Disclaimer: The information provided in this blog is for general informational purposes only and does not constitute legal, tax, or accounting advice. Nothing on this site should be relied upon as a substitute for professional advice from a licensed attorney, CPA, or financial advisor. Please consult a qualified professional before making any financial or legal decisions.
Bookkeeping becomes a HIPAA matter the moment your financial records contain protected health information (PHI), and a bookkeeper who handles those records for a covered healthcare practice is typically a business associate under the law. That status brings written agreements, security obligations, and direct legal liability for the bookkeeper, not just for you. This article explains when HIPAA applies to financial records, what the rules require, where everyday bookkeeping workflows leak PHI, and how to vet and set up a HIPAA compliant bookkeeping arrangement.
When Bookkeeping Records Count as Protected Health Information
Protected health information is individually identifiable health information that relates to a person's health condition, the care they receive, or payment for that care. Payment information is explicitly part of the definition, which is why billing records sit squarely inside HIPAA's reach. A record becomes PHI when it links a specific person to a healthcare service, even if no diagnosis appears on it.
In a bookkeeper's world, that covers more than most owners expect:
- Patient names on invoices or statements
- Insurance explanations of benefits (EOBs) and remittance advice
- Accounts receivable aging reports that list patients and balances
- Deposit detail or merchant processor reports that pair a patient with a procedure description
- Payment plan records, refund requests, and collections files
HIPAA binds covered entities directly: health care providers that conduct certain transactions electronically (such as billing insurance), health plans, and healthcare clearinghouses. A practice that never bills insurance electronically, for example a fully cash-pay practice, may not be a covered entity at all. Do not assume either way. Status turns on the specific facts, so confirm it with a healthcare attorney before deciding how much of this applies to you.
At the other end, some financial records contain no PHI. Monthly totals by expense category, payroll summaries, and a profit and loss statement that shows only aggregate revenue generally do not identify any patient. The caution is that "de-identified" has a formal meaning under HIPAA's rules (45 CFR 164.514), which sets out specific methods, including removing a defined list of identifiers. A report that merely hides last names but keeps dates of service, small-town ZIP codes, and unusual procedures may still be identifiable. Treat totals-only reports as low risk, not automatically risk-free. Clean, GAAP compliant financial reporting built on aggregated figures is a good model for what a bookkeeper can produce without touching patient detail.
Why Your Bookkeeper Is a Business Associate
The U.S. Department of Health and Human Services (HHS) defines a business associate as a person or entity that performs functions or services for a covered entity that involve the use or disclosure of PHI. Outside bookkeepers, accountants, billing companies, and collections agencies with access to patient-linked financial data generally fit that definition. The test is access to PHI, not the job title. If you are still weighing your options, our comparison of outsourced accounting vs in-house covers how each model affects who touches your data.
The Business Associate Agreement
Before any PHI is shared, HIPAA requires a written Business Associate Agreement (BAA) between the covered entity and the business associate. The agreement typically spells out:
- What the bookkeeper may do with PHI, and what is off limits
- The safeguards the bookkeeper must maintain
- How and how quickly the bookkeeper must report a breach or security incident
- Requirements for subcontractors
- Return or destruction of PHI when the engagement ends
Business associates are not merely bound by contract. Under the HITECH Act of 2009 and the HIPAA Omnibus Rule of 2013, they are directly liable to federal regulators for certain violations, including failing to safeguard electronic PHI under the Security Rule. Confirm the current citations with counsel before you rely on them in a policy document.
The chain does not stop at your bookkeeper. If the bookkeeper uses a cloud accounting platform, an offshore staffing partner, a document storage host, or an outsourced IT provider that touches PHI, those parties are subcontractors and need their own BAAs flowing down the line. Ask who else touches the data.
One misconception causes real trouble: a bookkeeper's personal promise of confidentiality, or a signed NDA, does not substitute for a BAA. An NDA protects business information. It does not impose HIPAA's safeguard, breach notification, and subcontractor requirements. Sharing PHI with a vendor who has signed only an NDA is itself a compliance problem for the practice.
The Security Rule Safeguards That Apply to Financial Data
The HIPAA Security Rule (45 CFR Part 164, Subpart C) protects electronic PHI through three groups of safeguards. It is flexible by design, scaled to the size and complexity of the organization, but "flexible" does not mean optional. Here is how each group shows up in a bookkeeping engagement.
Technical safeguards
These govern the systems that hold the data. For bookkeeping, that means encryption of files in transit and at rest, a unique login for every person (no shared passwords on the accounting file), multifactor authentication, role-based permissions so staff see only what their job requires, and audit logs that record who opened or changed what. Automatic logoff on idle sessions also belongs here.
Administrative safeguards
These are the policies and management practices. The practice and the bookkeeper should each have completed a security risk analysis, a written set of policies, and workforce training that covers handling patient-linked financial data. The minimum necessary standard applies directly: the bookkeeper should receive only the fields needed for the task. Reconciling bank deposits rarely requires diagnosis codes, and a monthly close rarely requires full patient names. A broader compliance management routine helps keep these policies documented and current.
Physical safeguards
Paper still exists. Printed EOBs, bank statements with patient detail, and deposit slips need locked storage, and laptops and phones that hold PHI need device controls such as full-disk encryption and remote wipe. Old paper and retired drives need secure disposal, such as shredding or certified media destruction, not the recycling bin.
Rules may be changing. In January 2025, HHS published a proposal to update the Security Rule, which would tighten expectations around items such as encryption, multifactor authentication, and asset inventories. Rulemaking proposals can be finalized, revised, or withdrawn, so check the current status on the HHS Office for Civil Rights website or with counsel before treating any proposed requirement as final or as absent.
Where Bookkeeping Workflows Quietly Leak PHI
Most breaches in a bookkeeping relationship are not dramatic hacks. They come from ordinary habits that nobody flagged as risky.
- Email attachments. A spreadsheet of patient balances or a scanned EOB sent from a personal or unencrypted email account is a classic problem. So is forwarding that message to a colleague "for a quick look."
- Accounting software without a BAA. Not every platform will sign one. Many mainstream small-business tools, QuickBooks Online among them, have historically not offered BAAs for their standard products. Vendor policies change, so verify each tool's current BAA availability directly with the vendor as of today instead of assuming. If a vendor will not sign, keep PHI out of that system. Our guide to QuickBooks vs a professional bookkeeper explains how software and human oversight fit together.
- Free-text fields. Memo lines, invoice descriptions, and bank transfer notes often carry things like "root canal, J. Alvarez" or "psychotherapy session." Once typed, that text replicates into bank feeds, reports, and exports.
- Informal channels. Texted photos of receipts, shared drives with broad access, and files saved to personal devices all sit outside any controlled system.
- Leftover data. Files that remain on a bookkeeper's computer or cloud folder long after an engagement ends are still PHI, and still a liability.
The fix: de-identify at the source
The most effective control is to stop PHI from entering the bookkeeping system at all. Use account numbers or invoice numbers in place of patient names, and keep descriptions generic, such as "Services rendered" instead of a procedure. Keep the key that maps numbers to patients inside your practice management or billing system, which should be covered by its own BAA. When the bookkeeper does need PHI, route it only through approved, access-controlled channels such as a secure portal, never ad hoc email or text. A well-designed chart of accounts also helps, because clean categories reduce the temptation to put patient detail in descriptions.
How to Vet and Set Up a HIPAA-Compliant Bookkeeping Arrangement
Work through the setup in order. Each step narrows what the next one has to protect.
- Confirm covered-entity status with a healthcare attorney or compliance professional.
- Decide what PHI the bookkeeper truly needs. Many bookkeeping tasks can be done on de-identified data.
- Sign a BAA before any PHI changes hands, and confirm subcontractor BAAs.
- Review the bookkeeper's security practices against the safeguards above.
- Configure access with unique logins, multifactor authentication, and permissions limited to the minimum necessary.
If your practice is building its financial back office from scratch, our walkthrough on how to set up a business accounting system can help you structure these steps from day one.
When interviewing a bookkeeper, ask direct questions:
- Do you sign BAAs, and will you sign ours?
- Where is our data stored, and on whose systems?
- Who on your team, including subcontractors, can access it?
- How do you detect and report a breach, and how fast?
- What HIPAA training does your staff receive, and how often?
Ask to see documentation, such as a summary of their latest risk analysis or their written security policies. Be wary of anyone advertising "HIPAA certified" status. HHS does not certify or endorse HIPAA products or professionals, so the phrase is a marketing claim, not a credential. Training certificates and third-party security audits can be useful evidence, but they are not government approval. Pricing varies with this level of diligence, so it also helps to know what accountant fees for small business typically look like when comparing providers.
Plan for the ends of the relationship too. Under the Breach Notification Rule, covered entities must notify affected individuals and HHS of breaches of unsecured PHI, and business associates must notify the covered entity. Your BAA should set the bookkeeper's reporting timeline, and your offboarding checklist should require revoking access and returning or destroying data, with written confirmation.
Penalties are tiered by level of culpability and adjusted for inflation each year. Rather than rely on any figure quoted from memory, check the current amounts published by HHS and the Office for Civil Rights.
Three Things to Get Right Before You Share Another Spreadsheet
HIPAA compliant bookkeeping comes down to a signed BAA, minimal PHI, and secured systems. If any one of those is missing, the other two will not make up for it. A good next step is to walk through your current workflow from the patient payment to the monthly close, noting every place a patient name, EOB, or procedure description travels. Then take what you find to a healthcare attorney or compliance professional, who can confirm your covered-entity status and tell you what your specific situation requires.
If you would like to talk through how your bookkeeping currently handles patient-linked financial data, Numbers Southwest Inc is happy to have that conversation.
Schedule a call and discover how we can help your business grow.