Twelve questions in six categories filter out the vast majority of medical billing contract risk. Ask them all in writing. Save the answers.
Pricing structure and hidden fees
Q1. What is the total effective cost as a percentage of collections?
The industry standard is 4 to 9 percent of net collections for physician outpatient billing. Ask the vendor to model your specific volume and show the total effective rate. Watch for pricing structures that combine a base fee, per-claim fee, and add-on fees; the total is what matters, not the headline percentage.
Q2. What is on the add-on fee list?
Ask for the full price list of anything that can be billed separately: patient statements, printing, postage, credentialing services, prior authorization, appeals, secondary claims, refund processing, EOB reconciliation, custom reports. Legitimate vendors have this list. Vendors that improvise fees during the relationship do not.
Performance minimums and reporting cadence
Q3. What are the committed performance minimums and rebate structure?
Reasonable metrics with monthly measurement: first-pass claim acceptance rate (target 92-97%), days-in-A/R (target 30-45 days), denial rate (target under 10-12%), unposted-payment rate (target under 3%). Rebate clause example: "If first-pass acceptance falls below 92% for two consecutive months, fees for the third month are waived."
Q4. What monthly report will I receive and can I see a sample?
Ask for a sample monthly report from a similar-sized practice, with the practice name redacted. The report should include claim volume, collections, aging bucket breakdown, denial-reason distribution, top-denied payers, and per-provider productivity. If the vendor cannot produce a sample, the reporting is either non-existent or off-the-shelf.
Data ownership and return process
Q5. Who owns the billing data?
The practice owns it. The contract must state this. Read the data-ownership clause word for word. Any assignment of ownership to the vendor is a walk-away signal.
Q6. What is the day-of-termination data return process?
Specify format (CSV export or SQL dump), delivery timeline (typically 30 days from termination notice), completeness (all patient demographics, all claim history, all payment postings, all correspondence with payers), and cost (should be zero — ransom fees for data return are a red flag).
Termination notice and evergreen clauses
Q7. What is the termination notice period and does the contract auto-renew?
Reasonable notice periods are 60 to 90 days. Evergreen auto-renewal is acceptable only if the notice window is 60 days or longer and the notice can be delivered via email. Notice requirements demanding certified mail to a specific corporate address are structural attempts to lock in another term after the practice has decided to leave.
Q8. What happens to claims in flight at termination?
Two acceptable answers: (a) the vendor completes claims already submitted to payers and hands off any pending appeals with documentation, or (b) the vendor performs a clean handoff to the successor vendor with detailed status notes. Any answer that leaves in-flight claims stranded is a fee-shifting problem.
Coder credentials and staffing model
Q9. What certifications do the coders on my account hold?
Ask for names and credential numbers. CPC (Certified Professional Coder), CPB (Certified Professional Biller), CCS (Certified Coding Specialist), CCS-P, and RHIA are the standard credentials. Verify names on aapc.com and ahima.org public directories. Uncredentialed coders introduce compliance risk that ripples into audit exposure.
Q10. Is the coding work performed onshore, offshore, or a mix?
HIPAA does not prohibit offshore coding, but it must flow through subcontractor BAAs with the same safeguards as domestic operations. Get a written answer on which functions are offshored, to which countries, and whether the vendor's cyber-liability insurance covers offshore incidents. If domestic-only is a practice requirement, insist on that clause in the BAA.
Compliance evidence
Q11. Can I see the Business Associate Agreement and most recent HIPAA risk analysis?
A compliant vendor produces the BAA template in advance and provides an executive summary of the most recent risk analysis on request. A vendor that treats these as sensitive-and-unavailable is telling you something important about the compliance program.
Q12. What are the cyber-liability insurance limits and does the coverage include breach-notification costs?
Industry norm for a mid-sized billing vendor is $1 million to $5 million per incident with breach-notification costs included. Confirm limits, deductible structure, and whether coverage applies to subcontractor incidents. Ask for a certificate of insurance naming your practice as additional insured or certificate holder.
Sample follow-up email
Subject: Follow-up questions before contract signature — [Practice Name]
Team,
Before we finalize, please provide written answers to the twelve questions in the attached PDF, and the following six documents:
- Signed Business Associate Agreement template
- Executive summary of most recent HIPAA risk analysis
- Cyber-liability insurance certificate (limits, deductible, additional-insured status)
- Coder credential list with AAPC/AHIMA credential numbers
- Three current client references in [our specialty]
- Sample monthly report from a similar-sized practice (practice name redacted is fine)
Please confirm receipt and provide a target date for the response.
Thanks,
[Name]
What the answers tell you
The pattern of responses is as informative as the content:
- Vendors that answer completely within a week: mature, compliant, likely to communicate well during the relationship
- Vendors that answer partially: probably have gaps in their compliance program that will surface later
- Vendors that resist the request or claim documents are unavailable: not equipped to be a compliant business associate; walk away
Bottom line
Twelve questions in six categories, plus six documents, plus a follow-up email that creates an audit trail. Two hours of due diligence up front avoids months of relationship pain later.