Medical billing cybersecurity · Reviewed September 12, 2026
Medical Billing Cybersecurity Checklist: 12 Controls RCM Companies Should Verify
Medical billing companies often operate across client EHRs, payer portals, clearinghouses, Microsoft 365, remote devices and internal billing systems. The challenge is not simply buying security tools. It is knowing which controls are in place, who owns them and what evidence proves they are still working.
Use this checklist as a security baseline, not a compliance certificate
Some of the controls below help support HIPAA Security Rule obligations and broader cybersecurity risk management, but this checklist is not a substitute for a formal risk analysis, legal review or an assessment of your actual environment.
HHS requires regulated entities to protect the confidentiality, integrity and availability of ePHI using reasonable and appropriate safeguards. The rule is technology neutral, so the right implementation depends on risk, systems, size and operating model.
The 12 controls to verify
Know where sensitive data flows
Identify the systems, devices, portals, vendors and storage locations involved in billing workflows. Include client-controlled platforms you do not administer.
Use individual accounts and MFA
Avoid shared credentials where possible. Verify MFA coverage for internal systems and document limitations in third-party portals.
Limit privileges and review access
Match access to job responsibilities, separate administrative accounts where appropriate, and review access after role changes or departures.
Manage employee devices
Know which laptops and desktops are approved, supported, protected and centrally visible. Remote billing increases the importance of device ownership and configuration.
Verify encryption coverage
Check managed-device disk encryption, protected recovery keys, approved file-transfer methods and cloud-storage settings.
Reduce phishing and impersonation risk
Use layered email protections, authentication controls and independent verification for payment or banking changes.
Find and remediate weaknesses
Establish recurring vulnerability detection, assign remediation owners and track exceptions until risk is accepted or resolved.
Keep supported systems current
Track operating systems, browsers, applications and infrastructure. Know which systems cannot be patched and why.
Prove recovery works
Confirm that critical company-controlled data is backed up and that restoration has been tested. Document dependencies on client and vendor platforms.
Know what gets monitored
Identify available logs, retention, review responsibility and escalation paths. Logging without ownership rarely produces useful security outcomes.
Manage vendor and subcontractor risk
Maintain an inventory of vendors that handle sensitive data, understand contractual responsibilities and review their security role.
Prepare for incidents
Define who reports, investigates, contains and communicates a security incident. Test the workflow before an actual event forces the issue.
What “verified” should look like
| Control | Weak evidence | Stronger evidence |
|---|---|---|
| MFA | “We turned MFA on.” | Coverage report showing enrolled users, exclusions and privileged accounts |
| Encryption | Policy says laptops must be encrypted | Current managed-device report showing encryption status and exceptions |
| Vulnerability management | A scan was run | Findings, assigned owners, due dates, remediation evidence and accepted exceptions |
| Backups | Backup dashboard is green | Documented scope plus a successful restore test for critical data |
| Offboarding | Microsoft 365 account disabled | Internal access revoked plus client/payer portal revocations tracked to confirmation |
| Incident response | Policy exists | Named roles, escalation contacts and results from a tabletop or exercise |
Common medical billing security gaps
Client-controlled accounts are not included in offboarding
A former employee can be disabled internally while retaining access to a provider EHR or payer portal. Build a workflow that distinguishes internal systems from external accounts and tracks revocation confirmation.
Remote employees use unmanaged devices
If staff can access or store ePHI from personal equipment, determine whether the workflow is acceptable and what controls apply. Company-managed endpoints or appropriately configured remote-access solutions can reduce visibility gaps.
Security responsibilities are assumed instead of documented
The MSP may manage devices, the billing platform may host data, the provider may own the EHR and an internal manager may approve access. Create a simple responsibility matrix so each control has an accountable owner.
Evidence is collected only before an audit
Security controls change. Build evidence collection into normal operations so encryption, MFA, endpoint coverage, vulnerabilities and access reviews can be verified without a last-minute scramble.
How this relates to HIPAA
The currently effective HIPAA Security Rule requires appropriate administrative, physical and technical safeguards for ePHI. HHS identifies risk analysis, risk management, access control, audit controls, authentication and transmission security among the rule’s requirements. HHS also provides voluntary healthcare Cybersecurity Performance Goals to help healthcare organizations prioritize high-impact cybersecurity practices.
HHS Security Rule summary · HHS Healthcare Cybersecurity Performance Goals
Turn the checklist into a working program
Find the gaps
Map assets, workflows, accounts, vendors and externally visible risks.
Fix priority controls
Assign remediation and deploy appropriate endpoint, identity, email, encryption and vulnerability controls.
Maintain evidence
Keep dated reports, approvals, policies, exceptions and remediation records.
Review continuously
Check control coverage, unresolved exceptions and changes in risk over time.
Want to know what is visible before giving anyone access to your systems?
Start with NCB Cyber’s complimentary Medical Billing Cyber Risk Snapshot. It reviews publicly observable security conditions such as domain and email-security posture and external exposure indicators.
Free · No agents · No passwords · No system access
Get My Free Medical Billing Risk Snapshot →Medical Billing Cybersecurity Services →
Continue the medical billing security series
- HIPAA Risk Analysis for Medical Billing Companies
- Remote Medical Billing Security: Access and Device Checklist
- 2026 HIPAA Security Rule Update for Medical Billing Companies
Frequently asked questions
Does a medical billing company need every tool on the market?
No. Start with risk, workflow and evidence. The correct security architecture depends on what data the company handles, where it is processed, the systems involved and contractual or regulatory obligations.
Can an MSP manage these controls?
An MSP can own many technical controls, but responsibilities should be explicit. Governance, evidence, vendor dependencies and client-controlled systems can remain gaps even when day-to-day IT is outsourced.
Does completing this checklist make a company HIPAA compliant?
No. It is a cybersecurity baseline and educational resource, not a determination of legal compliance or a substitute for a complete risk analysis.
General cybersecurity information only; not legal advice.