HIPAA (the Health Insurance Portability and Accountability Act), and specifically the HIPAA Security Rules, establishes national standards for protecting patient data through physical, technical, and administrative security measures.

Jump to:

• Is Bill.com HIPAA compliant?
• Why not?
• What does that mean for me?
• Do I need to sign a Business Associate Agreement (BAA)
• Are you planning on becoming fully HIPAA compliant in the future?

Is Bill.com HIPAA compliant?

No - currently, we are not fully HIPAA compliant. However, we have been working on enabling HIPAA controls into the Bill.com payables experience.

Why not?

We haven’t yet undergone all of the technical process required to become fully HIPAA compliant.

What does that mean for me?

This means that prohibited information as outlined by HIPAA (i.e. healthcare information) should not be stored in Bill.com, or transferred using Bill.com unless your organization has signed a Business Associate Agreement (BAA) with Bill.com.

Do I need to sign a Business Associate Agreement (BAA)?

The BAA relates to entities that process personal health information. The Bill.com system is only partially set up to process personal health information at this time, and our terms of service specifically prohibit customers using it for Protected Health Information (PHI) unless a BAA has been entered into with Bill.com.

As of July 31, 2020, we updated our terms on the subject to HIPAA as follows:

“Business Associate” under HIPAA. Bill.com may, upon request, operate as a “business associate” of certain users of the Service, including You, for the purposes of The Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). You agree that You will not send or transmit any electronic “Protected Health Information” (“ePHI”, as defined in HIPAA) to Bill.com or otherwise in any manner through the Service unless and until you have a Business Associates Agreement (“BAA”) with Bill.com. You are solely responsible for ensuring that Your use of the Service complies with all applicable laws and regulations, including HIPAA. If We become aware that You have sent or transmitted ePHI in any manner through the Service in violation of this Agreement or the BAA, We may delete the ePHI without any liability or notice to You, and You agree to pay any costs or fees associated with that ePHI deletion.

Are you planning on becoming fully HIPAA compliant in the future?

We understand the importance for some companies to be able to include certain types of sensitive information in financial transactions. We are currently working towards becoming fully HIPAA compliant, although we do not have a definitive ETA right now. We’ll update this article when we have new information - subscribe to the article to get emails about updates, and keep an eye on the News and Announcements section to stay up-to-date.

For more information about HIPAA and HIPAA compliance, please visit: U.S. Department of Health and Human Services - Health Information Privacy