Questions to Ask Before Hiring a Biller: What to Listen For

Somewhere in your next vendor call, a billing company is going to say a version of this sentence:

Four load-bearing words, and not one of them is self-defining.

Denials can mean posting an adjustment and moving on. It can mean one resubmission. Or it can mean a documented phone call to the payer, a corrected claim, a reconsideration, and two levels of formal appeal with the filing deadline tracked plan by plan.

Reporting can mean a monthly aging PDF. Or it can mean claim-level access to the original remittance, with every user action timestamped.

Everything else may still leave your front desk verifying benefits, chasing authorizations, and fielding patient billing calls.

And collections, the word your entire fee is calculated against, can mean money the vendor caused to be paid. Or it can include payments a patient hands your receptionist, money that arrives on claims the vendor never submitted, and balances that were already aging before it started.

That is the real reason the usual list of questions to ask before hiring a biller doesn't help much. The questions are fine. The problem is that every one of them can be answered with a confident generality, and you have no way to tell a confident generality from a real operating commitment. The vendor across the table has had this conversation four hundred times. You have had it twice. That is not a knowledge gap you should feel bad about; it is a preparation gap, and it closes in about fifteen minutes.

So this is not another checklist. For each question below you get why it separates vendors, what a strong answer actually sounds like, what an evasive one sounds like, and the specific document, export, or live demonstration that verifies it. We are a billing company; we answer these questions on sales calls ourselves. That includes the last section, which collects the questions we would least like to be asked - the ones about published proof, verifiable references, and how deep the bench really goes. A buyer guide that quietly omits the questions its own author would struggle with is not a buyer guide. It is an advertisement with a table of contents.

Before the call, know your own numbers

If you walk into the first conversation without a baseline, the vendor will define success using the metrics it already performs well. Everything after that is a negotiation you have already lost.

Pull these before you talk to anyone:

• Payer mix, provider count, and location count
• Claim volume and gross charges, monthly, for the last twelve months
• Current collections, and days in A/R with the full aging buckets
• Initial denials, broken out by payer and by reason
• Write-offs, by category and by who approved them
• Open A/R by status: unsubmitted, rejected, denied, appealed, paid-but-underpaid, patient balance
• Credentialing gaps, including any provider not fully enrolled or linked to the group
• Your current EHR, clearinghouse, EFT and ERA setup, and patient payment processor
• What your own staff currently spends on billing work, by role, in hours per week
• Upcoming contract renewal dates and any near-term timely-filing deadlines

You do not need these numbers to be perfect. You need them to exist, so that when a vendor tells you your denial rate is "about average," you can ask which of your payers it is average for.

How to tell a real answer from a rehearsed one

Before the specific questions, the pattern. Strong answers to completely unrelated questions share the same six markers, and once you can hear them you can evaluate questions nobody thought to write down.

A real answer is specific - it names a system, a queue, a report, a role. It assigns ownership to a person or a named position rather than to "the team." It has timestamps: a first-action window, a follow-up cadence, a deadline. It points to traceable evidence you could go look at. It states its own exceptions, because anyone who has actually run this work knows where their process stops. And it comes with a willingness to put it in writing as a contract exhibit or a service level, which is the single fastest test of whether an answer was operational or decorative.

An evasive answer has a recognizable shape too. It substitutes adjectives for mechanisms: aggressive follow-up, proactive reporting, dedicated account management. It uses the passive voice about work that a specific human either does or does not do. And it treats a category word as if it were a commitment.

It also helps to grade questions by consequence rather than treating all sixty as equal:

• Non-negotiable. Failure creates legal, cash-control, data-access, or continuity risk. No amount of good service compensates.
• Performance differentiator. This is what separates a claims-submission shop from an accountable revenue-cycle operator.
• Context-specific. Important when that service is in scope, whether that is credentialing, coding, patient collections, behavioral health authorization, or aged A/R recovery.

What actually goes wrong after you hire a billing company

None of what follows was invented at a whiteboard. Each question is reverse-engineered from something practices report going wrong after they signed. The accounts below come from practitioner forums, so treat them as failure modes rather than as prevalence data. They tell you what can happen, not how often it does.

Read down that table and a pattern emerges that has nothing to do with effort. Almost every failure is a definition failure. Someone used a word, the buyer heard one meaning, the vendor operated another, and the gap only became visible in the aging report ninety days later.

What a billing company owns, and what your staff still does

What exact stages will you own, and where does your responsibility begin and end?

Non-negotiable. "Full service" is not a standardized term. A vendor can submit claims and still exclude coding, eligibility, authorization, appeals, patient statements, underpayment recovery, credentialing, and aged A/R. The reason the HHS Office of Inspector General maintains compliance guidance specific to third-party billing companies is precisely that these firms occupy very different roles, and its general compliance guidance assumes those roles are assigned in writing rather than assumed.

A strong answer is a stage-by-stage responsibility matrix (who is responsible, who approves, who is consulted, who is merely informed) covering intake data, eligibility, authorization, charge capture, coding, scrubbing, submission, rejections, posting, denials, appeals, A/R, patient balances, underpayments, refunds, reporting, credentialing, and compliance escalation. A weak answer is "we handle everything," or a services list with no owner, no trigger, and no turnaround time attached to any line.

Ask for that matrix as a contract exhibit, then walk one encounter with them from scheduling through zero balance and see whether the matrix survives contact with a real claim.

After go-live, what will our own staff still do every day and every week?

Performance differentiator, and the most under-asked question in the category. The hidden cost of outsourcing is residual labor. One solo therapist described paying roughly six percent while still sending weekly spreadsheets, looking up claim status, and reporting patient payments, and receiving a monthly aging report in return. Another put the standard bluntly: at eight percent, you should not still be doing billing on the back end.

You want a written practice-side task list by role, with frequency, prerequisites, and an escalation point, and a vendor that distinguishes clinical judgment (yours, always) from administrative work (negotiable). "Very little" is not an answer. Ask them to estimate your internal hours by front desk, clinician, manager, and finance, then compare that estimate to what your staff spends today. If the vendor's number is lower than yours and they cannot say which specific task disappeared, the work did not disappear.

Who decides whether a claim is supportable?

Non-negotiable. Submission, coding, and clinical documentation review are three different functions, and outsourcing the first does not transfer responsibility for the last. You remain accountable for what your records support. A strong answer separates clinician documentation duty, coder validation, query workflow, audit escalation, and final authority, and contains no promise to "maximize" anything beyond what the documentation carries. "Our software codes everything" and "we guarantee the highest reimbursement" are both answers you should write down verbatim and show to your attorney.

Which services are explicitly outside scope?

Non-negotiable, and the fastest question in the whole list. Excluded work is where disputes start: prior authorization, secondary claims, workers' compensation, attorney liens, refunds, patient calls, collection placement, payer enrollment, coding, audits, takebacks, records requests. You want a plain exclusion schedule with an option and a price for each add-on. What you do not want is a broad services paragraph paired with a contract that lets the vendor reclassify work as "additional" later. Compare the proposal, the fee schedule, the statement of work, and the termination section against each other; contradictions between those four documents are common and they are always resolved in the vendor's favor.

The word in that scope list that hides the most variation, by a wide margin, is the next one.

Denial management: where proposals stop matching reality

What does "denial management" include in your proposal?

Non-negotiable. The phrase spans an enormous range of actual work. A strong answer defines rejection correction, corrected claims, reconsiderations, formal appeals, payer calls, documentation requests, clinical escalation, appeal levels, follow-up cadence, deadline control, root-cause coding, and the rules that close a claim. "We aggressively work denials," with no statuses, no deadlines, no call evidence, and no appeal levels, means somebody will resubmit once and then adjust.

The two complaints that recur most often when practices go looking for a replacement are worth quoting almost exactly as they get written: denials being worked but not resolved, and reports being sent but not translated into action. Both describe activity without accountability, and both are invisible until you ask what closes a claim.

Show us one denial, from the remittance to final disposition

This is the single most useful thing you can ask, and it is the question we would build a whole sales call around if buyers asked it more often.

When a payer processes a claim it sends back an electronic remittance advice, the 835 in the standard's language, carrying claim adjustment reason codes and remark codes that explain what happened. Most practice management systems summarize that file into a short status. The summary is where the information dies. Whether a vendor opens the original remit is the difference between a claim that gets fixed and a claim that gets closed.

So ask them to walk you through one de-identified denial end to end:

• The remit arriving, and how the reason code was categorized
• Who owned it, and what the first-action window was
• Whether it went to a corrected claim, a reconsideration, or a formal appeal
• What the payer said on the phone, and what reference number they got
• When it resolved, and how
• What changed upstream so it would not happen again

A dashboard screenshot is not an answer to this question. Neither is a case study. You want the claim history, with timestamps and attachments, for a claim that was genuinely difficult. A serious operation can produce one in a few minutes and will enjoy doing it. Our own writing on why mental health claims get denied exists because that trail is where the actual work is, and it is the part that never fits on a capabilities slide.

Two live tests are worth giving every finalist, using the same de-identified scenarios so the answers are comparable:

The vague non-covered denial. The system summary says "non-covered" and nothing more. Ask where the original remit and its reason codes appear in their workflow, what triggers a policy lookup or a payer call, where the call reference and the representative's answer get stored, and how the team chooses between an appeal, a corrected claim, a patient balance, and an adjustment. This tests the exact failure practices describe most often: claims adjusted at face value because nobody opened the remit.

The wrong-payer routing error. A behavioral health claim went to the medical plan instead of the carved-out behavioral administrator, a common structure where mental health benefits are managed by a separate company from the one on the insurance card. It is now approaching the filing deadline. Ask:

• How do they identify the correct administrator and payer ID?
• How do they preserve proof of timely filing?
• Do they correct, redirect, or appeal?
• Who updates the front-end verification workflow?
• How do they find every other patient affected by the same routing rule?

That last question is the one that separates a claim fixer from an operator. We wrote up how this plays out across behavioral health billing for the same reason.

What balances are too small, too old, or too costly for you to work?

Non-negotiable, and almost nobody asks it. A vendor protects its own margin by ignoring low-dollar denials while you pay for "full service." Worse, a $28 balance repeating across four hundred claims is not a small problem; it is a systemic leak wearing a small disguise.

A strong answer: no unilateral adjustment, a documented threshold policy that you approved, aggregation of recurring low-dollar causes into a root-cause item, and explicit exceptions for timely filing, compliance, or pattern risk. A weak answer is "we use professional judgment," with no report and no approval step. Ask for an adjustment export by amount, reason, payer, provider, code, user, and authorization, and ask who in their organization can zero a balance without you seeing it.

How do you track filing and appeal deadlines by payer and plan?

Non-negotiable, because deadlines are the one failure mode with no remedy. Medicare fee-for-service generally uses a one-calendar-year claim filing period, and its first two appeal levels run on separate deadlines - 120 days to file a redetermination and 180 days for a reconsideration. Those are Medicare rules specifically. Medicare Advantage, Medicaid, and commercial plans run on their own contractual windows, and a vendor that quotes you one universal deadline has just told you it does not track them.

You want a payer and plan matrix with a source link and a last-verified date, claim-level deadline tracking, retained proof of filing, and escalation before the deadline rather than a report after it.

How do you turn denial work into prevention?

Performance differentiator. Appeal volume can look like productivity while the same front-end error keeps generating claims. HFMA's framework for standardizing denial metrics exists to let you track occurrence and resolution as separate things, which is the only way to see the difference.

Ask for monthly root-cause analysis cut by payer, provider, procedure code, location, reason code, authorization, credentialing, registration, and documentation, with an assigned corrective action, an owner, and a re-measurement date. "Here are your top five denial reasons" is a report. "Here is denial reason three, here is the registration field that causes it, here is who changed it in March, and here is the volume since" is prevention.

While you are there, ask whether they identify underpayments at all, or only unpaid claims. A paid claim can still be wrong. Underpayments hide inside contractual adjustments, stale fee schedules, bundling logic, and provider linkage errors, and a vendor that treats every paid claim as resolved will never find them.

A vendor can do every bit of this well and still cost you more than the one charging two points more. That depends entirely on the next section.

Billing fees: what the percentage is calculated against

Your fee is a percentage of exactly what?

Non-negotiable. This is the question that decides your real price, and the rate is not it.

"Collections" is not a defined term. It can include payer EFTs, patient card payments, settlements, capitation, old A/R, and money that arrives at your office without the vendor touching it. A publicly posted 2026 agreement defines net collections broadly enough to include receipts paid directly to the client, and continues fee attribution after termination. Another publicly posted agreement sets its percentage against a narrowly defined net collections figure instead. Same word. Very different invoices.

A strong answer is a formula that names included and excluded receipt types, dates of service, posting period, refunds, recoupments, credits, bad checks, and attribution rules. "A percentage of net collections," with no definition of net, is not a fee - it is a placeholder.

Two follow-ups that flush out the rest of it. First: do you charge on money we collect directly, on claims you did not submit, or on our existing aged A/R? Narrow attribution tied to defined services and claim ownership is the good answer; "any receipt on the account is commissionable" is the one that shows up later as a surprise. Second: how are refunds, recoupments, reversals, chargebacks, and bad checks handled in the calculation? Without a netting period, you will pay commission on money that goes back to a payer. Ask them to calculate a sample overpayment and a payer takeback in front of you.

What is in the base fee, and what is billed separately?

Non-negotiable. Public agreements carry separate line items you would never predict from a proposal. One lists $650 for bank changes, $650 for Medicare 855B enrollment work, $400 for Blue Cross applications, $300 for Medicaid, and $200 per commercial enrollment; another adds a fee for virtual card payments, a payment method you do not control.

Ask for one itemized schedule covering setup, interfaces, clearinghouse, statements, postage, payment processing, credentialing, coding, audits, aged A/R, patient collections, records requests, custom reports, and termination support. Then require written confirmation that anything not on that schedule needs your advance written approval. "No hidden fees" is a marketing sentence, not a schedule.

Ask about minimums in the same breath - monthly, per provider, per claim, or minimum contract value, and model a low month, an expected month, and a high month before you sign. A percentage that looks cheap at your current volume can be expensive during a leave, a closure, or a slow quarter. And ask whether the rate can rise: one public agreement permits annual CPI-based increases capped at five percent, while another runs a three-year initial term with automatic two-year renewals unless you give notice ninety days before expiration. Put every one of those dates in a calendar the day you sign.

One thing you will not find here is a going rate. Several widely-read guides will tell you the number should be under eight percent, or under ten. Those figures come from vendor-authored content, not from a measured national distribution, and repeating them would be laundering a marketing claim into a benchmark. The useful comparison is not the rate. It is the denominator, the add-on schedule, and the exit terms. That is why a nominally cheaper proposal frequently is not.

There is a question underneath the fee that determines how much leverage you keep in every dispute that follows.

Who controls the cash and the bank account

Whose name is on every bank account, lockbox, EFT enrollment, merchant account, and payment address?

Non-negotiable. Cash custody is not an administrative detail, and the public record shows genuinely different models in the market. One posted agreement runs the percentage against net income deposited into an account the client controls, with the vendor holding view and deposit authority and the client holding audit rights. Another permits a vendor-named lockbox that the client cannot access directly, with remittance to the client at least monthly. A lockbox is simply a bank-operated mailing address that receives and deposits payments; whose name is on it decides who sees the money first.

Strong: a practice-controlled account, least-privilege vendor access, dual control for any change to payment instructions, and immediate practice visibility. Weak: a vendor-controlled lockbox, no direct access, or ambiguous authority to redirect payments. Inspect the account title, the bank letter, the EFT and ERA enrollment forms, and the change-control process, and have counsel read the account language specifically rather than the agreement generally.

Then ask how you audit the invoice back to the deposits. You want a monthly receipt ledger with claim, patient, and payment identifiers, a bank reconciliation, stated exclusions and credits, and a contractual right to inspect the supporting records. An invoice that shows only "collections × rate" cannot be checked, which means it cannot be disputed.

A note on percentage fees and where the money lands

This part deserves precision rather than confidence, and it is not legal advice.

Do not accept a blanket statement in either direction about whether percentage-based billing fees are permissible. It depends on your state, your profession, your entity, and the path the money takes. Three separate questions sit underneath it:

• State practice law. Illinois's Medical Practice Act, for example, permits a fair-market-value billing, administrative, or collection fee calculated as a percentage, flat fee, or other arrangement provided, among other conditions, that the licensee or practice controls the fees and that charges are paid directly to the practice or into a qualifying controlled account.
• Medicare payment conditions. A different question entirely. Paying a billing agent directly is governed by Part 424 and its reassignment provisions, which include that the agent's compensation not relate to amounts billed or collected and that payment remain in the provider's name.
• Everything else that can apply. Collection-agency licensing, corporate-practice rules, and fee-splitting rules vary by state and profession, and can add requirements beyond both of the above.

We price as a percentage of collections, like most of this industry, so this condition set applies to us as much as to anyone you are evaluating. Ask any vendor how the money physically flows, and have your own counsel review the answer against your state, your entity, your specialty, and your payers.

The people who will actually touch your claims

Who will physically work our claims, denials, posting, and patient calls?

Non-negotiable. The person selling you and the executive sponsoring the relationship may never touch the account. Quality lives with the operating team and its workload. You want named roles, location, experience, responsibilities, supervisor, backup, and a start date, plus a commitment to tell you when those change. "Our experienced team" is a description of a company, not of the people who will open your rejection queue on a Tuesday. Meet the proposed account lead and the denial lead before signature, not after.

Ask how many accounts, providers, or claims each of those people carries. A dedicated account manager can still be underwater, and capacity is what decides whether a low-value denial gets attention. A vendor that will not discuss workload at the account level, and instead cites total company headcount, has answered a different question.

What work is subcontracted or performed outside the United States, by whom, and in which countries?

Non-negotiable, and worth stating plainly: offshore is not inherently unsafe and domestic is not inherently safe. A U.S. company can use undisclosed subcontractors with poor oversight; a well-governed international team can have strong controls. The diligence issue is disclosure, competence, access, supervision, continuity, and contractual flow-down. HHS's HIPAA audit protocol reflects that expectation of appropriate downstream assurances wherever subcontractors handle protected health information.

Ask for entity names, countries, functions, access level, supervision, quality controls, downstream agreements, and advance notice before material changes. Practices describe discovering offshore involvement only after errors surfaced, which is a disclosure failure rather than a geography failure. "We are U.S.-based" that avoids naming who touches the data is the answer to watch for.

What happens when our primary biller is sick, on leave, or leaves the company?

Non-negotiable, and one of the most common fears buyers voice: being stranded when the individual who knew the account disappears. Continuity is an operational control, not a courtesy. You want a cross-trained backup, shared documentation, no credentials held by a single person, a handoff checklist, supervisor coverage, and notification of permanent changes. "Someone will cover" means the account knowledge lives in one person's inbox.

While you are on people: get a named operational contact and an escalation path with severity levels, response targets, an executive backstop, and an after-hours route for anything that threatens cash or access. A ticket portal is a queue, not an escalation system.

You cannot verify any of this by asking. You verify it in what arrives every month.

Reporting and KPIs: insist on the formula, not the label

What is the exact formula and source system for every KPI you report?

Non-negotiable. Clean-claim rate, first-pass acceptance, denial rate, net collection rate, and days in A/R are not interchangeable, and several of them can be moved several points by changing the formula rather than the work.

A strong answer is a data dictionary: numerator, denominator, exclusions, lag period, run-out, source system, refresh schedule, and segmentation, plus a commitment that any formula change comes with notice. A weak answer is benchmark percentages with no definitions, or a claim that the dashboard is "industry standard." We publish our formulas because a number whose definition can move is not a measurement, and the only way to prove that is to let a client recalculate one month from a raw export.

Here is the dictionary worth carrying into the meeting:

Two rows deserve emphasis because they cause the most expensive misunderstandings.

Clean-claim rate is not a payment metric. It measures data quality at the edit stage: whether your claims passed internal scrubbing without a human touching them. A vendor can report an excellent clean-claim rate while your cash is flat and your denials are climbing, and nothing about that is contradictory. Pair it with payer acceptance, initial denials, write-offs, resolution, and collection metrics, or it tells you nothing you can bank.

"Resolved" can mean recovered or written off. Because the standard measure runs to zero balance regardless of payment, a vendor with an aggressive adjustment habit will show excellent resolution times. This is the single easiest metric to look good on while performing badly. Always ask for resolution split by disposition.

On benchmark figures generally: AAFP describes 95% as a minimum adjusted collection rate, 95% to 99% as average, and 99% or better for high performers. Those are AAFP's guidance for its audience, not a guarantee that transfers across every specialty and payer mix. Any vendor that quotes you a benchmark without naming whose benchmark it is has not read the source.

Can we see claim-level status, source remits, notes, and user actions in real time?

Performance differentiator. Aggregate reports conceal stale claims and unworked queues, which is exactly why practices value staying inside their own system of record. You want read access to source transactions, a full audit trail, role-based permissions, and searchable claim history. A monthly PDF is not visibility. Test it by picking one number off their KPI report and tracing it down to the individual claims and remits behind it.

Ask what data you can export on demand, in what format, and at what cost, then actually run a sample export before you sign. "You own your data" is a sentence, not a deliverable. Ownership language means very little if the export omits notes, attachments, remits, claim history, correspondence, work queues, or audit logs. HHS's sample business associate agreement provisions contemplate continued access and return obligations for exactly this reason.

One more, since every vendor now has an answer prepared for it: where do you use automation, what is it permitted to change, and who reviews the result? You want an inventory of tools and the data they touch, permitted actions, human approval points, audit logs, override, and incident handling. "AI-powered" as a performance claim is not an answer, and any system that corrects or submits claims without a human decision is a compliance question rather than a feature. Our own terms say plainly that our platform flags risk while our staff decide, and that claims are not auto-corrected or auto-submitted; hold every vendor to a statement that specific.

A vendor can report honestly and still be the wrong risk to carry, which brings us to the part most buyers accept on a handshake.

HIPAA, BAAs, and security: past the compliant badge

Will you sign a business associate agreement before receiving any protected health information, and does it cover every downstream subcontractor?

Non-negotiable. Billing, claims processing, and practice management are business associate functions when they involve protected health information, and the required contractual safeguards flow down to subcontractors rather than stopping at your vendor. A generic non-disclosure agreement is not a substitute, and an agreement promised after go-live is a live exposure in the meantime.

"HIPAA compliant" is not a status you can verify by being told it. Ask these instead, and treat each as its own gate:

When was your last security risk analysis, and what material remediation is still open? The HIPAA Security Rule is risk-based and evidence-driven: an accurate and thorough risk analysis, risk management, regular access-log review, periodic evaluation, role-appropriate access. You want a dated enterprise risk analysis, a remediation plan, a named security official, and demonstrated controls: multi-factor authentication, encryption, role-based access, device controls, log review, backups, vulnerability handling. A policy binder proves someone bought a policy binder.

How quickly must you notify us of a suspected incident? HIPAA's breach notification requirements set an outer bound for business associates of without unreasonable delay and no later than sixty days. That outer bound is far too slow for your own investigation and your own duties. If the contract simply repeats "within sixty days," you have accepted the statutory maximum as your service level. Negotiate a short defined window for suspected material incidents, with ongoing updates and evidence preservation.

How do you screen employees, contractors, owners, and subcontractors for exclusions? The OIG is explicit that excluded individuals may not provide billing, accounting, administrative, or management services payable directly or indirectly by federal health care programs, and that contracting with an excluded person can create liability for you. Screening clinicians only, or screening once at hire, is not a program.

What compliance program governs the billing work itself? Named compliance officer, written standards, training, a reporting channel, auditing and monitoring, investigation, corrective action, an overpayment process, and leadership oversight proportionate to the firm's size. And ask specifically how a suspected coding error, overpayment, or unsupported claim gets escalated, including whether anyone has authority to stop work. A vendor whose staff are measured only on collections has a structural reason not to raise its hand.

If you treat substance use disorder, how do you handle 42 CFR Part 2? These records carry protections beyond ordinary PHI, with consent and redisclosure controls that change workflow. HHS's 2024 final rule became effective on April 16, 2024, with compliance required by February 16, 2026; "HIPAA covers it" is the wrong answer.

Finally, ask what happens when something outside everyone's control breaks: the EHR, the clearinghouse, a payer portal, or the vendor's own operation. Submission, appeal, authorization, and posting deadlines keep running during an outage. You want a documented continuity plan, a deadline inventory, alternate access, recovery objectives, a manual priority process, a last-tested date, and post-incident reconciliation. "Our vendors have backups" is not a plan you can rely on.

Two service lines carry diligence of their own, and neither belongs inside the general scope conversation.

Credentialing and patient billing: two questions people skip

When you say credentialing, do you mean credentialing, contracting, enrollment, roster loading, or all of them?

Non-negotiable when it is in scope. These are related and not identical, and the gap between them is where new providers stop generating revenue. A clinician can be fully credentialed and still unable to bill under the correct tax ID, product, location, or effective date. "We submit the application" treats submission as completion.

You want stage definitions, a payer-product-location matrix, a named application owner, a follow-up cadence, and tracking through effective date, group linkage, EFT and ERA setup, and roster loading.

Then ask two follow-ups. First: who owns the login credentials for CAQH, PECOS, NPPES, and the payer portals? Those accounts should be yours, under a practice-controlled email with a named authorized official and least-privilege delegated access, because CMS's enrollment guidance treats those roles as durable practice responsibilities and the records contain sensitive personal data. A vendor that creates them under its own email has taken something you will need back. The same goes for EFT enrollment.

Second: what prevents claims from going out before the effective date and product linkage are confirmed? Medicare has defined rules for when billing privileges take effect and limited circumstances for retrospective billing, and other payers set their own. "Submit and see what pays" is how practices end up refiling the same claim twenty times. And ask who monitors revalidation and reportable changes after the welcome letter arrives, since enrollment maintenance runs on its own calendar.

What exactly happens before a balance becomes patient responsibility?

Non-negotiable when patient billing is in scope. A denial, an information request, or a payer-routing error should never become a patient bill by default. Practices describe exactly this: outsourcing before the fundamentals were in place and watching balances move with no appeals behind them.

You want an insurance-responsibility review, remit validation, a benefit and authorization check, secondary billing, an explicit corrected-claim-or-appeal decision, and approved transfer logic, not an EHR rule that flips unpaid insurance balances to patient after N days. Ask for the transfer policy and a sample audit.

Then the downstream workflow:

• Statement cadence and itemization
• Accessible support a patient can actually reach
• A dispute hold that genuinely pauses collection activity
• Insurance recheck when a patient disputes
• Financial assistance where it applies
• Payment plans
• Your approval before any collection placement

This is a consumer-protection surface as much as a revenue one. The CFPB has taken action on inaccurate and inflated medical debt collection and publishes guidance on medical debt and credit reporting, and state requirements add more. While you are there, settle who owns refunds, credit balances, and deceased or bankrupt accounts, since credits netted invisibly against collections distort both your cash and your metrics. AAFP's practice finance guidance makes the same point about adjustments distorting collection performance.

Everything above gets decided in a document most buyers read last.

Read the billing contract as an operating document

Marketing pages describe service. Contracts describe what happens when service fails. The four public documents below are not all physician-practice agreements - several concern ambulance and EMS billing - and four examples prove that terms vary, not that any of them is typical. That is exactly why they are useful: they show the range of what is possible to sign.

That last row is worth borrowing. Holding final payment against a satisfactory handoff converts your exit from a hope into a term.

What happens in the first 30, 60, and 90 days, and who owns claims during the overlap?

Non-negotiable when you are switching. A transition is a revenue operation, not a software kickoff. You want baseline metrics captured before anything moves, a claim-level open-A/R inventory, an EDI/ERA/EFT and clearinghouse checklist, claim-hold rules, a credentialing review, test claims, a weekly cash forecast, work queues, a denial baseline, and a governance cadence.

The overlap question is separate and it is where money disappears. Without a boundary defined by date of service and claim status, both vendors work the same claim or neither does. Practices switching systems routinely find the practical answer is working in both systems for a period, which is fine as long as ownership is assigned claim by claim, with duplicate-submission controls and an agreed rule for remittances that land in the wrong place.

Ask the same question about your existing aged A/R: what dates and balances will you accept, how is that work priced, how do you triage timely-filing risk, and at what point do you stop? "We'll clean it up" has no boundary and no baseline. Pilot a sample of aged claims before you finalize scope.

What must you deliver at termination, when, in what format, and at what cost?

Non-negotiable, and the clause people negotiate least. A list of open balances is not a handoff. You want claims, balances, payments, remits, notes, attachments, payer correspondence, authorizations, credentials, audit logs, statement history, work queues, reports, and a data dictionary: validated, on a fixed timeline, at a stated cost.

One point of leverage worth knowing: HHS has addressed whether a business associate may block or terminate a covered entity's access to protected health information to gain leverage in a payment dispute, and the answer is no where the arrangement requires access or return. Your data is not collateral. Get the transition-out schedule and a sample export attached to the agreement as exhibits, and ask what post-termination collections remain commissionable, for how long, and how they are attributed, so you are not paying two vendors for the same dollar.

While counsel has it open, mark the clauses that quietly move risk:

1. Definitions of collections, claim, and existing A/R
2. The scope exhibit, including exclusions and service levels
3. The fee exhibit, including the denominator and every add-on
4. Cash control - account title, access, and instruction changes
5. Write-off authority - reason matrix, dollar limits, approvals
6. Data rights - ownership, continuing access, structured export, audit logs
7. The business associate agreement and the subcontractor chain
8. Staffing - named roles, location, replacement, continuity
9. Service levels - submission, posting, denial first action, appeals, reporting
10. Term and renewal mechanics, including every notice date
11. Wind-down - responsibilities, claim ownership, successor cooperation, tail fees
12. Liability - indemnity, caps, exclusions from the cap, insurance
13. Audit rights over invoices, performance, security, and subcontractors
14. Change control for scope, rate, platform, location, or subcontractor
15. Dispute continuity - services, data access, and PHI availability must not become leverage in an ordinary payment dispute

Public agreements can pair broad client indemnities with vendor liability capped at a few months of fees, which is a risk transfer no service description will mention.

There is one more set of questions, and they are the ones we would least like to be asked.

The questions we would least like to answer

Everything to this point has been aimed outward. Here is the part that makes the rest of it worth anything.

Ask for a comparable current client, and at least one former client. Not logos, not written testimonials. A reference in your specialty, with a similar payer mix, a similar size, and the same practice management system, with permission to discuss operational specifics. The former client matters more than the current one, because only a former client can tell you what the exit actually looked like. Any vendor can produce a happy customer. Producing someone who left, and letting you ask why, is a different order of confidence.

Ask what can be shown that someone other than the vendor verified. Published case studies with methodology. Figures a third party checked. An independent security assessment. This is where a great many billing companies, including ours, have to give an answer they would rather not. We have not published case studies. The results we can describe come from our own clients and our own systems, which makes them client-asserted rather than independently audited, and the honest framing is anonymized outcomes with references available on request. If we told you those numbers were verified, we would be doing the exact thing this article was written to help you catch.

Ask about a client relationship that went badly, and what changed afterward. A vendor that has never had a problem is either very new or not being candid. The answer you want has a specific failure in it, how it was detected, what the client experienced, how it was communicated, what was remediated, and what process or control changed as a result, without exposing patient information and without every fault belonging to the client. "We have never lost a client" is not a strength.

Ask how many people actually do this work, and how long the firm has operated under its current name and structure. These are two questions and they have two different answers, at our firm and at most others. The years the people have been doing revenue cycle work and the age of the entity on the contract are rarely the same number, and a vendor that blends them into one impressive figure is hoping you will not separate them. Ask for both. With us you are working with a small named team and talking to the people who touch your claims, which is a genuine advantage on responsiveness and a genuine question mark on bench depth. You should press us on the second one exactly as hard as you press anyone else.

We include these because the alternative is worse. A list of questions engineered so that the publisher answers all of them beautifully is not diligence; it is a sales asset wearing diligence as a costume, and any buyer sharp enough to be reading this far can smell it. The questions that separate a serious billing operation from a weak one are the same questions regardless of who prints them, and some of them are uncomfortable for us. That is the point.

If the honest answer for some vendors is "not yet," the honest answer for some practices is "don't hire anyone."

When keeping billing in-house is the right call

Outsourcing is not a universal upgrade, and any billing company that tells you otherwise is describing its business model rather than your situation.

Keeping billing in-house is a reasonable decision when you have:

• Low claim volume
• A small and stable payer mix
• Straightforward services and coding
• Reliable enrollment already in place
• Good visibility into your EHR and clearinghouse
• Few denials
• Genuine administrative time to check queues, call payers, work appeals, and reconcile payments
• A backup for absence and turnover
• Access to specialty coding or compliance help when something unusual comes up

The practitioner accounts support both sides of this honestly. Some solo clinicians report that once setup and the common denials are understood, self-billing inside their own system is manageable and saves a meaningful monthly fee. Others are genuinely overwhelmed by enrollment, Medicaid rules, and repeated denials, and describe reaching a point where the aggravation exceeds the savings. Both are true. Which one is you depends on the list above, not on a sales conversation.

And the choice is not binary. Between doing everything yourself and handing over the whole cycle, there are engagements sized to the actual gap:

• Self-submission with a periodic audit
• In-house billing with outsourced denials and appeals
• Credentialing and enrollment support only
• A one-time aged A/R recovery project
• A coding and documentation audit
• A patient-accounts workstream
• Co-managed revenue cycle, with the split defined stage by stage

We offer end-to-end and a-la-carte engagements for this reason. If the failing part of your cycle is credentialing, buying full-service billing is an expensive way to fix credentialing.

That picture usually changes for one of four reasons: the practice is growing - new clinicians, new locations, a new state; the payer or service mix has genuinely got more complex; nobody has the time the billing side actually needs; or collections have slipped and nobody can say precisely why. None of those is about size. We work with practices of every size, from a single clinician to a multi-state group, and we take on a single piece of the cycle as readily as the whole of it. The question is never whether a practice is big enough to be worth helping - it is which part of the cycle needs owning.

A scorecard that makes billing proposals comparable

Two proposals with different fee structures, different scopes, and different reporting are not comparable until you force them onto one sheet.

Start with the hard-fail gates. No vendor advances without a satisfactory answer and written protection on every one of these:

1. A business associate agreement signed before any PHI access
2. Full disclosure of subcontractors, countries, and functions
3. Practice access to PHI and a usable, tested data export
4. Practice control and visibility over cash, EFT/ERA, and payment routing
5. Clear write-off and patient-balance transfer authority
6. A defined fee denominator and a complete add-on schedule
7. A defined denial and appeal scope
8. A viable transition-out with successor cooperation
9. A named escalation route and a business-continuity plan
10. No promise to submit unsupported claims or to guarantee payer outcomes

Then score the rest. A hundred points across eight categories:

Score each individual question from 0 to 4. Zero is absent, contradictory, or refused. One is a general promise. Two is a specific process. Three is a specific process plus documentary or live proof. Four is proof plus a contract or service-level commitment plus a credible reference.

One rule holds the whole thing together: a high weighted total never overrides a hard fail. A vendor that scores 88 and cannot produce a usable data export is not an 88.

What you are actually buying when you outsource billing

You are not buying claim submission. Any competent shop can submit claims, and the ones that only submit claims will describe themselves using the same vocabulary as the ones that do considerably more.

What you are buying is the labor and the controls that sit around submission: payer-specific verification, enrollment that is finished rather than filed, authorization and concurrent review where the specialty demands it, the phone call that a portal status check cannot replace, appeals filed against deadlines somebody is actually tracking, aged A/R triaged instead of promised, documentation feedback before a pattern becomes a recoupment, payment variance caught on claims that already paid, patient balances that move only when they should, and a transition plan on both ends of the relationship.

So the sharpest version of the whole exercise is this. The right billing company is not the one that promises to handle everything. It is the one that can define everything, show you the work, measure it honestly, and let you leave with your cash, your data, and your claim history intact.

Before you replace anyone, define the work, the metrics, and the exit terms you need. A practice with a clean, low-volume cycle may need nothing more than an audit or one targeted fix. A practice with recurring denials, aging A/R, enrollment gaps, or nobody accountable for payer follow-up has a different problem and needs someone to own the work. We do both, across behavioral health, mental health, and inpatient and outpatient physician billing, and the first step in either direction is the same: find out which part of the cycle is actually failing before you buy a solution to a different one.

Frequently asked questions

What percentage should a medical billing company charge?

There is no reliable published national figure, and the ranges you will see quoted in vendor guides are marketing content rather than measured distributions. The more useful question is what the percentage is calculated against. A lower rate applied to a broadly defined denominator that includes payments you collect yourself, plus separate enrollment and processing fees, can easily cost more than a higher rate on a narrow, clearly defined base. Compare denominators and total cost, not rates.

What does "full-service" medical billing actually include?

Whatever the contract says, which is why the term is close to meaningless on its own. It may or may not include coding, eligibility verification, prior authorization, appeals beyond a first resubmission, patient statements and collections, underpayment recovery, credentialing, and aged A/R. Ask for a stage-by-stage responsibility matrix as a contract exhibit; OIG's third-party billing guidance assumes those responsibilities are assigned explicitly rather than implied.

Who owns the billing data?

Your practice does, and the contract should say so plainly, but ownership language is not the operative protection. Portability is. Confirm exactly which records you can export on demand and at termination: claims, payments, remits, notes, attachments, correspondence, work queues, and audit logs, in a documented format, on a stated timeline, at a stated cost. HHS's sample business associate agreement provisions address continued access and return obligations.

Can a billing company withhold our data during a payment dispute?

HHS has addressed this directly: a business associate may not block or terminate a covered entity's access to protected health information to gain leverage in a payment dispute where the arrangement requires access or return. Some agreements nevertheless condition final deliverables on payment of undisputed fees, so read the wind-down and data clauses together, and get counsel's view before you sign.

Should a solo practice hire a biller at all?

Not necessarily. In-house billing is reasonable with low volume, a small stable payer mix, straightforward coding, completed enrollment, few denials, and genuine time to work queues and call payers. Practitioners report success on both sides of this. Some find self-billing manageable once the common denials are understood, while others are overwhelmed by enrollment and Medicaid rules. If only one part of the cycle is failing, buy help for that part.

What reports should a billing company provide, and how often?

Operational queue reports weekly or more often, and an executive KPI package monthly, cut by payer, provider, code, and location. What matters more than the cadence is that each variance carries a cause, an owner, a due date, and follow-up on the prior period's actions. MGMA's operational KPI guidance is a reasonable starting list. A monthly aging report with no interpretation attached is data, not reporting.

Is offshore medical billing HIPAA compliant?

Location alone does not determine compliance or quality. What matters is disclosure, competence, access control, supervision, continuity, and contractual flow-down to every subcontractor handling protected health information, which HHS's audit protocol reflects. Ask for the subcontractor register, the countries and functions involved, the data-flow map, the downstream agreements, and a change-notice clause. Undisclosed subcontracting is the real risk, and it happens domestically too.

How long does it take to switch billing companies?

Plan in terms of the revenue cycle rather than the software. New claims can flow quickly, but enrollment, EFT and ERA re-registration, clearinghouse setup, and legacy A/R take considerably longer, and practices commonly work in both systems for a period. Contract terms extend it further: publicly posted agreements include 120-day wind-down periods and, in one case, fee entitlement for six months beyond the wind-down. Read those clauses before you set a date.

What is the difference between clean-claim rate and denial rate?

They measure different stages and neither implies the other. HFMA defines clean-claim rate as claims passing edits with no manual intervention divided by claims accepted into the claims-processing tool, an internal data-quality measure taken before the payer sees anything. Initial denial rate measures what the payer did after adjudication, and HFMA's denial metrics guidance recommends tracking it by both volume and dollars. A high clean-claim rate alongside a rising denial rate is entirely possible.

How do I compare two proposals with different fee structures?

Normalize them before you compare. Write both denominators out in full, add every enumerated fee including enrollment, statements, processing, and transition charges, apply any minimums, and model a low, expected, and high volume month. Then add the exit economics, since wind-down periods and post-termination fee tails can continue for months after you leave. Only after all of that do the two rates become comparable, and by then the rate is usually not the deciding factor.