---
title: "What is hipaa?"
description: "Hipaa explained in plain English: definition, how it works, an example, and how it appears in QuickBooks and Xero."
url: https://ledgerbpo.com/glossary/hipaa/
updated: 2026-09-11
publisher: LedgerBPO (SS Support Network LLC)
language: en-US
---

# What is hipaa?

Glossary

HIPAA is a US federal law protecting the privacy and security of individuals' health information, setting rules for how covered entities and their business associates may use, disclose and safeguard protected health information. It applies to healthcare providers, health plans and vendors that handle that information on their behalf.

Updated September 2026

## How hipaa works

HIPAA's Privacy Rule sets limits on how protected health information can be used and disclosed, while its Security Rule requires administrative, physical and technical safeguards for information held or transmitted electronically, including access controls, encryption and audit logging. Covered entities must also have a breach notification process for reporting unauthorized disclosures.

A vendor that handles protected health information on behalf of a covered entity, such as a billing or bookkeeping provider working with medical billing data, is a business associate under HIPAA and must sign a business associate agreement committing to the same safeguards. Staff handling this data are expected to receive HIPAA training, not a personal HIPAA certification, which does not exist as an official credential.

## Example

A medical practice hires an outside billing company to post insurance payments and follow up on patient balances. Because that work involves protected health information, the billing company signs a business associate agreement with the practice, restricts access to trained staff on a need-to-know basis, and logs who accesses each patient's billing record, consistent with HIPAA's Security Rule requirements.

## HIPAA in QuickBooks Online vs Xero

Not software-specific: HIPAA compliance depends on how protected health information is handled across whatever systems touch it, including the practice management, billing and any accounting software involved, rather than any single tool being HIPAA software. Businesses typically confirm a signed agreement is in place with each vendor and cloud provider that stores or processes this data.

## Common mistakes

- Sharing protected health information with a billing or bookkeeping vendor before a business associate agreement is signed, which puts the covered entity out of compliance regardless of the vendor's practices.
- Claiming staff are 'HIPAA certified,' which is not an official credential; the accurate description is HIPAA-trained staff following the covered entity's required safeguards.
- Giving broad, unrestricted access to billing data instead of limiting it to staff who need it for the specific work, which increases exposure if an account is ever compromised.

## Why it matters

HIPAA compliance protects a healthcare provider from significant penalties and reputational damage if patient information is mishandled or breached, which matters directly to a practice's ability to keep operating and billing payers. For a medical practice choosing a billing or bookkeeping vendor, confirming a signed business associate agreement and real HIPAA training, not an invented certification, is a basic and necessary due-diligence step.

## Related terms

- [Business associate agreement](https://ledgerbpo.com/glossary/business-associate-agreement/)
- [ISO 27001](https://ledgerbpo.com/glossary/iso-27001/)
- [SOC 2](https://ledgerbpo.com/glossary/soc-2/)
- [All terms](https://ledgerbpo.com/glossary/)

## How LedgerBPO handles hipaa

We sign a business associate agreement with healthcare clients before any protected health information is shared, and our staff working on medical billing accounts are HIPAA-trained, with access restricted to those who need it for the work. Details on our safeguards are covered on our compliance page.

[Compliance, country by country](https://ledgerbpo.com/compliance/)

Next step

## Books closed. Invoices paid. Every month.

Tell us what is going on with your books or billing. You will hear from a named person within 1 business day, with a custom quote and a plan for the first close.

- Reply from a named person within 1 business day
- No setup fee, month-to-month
- Your software, your data, no lock-in

Start with a custom quote

[Get a custom quote](https://ledgerbpo.com/get-a-quote/) [Book a 20-minute call](https://ledgerbpo.com/book-a-call/) Or call [+1-657-777-0006](tel:+16577770006) during US, UK or Australian business hours.

---

Source: https://ledgerbpo.com/glossary/hipaa/ · Contact: https://ledgerbpo.com/contact/ · Full site map for agents: https://ledgerbpo.com/llms.txt