In healthcare revenue cycle management, protecting patient information and maintaining reliable financial records are becoming central to how organizations evaluate billing partners.
A healthcare organization reviewing proposals from revenue cycle management (RCM) vendors may begin with familiar questions: How quickly are claims submitted? How are denials managed? What reporting will leadership receive? Increasingly, however, the evaluation also extends to another set of questions: Who can access patient information? How is that access monitored? What happens during a cyberattack? Can the vendor demonstrate that its financial processes are properly controlled?
These are not separate concerns. Modern RCM connects clinical records, insurance information, payment systems, patient communications, and financial reporting. A weakness in one part of that environment can affect the others.
Recent healthcare billing procurement requirements illustrate this broader approach to vendor evaluation. Buyers are examining security practices and audit controls alongside operational performance, particularly when a vendor will handle protected health information (PHI) and collect or reconcile revenue on the organization’s behalf.
A billing partner is also a data partner
RCM vendors need access to sensitive information to perform their work. Depending on the services provided, that information may include patient demographics, diagnoses, treatment records, insurance identifiers, claims, and payment details.
Under the Health Insurance Portability and Accountability Act (HIPAA), organizations that handle PHI on behalf of covered entities may qualify as business associates. The U.S. Department of Health and Human Services (HHS) explains that business associate agreements establish permitted uses of PHI, safeguarding obligations, breach-reporting responsibilities, and requirements involving subcontractors (HHS, n.d.-a).
For buyers, this raises practical questions that go beyond whether a vendor describes itself as “HIPAA compliant.” They may want to understand which employees can view records, whether access is limited by job responsibility, how subcontractors are managed, and how quickly security incidents are escalated. These questions become particularly important when billing work involves multiple systems, locations, or service providers.
Cybersecurity incidents can interrupt the revenue cycle
The connection between cybersecurity and financial operations became especially visible during the 2024 Change Healthcare cyberattack. HHS described the incident as having an unprecedented impact on patients and healthcare providers and opened an investigation focused on potential PHI breaches and HIPAA compliance (HHS, 2025a).
A cyberattack affecting claims infrastructure can disrupt far more than access to patient records. It may delay claim submission, payment processing, eligibility checks, and other activities that healthcare organizations depend on for cash flow.
The risk is also relevant to specialized billing providers. In May 2025, HHS announced a settlement with Comstar, a company providing billing and collection services to nonprofit and municipal emergency ambulance organizations. The investigation concerned a ransomware breach affecting 585,621 individuals and potential HIPAA Security Rule violations (HHS, 2025b).
For an organization outsourcing EMS or medical billing, that example makes security due diligence concrete: a billing vendor’s systems and safeguards can affect both patient privacy and the continuity of revenue operations.
Audit controls are about more than cybersecurity
Security controls help protect information. Financial audit controls help establish whether billing transactions are complete, accurate, authorized, and traceable.
Consider a routine billing scenario. An insurer pays a claim, but the payment is posted to the wrong account. Alternatively, a refund is issued without appropriate review, or the amount remitted to the healthcare organization does not reconcile with the vendor’s collection report. Even without a cyberattack, weak controls can create financial discrepancies and make them difficult to investigate.
That is why buyers may request evidence of processes for payment posting, refunds, reconciliations, user permissions, and transaction histories. They want to know not only that revenue is being collected, but also that each financial movement can be explained.
One relevant assurance mechanism is a SOC 1 report. The American Institute of Certified Public Accountants (AICPA) explains that SOC 1 examinations address controls at service organizations that may be relevant to their clients’ internal control over financial reporting (AICPA & CIMA, 2025).
A SOC 1 report is not interchangeable with a general statement about cybersecurity or HIPAA compliance. Different assurance reports address different control objectives, and buyers need to understand which evidence supports the particular risk they are assessing.
Why the questions are becoming more specific
A request for “secure systems” leaves considerable room for interpretation. More detailed procurement questions help buyers evaluate how a vendor’s commitments would work in practice.
- Can the vendor produce records showing who accessed or changed an account?
- Are billing, refund approval, and reconciliation responsibilities appropriately separated?
- How are PHI access rights removed when an employee changes roles or leaves?
- What happens to claim submission and payment processing if a critical system becomes unavailable?
- What independent assurance reports are available, and what controls do they actually cover?
The HIPAA Security Rule already addresses access controls, audit controls, authentication, integrity, and transmission security for electronic PHI (HHS, n.d.-b). HHS also clarifies that customers may seek additional contractual assurances, such as security documentation or audit rights, based on their own risk assessments (HHS, 2016).
In other words, regulatory obligations provide a foundation, while procurement requirements allow buyers to examine risks specific to their operations.
What this means for the future of RCM partnerships
The practical lesson is that billing performance and organizational trust cannot be evaluated independently.
A vendor may present an attractive collection rate or a competitive fee, but buyers also need confidence that patient information will be protected, billing activity will remain traceable, and financial reports can withstand scrutiny.
For RCM providers, this creates an opportunity to communicate value more clearly. Instead of relying on broad assurances, proposals can explain the actual processes used to manage access, monitor activity, handle incidents, reconcile funds, and oversee subcontractors—supported by appropriate documentation wherever available.
For healthcare organizations, asking detailed security and audit questions is not simply adding paperwork to procurement. It is part of understanding the operational and financial risks that come with entrusting another organization with patient information and revenue.
The direction is clear: an effective RCM partnership must demonstrate not only how revenue is recovered, but also how information, transactions, and accountability are protected throughout the process.
Talk to an RCM Expert
Evaluating an RCM partner involves more than comparing fees and collection performance. The right conversations should also cover reporting transparency, operational accountability, security responsibilities, and financial controls.
Talk to an RCM Expert to discuss your organization’s revenue cycle priorities.
References
American Institute of Certified Public Accountants & Chartered Institute of Management Accountants. (2025). Reporting on an examination of controls at a service organization relevant to user entities’ internal control over financial reporting (SOC 1®). https://www.aicpa-cima.com/cpe-learning/publication/reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-user-entities-internal-control-over-financial-reporting-soc-1-guide
U.S. Department of Health and Human Services. (2016, October 6). Do the HIPAA Rules require CSPs that are business associates to provide documentation, or allow auditing, of their security practices by their customers who are covered entities or business associates? https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html
U.S. Department of Health and Human Services. (2025a, March 14). Change Healthcare cybersecurity incident frequently asked questions. https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
U.S. Department of Health and Human Services. (2025b, May 30). HHS Office for Civil Rights settles HIPAA ransomware cybersecurity investigation with Comstar, LLC. https://www.hhs.gov/press-room/hhs-hipaa-comstar-agreement.html
U.S. Department of Health and Human Services. (n.d.-a). Business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
U.S. Department of Health and Human Services. (n.d.-b). Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
