How to Choose a Medical Billing Company: Technical Standards Guide

Choosing a medical billing vendor is a revenue-integrity decision, not a procurement one. A poorly matched vendor directly reduces cash flow, increases compliance exposure, and creates operational friction.

This guide applies benchmarks from the Healthcare Financial Management Association (HFMA) and Medical Group Management Association (MGMA) to establish minimum performance thresholds. Any vendor failing to document these metrics should be disqualified early.

• First-Pass Clean Claim Rate: 95%
• Denial Rate: 5%
• Days in Accounts Receivable: 30 days
• Net Collection Ratio: 96%

Vendors that cannot produce 12 months of production data demonstrating these outcomes are not operating a modern revenue cycle management.

Before evaluating vendor features, establish performance floor criteria. Request audited production data (not marketing claims) across these four metrics.

• Industry standard: 95%
• What this means: Claims accepted on first submission without rejection or rework
• Why it matters: Below 95% indicates either poor medical coding discipline, weak payer knowledge, or insufficient data validation.
• How to verify: Ask for 12-month FPCR by claim type (professional vs institutional) and by your specialty. Request the denominator (total claims submitted) and numerator (claims paid/accepted without adjustment on first pass).

• Industry standard: 5%
• What this means: Percentage of claims that receive full or partial denial
• Why it matters: Denials cost money (rework, appeals, cash flow delay). High denial rates indicate coding deficiencies or payer contract misalignment. A structured denial management program should be a core vendor capability.
• How to verify: Request denial volumes (not just rates) and the CARC (Claim Adjustment Reason Code) breakdown. Common codes:
  • CO-16: Missing, incomplete, or invalid member identification number
  • CO-97: The benefit for this service is included in the payment/allowance for another service already adjudicated
  • CO-45: Charge exceeds reasonable and customary fee or maximum allowance
  • PR-96: Non-covered service because it does not meet the definition of any covered service

• Industry standard: 30 days
• What this means: Average calendar days from service date to payment receipt
• Why it matters: Every day delay is deferred cash. 30 DAR maintains operational liquidity
• How to verify: Request a 12-month average. Distinguish between (a) days from claim submission to payment and (b) days from service date to payment. Ask for aging buckets: 30 days, 31-60, 61-90, 91+.

• Industry standard: 96%
• What this means: Collections / (Gross charges minus contractual adjustments), expressed as a percentage
• Why it matters: Reveals how much of what should be collected is actually collected
• How to verify: Request the calculation method. A 96%+ NCR means write-offs and uncollected accounts are controlled.

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), effective January 1, 2026, mandates that payers expose three sets of APIs using HL7 FHIR:

1. Patient Access API — Patients can retrieve their records and claim information
2. Provider Access API — Authorized providers (billers, clinicians) can retrieve patient records and prior auth status
3. Prior Authorization API (Da Vinci Prior Authorization Service) — Streamlines PA workflows

Your vendor selection must verify FHIR-native capability, not portal scraping.

1. Do you natively consume and produce X12 EDI transactions (837, 835, 277CA)?
2. Do you have a HL7 FHIR US Core implementation?
3. Do you support Da Vinci PAS (Prior Authorization Service) for automated PA submission?
4. Which payers’ FHIR endpoints do you currently read from (UnitedHealth, Aetna, Blue Cross, Humana, etc.)?
5. What is your roadmap for CMS-0057-F full compliance? (Deadline January 2026 for large payers; December 2026 for smaller plans.)

• “We have APIs” without specifying FHIR or EDI standards
• Only web portal scraping (screen-scraping is fragile and non-compliant)
• No timeline for 835/277CA EDI adoption
• No mention of FHIR or Prior Authorization API capability

Minimum Requirements:

• HIPAA Business Associate Agreement (BAA)  non-negotiable
• Encryption at rest (AES-256 or equivalent) for all patient data
• Encryption in transit (TLS 1.2+)
• Minimum necessary standard: vendor should only access data required for billing functions
• Audit logging with retention 6 years
• Breach notification procedures documented and tested

HIPAA Security Rule NPRM (2025): The HHS Office for Civil Rights issued an NPRM proposing updates to the HIPAA Security Rule. Key proposals affecting vendors:

• Multifactor authentication (MFA) required for all access
• Encryption standards strengthened
• Vendor risk management framework required

Ask vendors: “Have you implemented MFA for all portal access? What is your roadmap for NPRM compliance?”

Critical distinction:

• SOC 2 Type I — A snapshot of security controls at a point in time. Inadequate for ongoing trust.
• SOC 2 Type II — Auditor assessment of controls over a minimum 6-month period. The actual standard for vendors.

Demand SOC 2 Type II. Request the full report (or auditor attestation) covering:

• Security (CC controls)
• Availability (A controls)
• Processing Integrity (PI controls)
• Confidentiality (C controls)
• Privacy (P controls)

Payers and health systems increasingly require HITRUST (Health Information Trust Alliance) Common Security Framework. It combines HIPAA, HITECH, and ISO 27001 standards.

If your practice receives revenue from large payers or works with ACOs, ask: “Are you HITRUST certified? What is your timeline to certification?”

A clean claim is submitted with complete, accurate, compliant information. NCCI (National Correct Coding Initiative) edits define bundling rules, modifier requirements, and claim-level logic.

• Does the vendor apply CMS NCCI edits before submission?
• Do they update NCCI edits monthly? (CMS releases updates on the 15th of each month)
• Do they handle modifier logic correctly? (Modifiers 25, 59, XE, XS, XP, XU override specific bundles per CPT Guidelines)

• Local Coverage Determinations (LCDs) are payer-specific. Does the vendor maintain an updated LCD database?
• CMS LCD Search Tool
• National Coverage Determinations (NCDs)
• Does the vendor pre-validate claims against LCDs before submission?
• How do they handle LCD changes? (Turnaround time to implementation?)

• Pre-submission claim scrubbing (before it hits the payer)
• Patient eligibility verification with real-time payer lookup
• Provider credentialing verification
• Missing required fields detection

• “We submit claims as billed” (no pre-validation)
• No mention of NCCI edits
• LCD compliance is reactive (identified after denial)
• No real-time eligibility verification

Modern denial management is not manual; it is data-driven. A robust program categorizes denials by root cause and targets prevention.

1. Do you track denials by CARC code and provide monthly root-cause summaries?
2. What is your appeal success rate by CARC category?
3. Do you distinguish preventable denials (should not occur) from systemic denials (require process change)?
4. Do you provide a dashboard showing denial trends by payer, by specialty, by provider?
5. What is your average turnaround time for filing appeals?

• Redetermination (First level): Typically 30-day turnaround (per Medicare Appeals Process)
• Reconsideration (Second level): 60-day turnaround
• Administrative Law Judge (ALJ) (Third level): 90+ days
• MAC (Medicare Appeals Council): For Medicare cases

Ask vendors: “What is your success rate at each appeal level? Can you provide data by diagnosis code?”

Medical billing vendors use three pricing models. Understand the tradeoffs:

• Pro: Cost scales with practice revenue
• Con: Vendor profit motive may reduce aggressive AR follow-up on large balances
• Benchmark range: 4–6% for high-performing vendors; 6–9% for basic services

• Pro: Predictable budget
• Con: May not scale with practice growth
• Benchmark range: $1,500–$5,000/month depending on claims volume

• Pro: Fixed cost per transaction
• Con: Incentivizes high-volume claims; less incentive for denial prevention
• Benchmark range: $0.50–$0.75 for professional claims; $0.75–$1.50 for institutional

Assume:

• Monthly claims: 1,000
• Average claim value (gross): $500
• Expected collections: $450 (90% collection rate)
• Monthly revenue: $450,000

• Monthly cost: $27,000 ($450,000 × 6%)
• Annual cost: $324,000

• Monthly cost: $600 (1,000 claims × $0.60)
• Annual cost: $7,200

• Monthly cost: $2,500
• Annual cost: $30,000

Recommendation: For practices with 2,000 claims/month and collections $750,000/month, per-claim or flat-fee models are typically more cost-effective. For larger practices, negotiate a hybrid (e.g., $0.20/claim + 2% of collections >$1M).

Medical billing contracts often contain predatory terms. Identify and negotiate these before signing:

• Default language: Auto-renews unless you notify 60 days prior
• Risk: Easy to miss renewal deadline; locked into unfavorable terms
• Negotiation: Change to 30-day notice or require explicit written renewal

• Default: $5,000–$25,000 early termination fee
• Risk: Locks practice into relationship even if vendor underperforms
• Negotiation: Tie termination fee to performance metrics; waive if vendor misses FPCR/DAR benchmarks

• Default: Vendor owns A/R data; 30-day return window post-termination
• Risk: Vendor leverage to negotiate higher renewal fees; cannot access accounts in transition
• Negotiation: Specify that practice owns all A/R data per 45 CFR 164.308(a)(3)(ii)(C). Require 60-day data access post-termination and full export in standard formats (CSV, HL7)

• Default: Vendor continues posting payments and denials for X days post-termination
• Risk: New vendor cannot access claims; loss of appeal timeline
• Negotiation: Define clear handoff date; require parallel access during transition

• Default: “Minimum 500 claims/month or $X00 fee”
• Risk: Small practices pay fixed amount even if claims volume drops
• Negotiation: Tie minimums to historical average; allow Q2 reset if volume drops >15%

• Default: Vendor claims ownership of custom fee schedules, templates, protocols
• Risk: Cannot take institutional knowledge to next vendor
• Negotiation: Specify that practice retains IP for all custom workflows

•  BAA included and executed (per 45 CFR 164.504(e))
•  Performance metrics (FPCR 95%, DAR 30, NCR 96%) defined as success criteria
•  SLA (Service Level Agreement) for response time, uptime, report delivery
•  Termination fee capped at 1–2 months of average fees; waived for vendor breach
•  Data ownership clause specifies practice ownership of all A/R data
•  60-day data access window post-termination
•  No IP restrictions on practice-developed workflows
•  Audit rights: Practice can audit vendor processes and compliance annually
•  Insurance: Vendor carries errors & omissions (E&O) insurance $1M

Use this scorecard to standardize evaluation across multiple vendors. Weight each criterion by importance to your practice.

• Performance (60–70% total weight) — This is the revenue-integrity decision
• Compliance (30–40% weight) — Non-negotiable minimum
• Technology (25–35% weight) — Enables performance
• Support (15–25% weight) — Enables success
• Pricing/Contract (15–20% weight) — Enables profitability

Selecting a medical billing vendor is a revenue-integrity decision supported by data, not relationships. Use the HFMA/MGMA benchmarks, CMS-0057-F interoperability standards, and contract risk checklist to disqualify underperformers early.

Request references. Audit 12-month production data. Negotiate performance-based terms. Verify compliance posture with SOC 2 Type II and HIPAA documentation.

Do not prioritize lowest cost. Prioritize highest FPCR, lowest DAR, and highest NCR. A 3% improvement in first-pass rate is worth more than a 2% reduction in fees.

If you are evaluating medical billing vendors and need expert billing guidance on revenue cycle optimization, Revix MD specializes in data-driven denial management, FHIR-compliant prior authorization automation, and HFMA-benchmarked performance accountability.

Schedule a Technical Assessment with Revix MD to review your current KPIs against industry standards.