US Medical Billing
A/R & Follow-Up

Outsourced A/R Vendor Oversight: Rights You Already Have

Engaging a billing company moves the work. It does not move the responsibility for the work being right, and federal rules are unusually explicit about this. Where an entity is paid under a contractual reassignment, that entity and the practice that furnished the service are jointly and severally responsible for any Medicare overpayment — and the practice has an unrestricted right of access to the claims submitted on its behalf, enforceable against a vendor that will not produce them. Most oversight failures are not failures to negotiate those rights. They are failures to use rights already held.

Updated 10 min read

On this page

Key takeaways

  • The liability does not follow the work. Under 42 CFR 424.80(d)(1), an entity paid under a contractual reassignment and the supplier who furnished the service are jointly and severally responsible for any Medicare overpayment.
  • A practice has unrestricted access to claims submitted on its behalf, and a vendor that refuses to provide billing information on request risks revocation of its right to receive reassigned benefits.
  • That access right is the whole basis of real oversight: a practice entitled to claim-level data does not have to accept a summary report as the only account of its own receivable.
  • Where a vendor receives the payment itself, the arrangement enters a rule with strict conditions on the agent's compensation, and payment is always issued in the name of the provider.
  • A vendor's report is the vendor's account of its own performance. Oversight begins where an independent view of the same book begins — the practice's own system, its own aging, its own cash.
  • The measures that matter are the ones a vendor cannot restate favorably: what was never billed, what aged past a deadline, and what was written off without a decision.
  • Every oversight arrangement should be designed to survive its own ending. The exit — data, work in progress, open balances — is the part that is hardest to negotiate afterward.

The liability does not move with the work

The most common misunderstanding about outsourced billing is that it transfers exposure along with the workload. It does not. Where an entity enrolled in Medicare receives payment under a contractual arrangement and the supplier who furnished the service would otherwise have been paid, 42 CFR 424.80(d)(1) (opens in a new tab) makes the two jointly and severally responsible for any Medicare overpayment to that entity. Jointly and severally means the program may look to either party for the whole amount. It does not have to apportion fault first, and it does not have to read the service agreement.

An indemnity clause is worth having and does not change this. Indemnity is a promise between the practice and the vendor about who ultimately bears a cost; it is not a defense against the party seeking the money, and it is worth exactly what the vendor is able to pay when it is invoked. The practical reading is simple: a coding or billing error made by a vendor is, as far as the program is concerned, the practice's error too.

And nothing about outsourcing displaces the other rules

The same regulation opens by preserving everything else that applies: nothing in it alters a party's obligations under the anti-kickback statute, the physician self-referral prohibition, the rules on billing for purchased diagnostic tests, or the incident-to rules. A billing arrangement is not a container that other obligations stay outside of, and an arrangement designed only for administrative convenience can still sit inside one of them.

You already have a right to the claim data

This is the provision worth knowing verbatim in substance, because it converts oversight from a negotiation into an entitlement. Under 42 CFR 424.80(d)(2) (opens in a new tab), the supplier who furnishes a service has unrestricted access to claims submitted by an entity for services provided by that supplier. The rule states that it applies whether or not the supplier is an employee and whether or not the service is provided under a contractual arrangement — so the shape of the commercial relationship does not narrow it.

There is an enforcement consequence, and it is the vendor's

The same paragraph continues: if an entity refuses to provide billing information to the supplier who performed the service upon request, the entity's right to receive reassigned benefits may be revoked. That is a meaningful asymmetry, and few practices realize they hold it. A vendor's ability to be paid on the practice's behalf is conditioned on producing the practice's own billing data when asked.

The everyday version of the problem this solves: a practice receives a monthly summary — charges, collections, an aging table, a paragraph of commentary — and has no way to test any of it, because the underlying claims live in the vendor's system. The summary is the vendor's account of the vendor's own performance. That is not a criticism of vendors; it is a structural fact about self-reporting. The access right is what makes an independent account possible.

A report
An aggregate the vendor produced, on the vendor's definitions, from the vendor's data. Useful, and not verifiable from itself. Two vendors can compute the same-named measure differently and both be honest.
The claim-level data
The rows behind the aggregate — what was billed, when, for whom, what came back, what was adjusted and why. This is what the access right reaches, and what makes any of the aggregates checkable.
An independent view
The same book seen from the practice's own system and its own bank — the deposits that actually arrived, the balances still open, the encounters that never became claims. The point of oversight is that this exists at all.

Where the money lands changes which rule applies

Medicare's default is that payment goes to the party that furnished the service. 42 CFR 424.73(a) (opens in a new tab) states the prohibition for providers and 424.80(a) the parallel one for suppliers: Medicare does not pay amounts due to any other person under assignment, power of attorney, or any other direct payment arrangement, except as specifically permitted. Reassignment is the term for the permitted exceptions, and one of them covers an agent that furnishes billing and collection services.

That exception is conditional, and the conditions are the part that surprises people. Under 424.73(b)(3), Medicare may pay such an agent only if all of the following hold — and 424.80(b)(5) applies the same set to a supplier's agent.

  • The agent receives the payment under an agency agreement with the provider.
  • The agent's compensation is not related in any way to the dollar amounts billed or collected.
  • The agent's compensation is not dependent upon the actual collection of payment.
  • The agent acts under payment-disposition instructions that the provider may modify or revoke at any time.
  • The agent, in receiving the payment, acts only on the provider's behalf.

The regulation then adds a sentence that is easy to skim past and useful to hold onto: payment to an agent will always be made in the name of the provider. The money is identifiable as the practice's throughout, which is what makes the fourth condition — instructions revocable at any time — operable rather than theoretical.

Read this narrowly, because it is narrow

These conditions attach to the arrangement in which the agent itself receives the payment. They are not a general federal prohibition on percentage-based billing-service fees, and nobody should read one here. What they do establish is that routing program money through a vendor moves the arrangement inside a rule with strict conditions on how that vendor may be compensated — which makes it worth knowing, in writing and before it matters, which frame a practice's own arrangement sits in. That question, and the anti-kickback question the regulation expressly preserves, are for the practice's own counsel reading the practice's own agreement.

What oversight actually consists of

Rights are only useful when something routinely exercises them. The oversight that works is not an annual review meeting; it is a small number of questions asked continuously, from data the practice can see for itself.

  1. Reconcile cash to the bank, not to the report

    The one check no vendor report can substitute for. Money the practice actually received, from its own bank, against what the vendor says was collected. This is the same discipline the corpus applies to in-house posting, and it is the first thing to establish because everything else is downstream of it.

  2. Keep your own aging

    Produced from the practice's system, on the practice's definitions, so that A/R aging has a second source. Where the two disagree, the disagreement is the finding — most often a difference in when the clock starts or in what counts as an open balance, which is worth knowing regardless of who is right.

  3. Watch the things a summary cannot show

    Work never billed, claims aged past a filing deadline, and balances written off without a decision. These are invisible in a collections total by construction: an encounter that never became a claim contributes nothing to any of the numbers a vendor reports on, which is precisely why it is where unmanaged loss accumulates.

  4. Sample the claim-level detail, on a schedule

    Not an audit of everything — a routine, small, unannounced pull of the underlying rows, tested against what the practice knows independently. The value is partly what it finds and mostly that it happens at all. This is the access right doing work.

  5. Ask who owns the write-off decision

    A vendor compensated on collections has no reason to pursue an account it judges uncollectible, and every reason to close it. That is not bad faith; it is the arrangement. Whether the practice or the vendor decides when to stop pursuing a balance is a policy question that should be answered explicitly rather than settled by default in a queue.

Design the exit while you are still happy

The hardest thing to negotiate is an ending, and the worst time to negotiate it is during one. Three questions decide whether a transition costs a quarter's cash or a week of inconvenience: who holds the data and in what form it is returned, what happens to claims in flight and appeals part-heard, and who works the open balances during the overlap. A practice that has answered those on the way in has a real alternative to its vendor, which is also the only thing that makes the rest of oversight persuasive. The mechanics of moving a receivable — and the way an aging start date resets when balances are loaded somewhere new — are the same ones A/R at a system conversion runs into.

Common questions

If the vendor made the error, why is the practice liable for the overpayment?

Because the regulation says both parties are. Where an entity receives payment under a contractual reassignment, that entity and the supplier who furnished the service are jointly and severally responsible for any Medicare overpayment to the entity — which means the program can recover the full amount from either one without first deciding whose mistake it was. A contractual indemnity between the practice and its vendor is still worth having, but it operates between those two parties afterward; it is not a defense to the recovery itself, and it is only as good as the vendor's ability to honor it.

Can a vendor refuse to give us claim-level data?

Not without consequence. A supplier has unrestricted access to claims submitted by an entity for services that supplier provided, and the rule is explicit that this applies regardless of whether the service was furnished under a contractual arrangement. An entity that refuses to provide billing information upon request may have its right to receive reassigned benefits revoked. In practice the conversation rarely gets that far — but knowing the request rests on a regulation rather than on goodwill changes how it is made, and it is worth putting the expectation into the agreement so that routine access never depends on the point being argued.

Are percentage-of-collections billing fees prohibited?

That is not what the regulation says, and it would be wrong to summarize it that way. The conditions on compensation — not related in any way to the dollar amounts billed or collected, and not dependent upon actual collection — govern the arrangement in which Medicare pays an agent that furnishes billing and collection services, which is a question about who receives the money. Many arrangements are structured so that payment goes to the practice and the vendor invoices separately. Which structure a given agreement creates is a legal question about that agreement, and the same regulation separately preserves anti-kickback and self-referral obligations that any compensation design has to satisfy on its own terms.

What should we monitor if we only have time for a few things?

Cash against the bank, an aging produced from your own system, and the population that never became a claim. The first is the only figure that cannot be presented favorably. The second gives you an independent view of the same book, so that a disagreement with the vendor's aging becomes visible as a disagreement rather than being absorbed. The third matters because it is structurally missing from every collections report — an encounter that was never billed produces no claim, no denial and no aged balance, so a vendor can be performing well on everything it reports while work quietly expires upstream of all of it.

Does a business associate agreement cover the oversight obligations?

It covers a different set of them. A business associate agreement governs how protected health information may be used and disclosed and what happens when it is mishandled; it is required, and it is not a performance-management instrument. The payment and access provisions discussed here come from a separate part of the regulations and attach to the payment relationship rather than to the privacy one. A complete arrangement usually has both, plus a service agreement dealing with scope, reporting and the exit — and it is worth checking that the three do not contradict each other on data return, because that is the term all of them touch.

Key terms in this article

Defined once, on their own pages.

Continue learning

The decision that comes before this, and the checks that follow it.

Authoritative sources

  • 42 CFR § 424.80 — Prohibition of reassignment of claims by suppliers (opens in a new tab)

    States the default prohibition on Medicare paying anyone other than the supplier, and the exceptions permitting it. Paragraph (a) expressly preserves obligations under the anti-kickback statute, the physician self-referral prohibition, the purchased-diagnostic-test rules and the incident-to rules. Paragraph (b)(5) applies the agent conditions of § 424.73(b)(3) to a supplier's agent and requires payment always to be made in the supplier's name. Paragraph (d)(1) makes an entity paid under a contractual arrangement and the supplier jointly and severally responsible for any Medicare overpayment to that entity; paragraph (d)(2) gives the supplier unrestricted access to claims submitted for services it provided — irrespective of employment status or contractual arrangement — and provides that an entity refusing to supply billing information on request may have its right to receive reassigned benefits revoked under § 424.82(c)(3).

  • 42 CFR § 424.73 — Prohibition of assignment of claims by providers (opens in a new tab)

    The parallel prohibition for providers, with the exceptions that permit payment to a government agency or entity, under a court-ordered assignment, and to an agent furnishing billing and collection services. The agent exception at paragraph (b)(3) is conditional on an agency agreement; on the agent's compensation being neither related in any way to the dollar amounts billed or collected nor dependent upon actual collection of payment; on the agent acting under payment-disposition instructions the provider may modify or revoke at any time; and on the agent acting only on the provider's behalf. Payment to an agent is always made in the name of the provider.

Ready to improve your revenue cycle?

Tell us about your practice and we’ll tell you where we would start.

Request a consultationBrowse the Knowledge Base