Does HIPAA apply to my bookkeeper if they handle medical practice financial records?
Yes, HIPAA absolutely applies. If your bookkeeper sees patient names tied to billing amounts, insurance claim details, payment records from insurers, or any other financial data that includes protected health information (PHI), they are classified as a Business Associate under HIPAA. This isn’t optional or a gray area. The law is clear on this.
Before your bookkeeper accesses any of this data, you need a signed Business Associate Agreement (BAA) in place. A BAA is a legal contract that spells out how the bookkeeper will protect PHI, what they can and cannot do with it, and what happens if there’s a breach. Without a signed BAA, your practice is out of compliance the moment your bookkeeper opens a file containing patient information. Both you and your bookkeeper can face penalties if something goes wrong.
The practical impact goes beyond paperwork. A HIPAA-compliant bookkeeper needs to store your financial data in encrypted systems, transmit information through secure channels rather than regular email, and have protocols for disposing of records when they’re no longer needed. Cloud-based accounting software like QuickBooks Online generally meets encryption standards, but how files are shared between you and your bookkeeper matters just as much. Emailing a spreadsheet of patient billing data as an unencrypted attachment is a violation, even if nobody intercepts it.
Not every bookkeeper understands these requirements. Many general bookkeepers have never worked with medical and dental practices and don’t realize that handling your books creates HIPAA obligations for them. If a bookkeeper hesitates when you bring up a BAA or doesn’t know what one is, that’s a sign they aren’t prepared to work with a healthcare practice.
When evaluating a bookkeeper for your medical practice, ask directly whether they’ve signed BAAs with other healthcare clients. Ask how they store and transmit financial data. Ask what their breach notification process looks like. These aren’t unreasonable questions. Any bookkeeper experienced with healthcare accounting will expect them.
Penalties for HIPAA violations range from $100 to $50,000 per incident depending on the level of negligence, with annual maximums that can reach into the millions. Even unintentional violations carry fines. The Office for Civil Rights doesn’t distinguish between a data breach at a hospital and one at a small dental office. Your practice is held to the same standard regardless of size.
The good news is that compliance isn’t difficult once the right systems are in place. A bookkeeper who already works with healthcare clients will have secure workflows established. Experienced Phoenix bookkeepers who serve medical practices will already have BAA templates ready and know how to handle your data properly from day one. The key is making sure you address this before granting access to your financial records, not after.
Your Valley of the Sun Bookkeeper
The Next Step:
A Quick Conversation
Tell us what's going on with your books. We'll listen, ask a few questions, and give you a clear quote with no surprises.
More Questions
How do I handle patient copays and deductibles in my accounting when collected at different times?
Collect at the point of service whenever possible. When that doesn't happen, book the patient's balance as a separate accounts receivable from insurance A/R so you can track and collect it properly.
Read answerCan a landscaping business deduct the cost of a trailer and mowing equipment in the first year?
Yes. Section 179 lets you deduct the full purchase price of qualifying equipment like mowers, trailers, and trucks in the year you buy them. The 2024 limit is $1,220,000, which covers most landscaping equipment purchases easily.
Read answerHow does Arizona's Transaction Privilege Tax (TPT) work and how is it different from sales tax?
Arizona TPT is a tax on the business for the privilege of doing business in the state, not a tax on the buyer. The business owes the tax regardless of whether it gets passed on to the customer.
Read answerShould my cleaning company use cash or accrual accounting?
Cash basis works for most small cleaning companies because it's simpler and matches how payment actually flows. Consider switching to accrual if you take on significant commercial contracts with net-30 payment terms or annual contracts where cash timing doesn't match when the work gets performed.
Read answerHow should a dental practice track PPO write-offs and fee schedule adjustments?
Record every procedure at your full UCR fee, then post the contractual adjustment as a separate entry. Track those adjustments by insurance company so you can see which PPO plans are actually profitable and which ones are costing you money.
Read answerHow do I account for Medicaid reimbursement delays and denials in my practice books?
Book claims at the expected Medicaid reimbursement amount, not your billed charges. Track Medicaid A/R separately from commercial insurance so you can forecast cash flow accurately and know which claims need follow-up.
Read answer
