned payment revoked.”.
21. 42 CFR. §424.510, Requirements for enrolling in the Medicare program (eCFR; Title 42 up to date as of October 22, 2026; paragraph (e)). Checked October 26, 2026.
    Show the passageHide the passage

    “Providers and suppliers must” “(1) Agree to receive Medicare payment via electronic funds transfer (EFT) at the time of enrollment, revalidation, change of Medicare contractors where the provider or supplier was already receiving payments via EFT or submission of an enrollment change request; and (2) Submit the CMS-588 form to receive Medicare payment via electronic funds transfer.”.
22. 42 CFR. §424.516, Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program (eCFR; Title 42 up to date as of October 22, 2026; paragraphs (d) and (e)). Checked October 26, 2026.
    Show the passageHide the passage

    (d), for physicians, nonphysician practitioners and their organizations, 30 days for “A change of ownership;”, “Any adverse legal action; or” “A change, addition, or deletion of a practice location.”, and “All other changes in enrollment must be reported within 90 days.”; (e), for all other providers and suppliers: “All other changes to enrollment must be reported within 90 days.”.
23. HHS Office of Inspector General. Compliance Program Guidance for Third-Party Medical Billing Companies (63 Fed. Reg. 70138, December 18, 1998; footnotes 40 and 42; listed in OIG’s CPG Archive). Checked October 26, 2026.
    Show the passageHide the passage

    “For billing companies that provide marketing services, percentage arrangements may implicate the anti-kickback statute.”; “The OIG has a longstanding concern that percentage billing arrangements may increase the risk of upcoding and similar abusive billing practices.”; “Billing companies should encourage providers to make a good faith effort to collect copayments, deductibles and non-covered services from federally and privately-insured patients.”.
24. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 24, General EDI and EDI Support Requirements, Electronic Claims, and Mandatory Electronic Filing of Medicare Claims (§40.2.4.7, Provider Guidelines for Choosing a Vendor, and §§40.2.4.7.1 to 40.2.4.7.4, Rev. 2803). Checked October 26, 2026.
    Show the passageHide the passage

    “The provider should consider what services could be easily performed by their in-house staff and which might be more cost effective to obtain through a vendor.”; “The provider should create a written description of the components of its practice that need vendor support and a description of support needed so prospective vendors can design their proposals to best meet the provider’s needs.”; “Selecting a vendor must be as objective and quantitative as possible.”; “Attend demonstrations of at least two to three vendors”; “Check vendor references and ask specific questions such as:”; “Check with providers served by the vendor and ask specific questions such as:” “Have you experienced any problems with the vendor?” “How long did it take to get up and running?”; “Providers should create a checklist that compares the vendor proposals against their original requirements by assigning a relative weight to each requirement and then rating the vendor’s ability to meet each requirement based on their written proposals.”; among overall costs, “Training costs;” and “Conversion costs;”; “All agreements reached between the two parties should be obtained in writing.”.
25. 42 CFR. §424.44, Time limits for filing claims (eCFR; Title 42 up to date as of October 22, 2026; paragraph (a)(1)). Checked October 26, 2026.
    Show the passageHide the passage

    “Except as provided in paragraphs (b) and (e) of this section, for services furnished on or after January 1, 2010, the claim must be filed no later than the close of the period ending 1 calendar year after the date of service.”.
26. 42 CFR. §447.45, Timely claims payment (Medicaid; eCFR; Title 42 up to date as of October 22, 2026; paragraph (d)). Checked October 26, 2026.
    Show the passageHide the passage

    “(1) The Medicaid agency must require providers to submit all claims no later than 12 months from the date of service. (2) The agency must pay 90 percent of all clean claims from practitioners, who are in individual or group practice or who practice in shared health facilities, within 30 days of the date of receipt.”; (b): “Clean claim means one that can be processed without obtaining additional information from the provider of the service or from a third party.”.
27. 42 CFR. §405.942, Time frame for filing a request for a redetermination (eCFR; Title 42 up to date as of October 22, 2026; paragraph (a)). Checked October 26, 2026.
    Show the passageHide the passage

    “Except as provided in paragraph (b) of this section, any request for redetermination must be filed within 120 calendar days from the date a party receives the notice of the initial determination.”; (a)(1): “the date of receipt of the initial determination will be presumed to be 5 calendar days after the date of the notice of initial determination, unless there is evidence to the contrary.”.
28. Centers for Medicare & Medicaid Services. Medicare Claims Processing Manual, Chapter 1, General Billing Requirements (§80.2.1.1, Payment Ceiling Standards, Rev. 454; §80.2.1.2, Payment Floor Standards, Rev. 1472). Checked October 26, 2026.
    Show the passageHide the passage

    ““Clean” claims must be paid or denied within the applicable number of days from their receipt date”; “for clean claims received October 1, 1993, and later, if this span is 30 days or less, the requirement is met.”; “The “payment floor” establishes a waiting period during which time the contractor may not pay, issue, mail, or otherwise finalize the initial determination on a clean claim.”; “The waiting periods are 13 days for electronic claims and 26 days for paper claims.”.
29. 45 CFR. §164.312, Technical safeguards (eCFR; Title 45 up to date as of October 22, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    “A covered entity or business associate must, in accordance with § 164.306:”; (a)(2)(i): “Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.”; (b): “Standard: Audit controls. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.”.
30. 42 CFR. §438.210, Coverage and authorization of services (Medicaid managed care; eCFR; Title 42 up to date as of October 22, 2026; paragraph (d)(1)). Checked October 26, 2026.
    Show the passageHide the passage

    “(B) For rating periods that start on or after January 1, 2026, within state established time frames that may not exceed 7 calendar days after receiving the request for service.”; (d)(1)(ii): “Standard authorization decisions may have an extension to the timeframes in paragraph (d)(1)(i) of this section up to 14 additional calendar days if” “(A) The enrollee or the provider requests the extension; or”.
31. 42 CFR. §422.138, Prior authorization (Medicare Advantage; eCFR; Title 42 up to date as of October 22, 2026; paragraph (c)). Checked October 26, 2026.
    Show the passageHide the passage

    “If the MA organization approved the furnishing of a covered item or service through a prior authorization or pre-service determination of coverage or payment, or a concurrent determination made during the enrollee’s receipt of inpatient or outpatient services, it may not deny coverage later on the basis of lack of medical necessity and may not reopen such a decision for any reason except for good cause (as provided at § 405.986 of this chapter and § 422.616) or if there is reliable evidence of fraud or similar fault per the reopening provisions at § 422.616.”.
32. 42 CFR. §433.139, Payment of claims (Medicaid third party liability; eCFR; Title 42 up to date as of October 22, 2026; paragraph (b)(1)). Checked October 26, 2026.
    Show the passageHide the passage

    “If the agency has established the probable existence of third party liability at the time the claim is filed, the agency must reject the claim and return it to the provider for a determination of the amount of liability.”; “When the amount of liability is determined, the agency must then pay the claim to the extent that payment allowed under the agency’s payment schedule exceeds the amount of the third party’s payment.”; (b)(3): “The agency must pay the full amount allowed under the agency’s payment schedule for the claim and seek reimbursement from any liable third party to the limit of legal liability” when, in (b)(3)(i), “The claim is for preventive pediatric services, including early and periodic screening, diagnosis and treatment services provided for under part 441, subpart B, of this chapter, that are covered under the State plan”.
33. 42 CFR. §424.24, Requirements for medical and other health services furnished by providers under Medicare Part B (eCFR; Title 42 up to date as of October 22, 2026; paragraph (c), Outpatient physical therapy, occupational therapy, and speech-language pathology services). Checked October 26, 2026.
    Show the passageHide the passage

    (c)(2): “The initial certification must be obtained as soon as possible after the plan is established.”; (c)(4)(i): “Recertification is required at least every 90 days.”.
34. Centers for Medicare & Medicaid Services. Therapy Services (page last modified March 10, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    “Claims for services over the KX modifier threshold amounts without the KX modifier are denied. For CY 2026 this KX modifier threshold amount is: $2,480 for PT and SLP services combined, and $2,480 for OT services.”; “the MR threshold is $3,000 for PT and SLP services and $3,000 for OT services.”; “Payment for these services is at 85 percent of the otherwise applicable PFS payment amount/rate for the service, effective January 1, 2022.”; “CQ modifier: PT services furnished in whole or in part by PTAs and” “CO modifier: OT services furnished in whole or in part by OTAs.”.
35. DrSensory. DrSensory for therapists (the For Therapists hub). Checked October 26, 2026.
    Show the passageHide the passage

    “DrSensory is a directory families use free to find occupational therapy, physical therapy and speech therapy clinics”; “across all 50 states and Washington, DC”; “Every clinic keeps a basic listing at no cost.”; “The directory lists clinics rather than individual therapists, so one listing covers a whole practice at one address.”; “A paid listing adds your own description, logo, up to five photos, hours, reviews with your replies, and inquiries that come to you instead of to the DrSensory team.”; “When a family writes from your profile, the address you gave as your email for family inquiries is told that a message is waiting. The message itself is read in the portal, not sent by email, because what a parent writes about their child is health information. You reply from your own address.”; in its free-versus-paid table, messages from families on a free listing “Come to the DrSensory team, who try to forward them to the clinic; not guaranteed” and on a paid listing “Come to you, in the portal”.
36. DrSensory. Therapy Clinic Directory Pricing (the pricing page and its frequently asked questions). Checked October 26, 2026.
    Show the passageHide the passage

    “$29.99 a month or $349.99 a year for your first location, and $9.99 a month or $99.99 a year for each additional location”; “There is no contract and you can cancel at any time”; “We do not verify clinical quality.”; “We do not sell your leads.”; “you read it signed in, because what a parent writes about their child is health information, and you reply from your own address.”.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice, not legal, compliance, billing or financial advice. Payment-arrangement, contract and privacy questions belong with a health care lawyer, and its figures are hypothetical, not DrSensory data or any vendor’s prices.