Medical Billing Outsourcing: Cost, Risk, and Liability

The billing failure that costs the most money is also the quietest one. A vendor submits to the primary payer, collects, and then never files with the secondaries. Nothing breaks, no alert fires, and the shortfall only shows up months later as a gap between what you billed and what arrived.

Medical Economics documented exactly that in 2003, when a solo practice lost roughly $20,000 before the pattern surfaced. Everything around billing has changed since then, from clearinghouses to electronic remittance to the compliance regime. The mechanism has not.

This page is not an argument for or against outsourcing your billing. It is about what has to be true about a vendor, and about the contract, before the first claim leaves your office.

We build finance and back-office teams for global companies, and we support 300+ global companies overall. The pattern in the accounts that go wrong is almost never the work itself. It is that nobody on the client side had been assigned to check that the work actually happened. The duty to notice sits with you whatever the contract says, which is the single idea this article is built on: outsourcing the work does not outsource the duty.

What does medical billing outsourcing actually cover?

Medical billing outsourcing covers claims processing and payment posting. Anything wider than that, from patient access and eligibility through coding, denials, appeals and reporting, is revenue cycle management, and it is a different purchase with a different contract. Buying the narrow scope while expecting the wide one is the most common mismatch we see.

If what you actually need is the wider function rather than claims and posting, start with our guide to outsourcing revenue cycle management, because that is a different contract bought from a different vendor category. Worth knowing too that the narrow scope often sits inside a larger healthcare BPO services operation, so the same company may quote you both and call both "billing".

Settle the boundary first, because a fee basis only means something measured against a defined scope.

Is outsourcing medical billing a good idea for your practice?

It depends on a threshold, not a preference. Outsourcing medical billing works when your claim volume is too small to staff properly and too complex to run part time, and when you still have someone senior with the capacity to supervise the vendor afterwards. Without that second condition you have moved the work, not the risk.

Who should outsource billing?

• Single-site practices carrying real volume across a handful of payers: enough claims to need daily attention, not enough to justify a trained team with cover.
• Practices that cannot realistically hire a second biller: one person holding every payer rule, portal login and follow-up queue is a single point of failure, and vacation is the moment it shows.
• Groups adding a location or a second specialty faster than they can hire: the billing capacity has to exist on day one of the new schedule, not three months later.
• Practices where billing happens after hours: when the work is being done by someone whose actual job is the front desk or the clinic, errors are structural rather than individual.

Who should keep it in-house?

• Practices with nobody to supervise the vendor: if no named person on your side will read a monthly submission report and chase what is missing, outsourcing converts a staffing problem into an invisible one.
• High-denial, high-authorization specialties without internal expertise: if you cannot tell a correct denial from a wrong one, you cannot tell a good vendor from a bad one either.
• Practices with unresolved data hygiene: if your charge capture, fee schedule or payer contract loads are wrong, a vendor will submit wrong claims faster and more consistently than you did.
• Anyone whose shortlist is priced below the cost of the work: a quote that cannot fund the staffing is not a saving, it is a deferred problem.
• Anyone treating this purely as headcount reduction: the supervision does not disappear, it changes shape, and it usually lands on a senior person who has less time than the biller did.

The supervision question is not specific to claims. It is the same failure mode we see when practices buy healthcare IT outsourcing and assign nobody to check the output. Billing is also rarely the only function under strain, so it is worth scanning the other outsourcing options for a small practice before you conclude billing is the right one to move first. For a wider view of which functions travel well to a provider and which do not, our guide to HR outsourcing benefits and types sets out the model choices in plain terms.

How much does it cost to outsource medical billing?

You pay on one of three bases: a percentage of collections, a rate per claim or transaction, or a fixed monthly or per-FTE fee. The basis matters more than the rate, because each one quietly rewards different vendor behavior. Establish what the fee is calculated on before you compare two quotes.

The comparison a buyer actually needs is the cost of running it yourself. The U.S. Bureau of Labor Statistics counts 194,720 Medical Records Specialists employed nationally, at a median annual wage of $51,140 and a mean annual wage of $56,790, as of May 2025, in its Occupational Employment and Wage Statistics.

Those are wages, not the cost of the function. Add payroll taxes and benefits, the clearinghouse, the billing software, the workstation, and the cover you need for the two weeks when the one person who knows your payer rules is away. The fee basis question shows up in every back-office function, which is why it helps to understand how payroll outsourcing is priced before you assume a percentage fee is simply how this market works.

That total is what a low quote has to be measured against. Claims work is labor, and a fee that sits well below the rest of your shortlist has to come from somewhere: fewer people, less experienced people, or more accounts per person. A quote far under the others is information about staffing levels, not a discount.

Expert Tip: On a percentage-of-collections deal, ask in writing whether the fee is calculated on net collections or on charges submitted, and whether it applies to patient-responsibility balances your front desk collects at the counter. That difference is usually larger than the gap between two vendors' rates.

What does HIPAA actually require when a vendor handles your claims?

A billing vendor is a business associate by name in the regulation, and the regulation does not let you hand the duty over along with the work. 45 CFR 160.103 lists claims processing and billing as business associate functions, and 45 CFR 164.504(e)(1)(ii) says a covered entity is not in compliance when it knew of a pattern of activity by that business associate and did nothing about it.

Who counts as a business associate, and does that include your vendor's subcontractor?

45 CFR 160.103 defines a business associate as a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a regulated function, "including claims processing or administration... and billing".

So there is nothing to argue about on scope. The regulation names the function you are buying. A vendor that describes itself as a technology platform, a service bureau or an administrative partner is still a business associate if it touches PHI to process your claims.

The chain does not stop at your vendor either. 45 CFR 160.103(3)(iii) states that "Business associate includes... a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate." The offshore delivery team, the coding partner, the storage provider: each one your vendor uses is itself a business associate in its own right.

That is why "who else touches this data" is a compliance question and not merely a service preference.

What does a signed BAA actually get you?

45 CFR 164.502(e)(1)(i) permits a covered entity to disclose PHI to a business associate only where it "obtains satisfactory assurance that the business associate will appropriately safeguard the information". Under (e)(1)(ii), your vendor owes that same duty toward its own subcontractor. Under (e)(2), those assurances "must be documented through a written contract or other written agreement".

Read the verbs. The regulation asks you to obtain an assurance and then to document it. Signing is the evidence step, not the substance.

• The written agreement is the minimum, not the outcome: 45 CFR 164.502(e)(2) requires the assurance to be documented, which makes an unsigned BAA a straightforward gap and a signed one a starting position rather than a finished job.
• Ask for your vendor's subcontractor BAAs, not only your own: under 45 CFR 164.502(e)(1)(ii) the duty to obtain assurance runs down the chain, so a vendor that cannot name its subcontractors cannot demonstrate it met that duty.
• "Satisfactory assurance" is something you obtained, so be able to show how: 45 CFR 164.502(e)(1)(i) is written as an obligation on you, the covered entity, which means your diligence file is part of your compliance position.
• A subcontractor is a business associate in its own right: 45 CFR 160.103(3)(iii), which is the reason undisclosed subcontracting is disqualifying rather than merely irritating.

What happens if you know your vendor has a problem and do nothing?

This is the part buyers miss, and it is the whole reason this page exists. 45 CFR 164.504(e)(1)(ii) provides that a covered entity "is not in compliance" if it "knew of a pattern of activity or practice of the business associate that constituted a material breach or violation" of the business associate's obligations, "unless the covered entity took reasonable steps to cure the breach or end the violation" and, where those steps failed, "terminated the contract or arrangement, if feasible".

Read that as a sequence: knowledge, then cure, then termination if the cure fails. Each step is something you have to be able to show you did.

Signing a BAA bought you a document. It did not buy you an exit from the duty. The practice in the secondary-payer case had a contract. What it did not have was a monthly report that would have surfaced the pattern in the first few weeks rather than after a year of it.

45 CFR 164.504(e)(1)(iii) puts the identical duty on a business associate toward its own subcontractor, which is the same obligation running one more link down the chain. If your vendor cannot describe how it supervises its subcontractor, it is carrying an open exposure and so are you.

The procurement consequence is concrete. Your contract has to define what a pattern looks like, and your monthly routine has to be capable of noticing one. That is a governance design task, and it sits alongside the rest of your compliance and legal management obligations and a written data protection policy that states where PHI may and may not go.

Pro Tip: "Knew of a pattern" is a standard you either measure or argue about after the fact. Define the pattern in the contract: a named denial-rate ceiling, a maximum days-to-submit, a maximum time to answer a coding query, and the number of consecutive misses that triggers cure and then termination. Then it is a report you read monthly instead of a dispute you lose later.

Which red flags should disqualify a billing vendor?

The disqualifying flags are not about price or software. They are about evidence that claims actually go out, and that a named person answers when one does not. Each check below is one you can run during diligence, using documents a vendor either has to hand or does not have at all.

• No evidence of secondary-payer submission: ask for a sample report showing claims submitted to secondary and tertiary payers after the primary paid. The $20,000 case was not a coding failure. The vendor billed Medicare, stopped there, and nobody on the practice side was reading a submission report that would have shown it.
• No accountable named person: ask who specifically answers when a claim does not go out, what authority that person has to reassign work and approve a correction, and who covers when they are away. A vendor that answers with a shared inbox or a ticket queue has told you that no individual owns your account. That is an ownership gap rather than a skills gap, and it is the cheapest thing to test in a sales process.
• Undisclosed subcontractors or undisclosed staff location: if a vendor will not name its subcontractor chain in the BAA, you cannot satisfy 45 CFR 164.502(e)(1)(ii), and 45 CFR 160.103(3)(iii) makes each of those subcontractors a business associate anyway. Ask for the chain in writing, by legal entity name and country.
• A rate too low to staff the work: a vendor that priced below the cost of doing the job has to recover it somewhere, and it is usually in caseload per biller. If one quote is far under the others, ask how many people will touch your claims, at what seniority, and how many other accounts those same people carry.

What happens if your billing vendor goes down?

Handing billing to a single vendor concentrates your cash flow inside that vendor's uptime, and very few practices price that risk. The American College of Surgeons Bulletin described a small surgery practice whose billing company was hit by ransomware in February 2024, and the result was blunt: "no invoices were processed... the surgery practice's income stream went dry and came to a complete stop." That is a treasury exposure living inside a back-office contract.

So ask three things before you sign. Where does the claim queue physically live, and can you reach it without the vendor's help. Who on your side is able to submit claims if the vendor cannot, and have they ever actually done it. And what notice period, handover format and data-return deadline apply if you exit under pressure rather than at renewal.

The diligence habits transfer from other categories almost unchanged, and how buyers vet an IT outsourcing company covers the continuity and exit questions in more detail than most billing RFPs do.

What should you ask before sending claims offshore?

Treat offshore delivery as a governance question, not a cost question. The honest record is mixed: practitioners report moving billing offshore and then bringing it back in house, and some vendors sell a domestic delivery footprint as their main trust signal. What separates the two outcomes is supervision design rather than geography.

We are not going to argue with anyone who has had that experience. If work went offshore and came back, something in the arrangement was not being supervised, and saying so is more useful than explaining it away.

Billing and accounts-receivable work is commonly delivered offshore, India among the usual locations, and where the desks sit is not the variable that decides the outcome. These five questions are:

• The subcontractor chain named in the BAA: who employs the people touching PHI, in which legal entity, in which country, consistent with 45 CFR 160.103(3)(iii).
• The coding QA sampling rate and who samples: what share of claims is reviewed, by whom, at what seniority, and whether that reviewer sits inside the production team or independent of it.
• Who holds the payer portal credentials: credentials in your name with vendor access granted and revocable by you, or vendor-held logins you cannot switch off on a Friday afternoon.
• An escalation SLA expressed in your time zone: a response commitment written against your business hours, not the delivery site's, with a stated path for when the first responder is asleep.
• One named accountable person with authority to fix: not an account manager who relays messages, but someone who can reassign work, approve a correction, and answer for a missed submission.

Distance is not the problem. Unowned work is the problem, and those five questions are how you tell one from the other. If you are still weighing delivery footprints, onshore versus offshore delivery sets out the trade-offs. Before you compare quotes, though, read our explainer on offshoring versus outsourcing, because those two decisions get conflated constantly and they are not the same choice.

What are your options if you do not want a billing vendor?

There are four paths, and they differ on who employs the staff and who directs the work. Only two of them are outsourcing at all. Setting up your own entity and using an employer of record keep the direction of the work with you, while staffing and managed services move some or all of it to a provider.

Can you build the billing team in-house?

• Set up a legal entity: full control, your own employees, and the full compliance and setup responsibility sits with you.
• Use an employer of record: no local entity required, the EOR is the legal employer of the staff, and you direct the work.

Or should you hand the function to a provider?

• Staffing or staff augmentation: you get people working for you, they remain employed by the outsourcing company, and you direct the day-to-day work.
• Managed services or an outsourcing company: you hand over a function, process or project, and the provider takes responsibility for delivery.

If the third and fourth paths are the two you are weighing against each other, our comparison of staff augmentation and outsourcing lays out where each one genuinely fits. Two adjacent options are worth naming so you do not confuse them with these four: recruitment process outsourcing buys recruiting capacity rather than a staffed billing desk, and build, operate and transfer is a staged version of the entity route where a partner stands the team up and hands it over later. If managed services is the path you want, the established BPO provider market is where that shortlist comes from.

Two of those four paths are where we work, and it is worth being precise about which. We support the employment and hiring side: employing your billing and accounts-receivable staff as the legal employer of record, setting up your own entity, and building capability centers in India. We do not deliver managed services, we do not run a billing function for a client, and we do not provide staff augmentation. Across the employment models we do run, we currently employ and pay 2,000+ employees on behalf of clients, which is a run-state payroll and supervision job rather than a process delivery job.

Will AI replace medical billers?

No, and the reason is sitting in the failure record. Every loss described on this page is a judgment or follow-up failure rather than a keystroke failure. Automation is already dependable at the repetitive parts of claims work. It is not the thing that notices nobody billed the secondary payer for eight months.

What automation does reliably today:

• Eligibility and benefit checks: batch verification against payer systems before the visit, which removes a large share of avoidable front-end denials.
• Claim scrubbing: rule-based validation against payer edits and format requirements before submission.
• Coding suggestion: proposing codes from the documentation for a human to accept, amend or reject.
• Payment posting: matching electronic remittance files to claims and posting the cash with minimal handling.

What still needs a person:

• Payer-specific denial logic: the unwritten behavior of a given plan in a given state, which lives in someone's memory and in last month's appeal outcomes.
• Appeals: assembling the argument, the documentation and the timeline, then escalating when the first response is a form letter.
• Secondary-payer follow-through: the sequence that cost one practice $20,000 was not hard to execute. It was simply unowned, and no automation assigns ownership.

The occupation is large, as the employment figure in the cost section above shows, and what we see is reassignment rather than replacement: fewer hours on data entry, more hours on the payer-by-payer follow-up that actually produces the cash. Where outsourcing automation is heading tracks the same shift across other functions.

What belongs in the contract before you send the first claim?

The contract is where the supervision duty from the HIPAA section becomes operational. Four clauses do most of that work: data ownership and return on exit, credential control, a defined pattern-of-activity trigger with cure and termination steps, and the notice period with run-off on tail claims.

• Who owns the claims and remittance data on exit, in what format and by when: name the file formats, the delivery deadline in days from notice, and who bears the extraction cost. "Our data" on its own is not a clause.
• Who holds the payer portal credentials: credentials issued in your name, with vendor access granted and revocable by you, is what keeps you able to submit claims on the day the relationship ends badly.
• The defined pattern-of-activity trigger, with its cure and termination steps: write your thresholds into the agreement with a cure window and a stated number of consecutive misses, so that the route described in 45 CFR 164.504(e)(1)(ii) is available to you as a contractual right rather than a negotiation.
• The notice period, and run-off or tail claims after termination: who works the claims already submitted, who works the balances aged in accounts receivable, for how long, and at what fee.
• The master services agreement as the container: a master services agreement holds the commercial, liability and data terms while statements of work carry scope, so scope can change without reopening the liability position every time.

You also need a measurement set to hold the vendor to, and those key performance indicators belong in a contract schedule rather than in a quarterly slide. For the measurement set itself, our guide covers the revenue cycle KPI set to hold a vendor to, and it is the better place to pick your thresholds from than this page.

How can Wisemonk help you build a billing team?

Wisemonk is a India native Employer of Record (EOR) that helps global companies hire, pay, and manage employees without setting up a local entity. We simplify complex HR operations so you can focus on strategy, not administration.

Here's how we help businesses manage medical billing outsourcing more effectively:

• Employer of Record: employ billing and accounts-receivable staff without your own entity, from $99 per employee per month.
• Mira AI: free hiring software that scores applicants against a scorecard you write, and Finance and Accounting is one of its ten role categories, covering bookkeeping, accounts payable and receivable, payroll and tax.
• Background verification: screening for staff who will touch protected health information, with 19 check types, from $50 per candidate for the standard package, as of September 2026.
• Capability center setup: the captive-team alternative to a vendor, priced on a custom quote.
• Entity setup: the route for a team you intend to own outright, priced on a custom quote.

What do clients say about working with us?

The accountability point this article keeps returning to, one named person who answers when something goes wrong, is the thing clients tell us matters most once the work is actually running.

Wisemonk is easy to implement and use. We have been able to hire and manage overseas resources without any hassle. The support by the Wisemonk team is top class, We have a dedicated account manager who ensures that all our queries are answered and resolved immediately. They saved a lot of our manual resource time.

Manasij G, Co-founder and CEO (G2 review)