Staff Series – R5 M2: HIPAA and the Revenue Cycle
RCM FOUNDATION SERIES · ROUND 5
Module 2 of 3

HIPAA and the Revenue Cycle

Round 5 — Module 2 · Protecting patient information while getting paid
Your name will appear on your certificate when you complete this round.
Round 5 Progress
1
Changing Environment
2
HIPAA & RCM
3
Policies & Your Role

Billing Work Is Also Privacy Work

Every step of the revenue cycle touches protected health information — diagnosis codes, treatment details, insurance information, and financial data. HIPAA exists to make sure that information is only seen, shared, and used by the people who genuinely need it to do their job.

Where HIPAA Shows Up in Billing Work

Minimum Necessary Standard

Only access or share the information needed for the specific task at hand — not an entire chart when only a billing code is needed.

Verifying Who You're Speaking To

Before discussing any account details over the phone, confirming identity protects both the patient and the practice.

Secure Handling of Statements and Records

Statements, EOBs, and printed reports containing patient information need to be handled, stored, and disposed of securely — not left visible at a workstation or in an unsecured bin.

Why This Matters Beyond the Rule Itself

Patients trust the practice with sensitive information because they have to, not because they have a choice. Protecting that information carefully is part of honoring that trust, not just avoiding a violation.

Where Small Slips Happen

Common risks to watch for: discussing account details within earshot of other patients, leaving a screen with patient information visible and unattended, and sharing more information than necessary when a family member calls asking about a balance.

Check Your Understanding

1. What does the "minimum necessary" standard mean?
Correct. The standard limits access and sharing to only what's needed for the task.
Not quite. Minimum necessary means limiting access to only what's needed, and it applies broadly, including billing staff.
2. Why is it important to verify identity before discussing account details by phone?
Correct. Verifying identity is a real safeguard, not just a formality.
Not quite. This step genuinely protects both the patient's information and the practice.
3. What should guide how much information is shared when a family member calls about a balance?
Correct. Family relationship alone doesn't justify sharing more than