What Should a Billing Company’s BAA Say About a Data Breach?

It should require the billing company to report security incidents, including breaches of unsecured patient information, back to you. Ask for a deadline measured in days so you are not waiting on the vendor’s own timeline. Also ask who their subcontractors are, since a vendor that shares patient information with a subcontractor needs a BAA with that subcontractor first.