The short answer
Before you sign, an AR recovery contract should say in writing which claims are in scope, what counts as "recovered", who the payer pays, who may write off a claim, how results are reported claim by claim, what happens to fees and data when you leave, and that a business associate agreement covers the work.
The fee percentage matters less than how "recovered" is defined. Two proposals at the same rate can cost very different amounts once you see what the rate is applied to.
The 8 terms at a glance
Use this as a checklist against the proposal in front of you. Each term is covered below, with the rule behind it where there is one.
| Term | What to look for | Red flag |
|---|---|---|
| 1Scope | What to look forA claim-level list, attached to the contract | Red flag"All outstanding AR" |
| 2Fee base | What to look forPayer payments on the listed claims | Red flag"All collections" |
| 3Payment flow | What to look forPayers pay you; the vendor invoices its fee | Red flagPayments routed to the vendor |
| 4Write-offs | What to look forYour written approval for each one | Red flagLeft to the vendor's discretion |
| 5Appeals | What to look forFiled in your name, with copies kept in your system | Red flagNo copies kept |
| 6Reporting | What to look forStatus and reason for every claim | Red flagTotals only |
| 7Exit | What to look forNotice in days and a defined tail | Red flagOpen-ended fees after you leave |
| 8BAA and access | What to look forA signed BAA; a set date for removing access | Red flagNo BAA, or shared logins |
A red flag isn't proof of bad faith. It marks a place where the contract leaves a decision to the vendor that should stay with you, and that is the place to ask for a change before you compare prices.
Term 1: The scope list
The contract should attach the list of claims the vendor will work, claim by claim, with the payer, date of service and open balance for each. Current AR that your own team works stays off the list.
Without a list, scope becomes "all outstanding AR", and every payment that arrives during the engagement can be counted as recovered, including claims your staff billed last week and payers were about to pay anyway. A list also settles disputes later: a payment on a listed claim is in, and a payment on anything else is not.
If the vendor wants to add claims partway through, the addition should be in writing, dated, and itemized the same way as the original list. And give every claim one owner: if a listed claim is also sitting in your own team's work queue, decide who works it, so nobody duplicates an appeal or a call to the payer.
Term 2: What counts as "recovered"
This definition sets the price. The fee is a percentage of whatever the contract calls "recovered", so the definition decides what you pay more than the rate does. Spell out four things:
- Payer payments on listed claims. That is the base. Payments on claims outside the list are not part of it.
- Patient payments. Say whether patient payments on the same claims count, and if they do, from what point.
- Recoupments and refunds. If a payer takes money back, or you refund it, within a set period after it was counted, the fee on that amount comes back off the base.
- Overpayments. No fee on money you are required to return.
Timing belongs in the definition too. A payment should count when the payer's money reaches your account, not when a claim is resubmitted or an appeal is filed, and a claim paid in part counts only for the part that was paid.
Then ask the vendor for a worked example on three of your own claims: one paid in full, one paid and later recouped, and one with a patient balance. If the invoice in the example surprises you, fix the definition before you sign, not the arithmetic after.
Published rates, and what each one is applied to, are covered in what AR recovery typically costs.
Term 3: Who the payer pays, and is a percentage fee legal?
Medicare. Medicare doesn't pay amounts due to a provider to anyone else, with narrow exceptions. One is a billing agent, on conditions: the agent's compensation must be "not related in any way to the dollar amounts billed or collected" and "not dependent upon the actual collection of payment", and payment is always made in the provider's name (42 CFR 424.73(b)(3)). The same conditions apply to an agent billing for physicians and other practitioners (42 CFR 424.80(b)(5)).
Medicaid. A state may pay a business agent, such as a billing service, in the provider's name only if the agent's compensation is related to the cost of processing the billing, "not related on a percentage or other basis to the amount that is billed or collected", and not dependent on collection (42 CFR 447.10(f)). States write their own rules too. New York's Medicaid rule repeats these conditions for service bureaus and billing services (18 NYCRR 504.9).
The OIG. The HHS Office of Inspector General has said it has "a longstanding concern that percentage billing arrangements may increase the risk of upcoding and similar abusive billing practices" (Compliance Program Guidance for Third-Party Medical Billing Companies, 63 FR 70138).
What it means in practice: with a percentage fee, payer payments should go to your account, in your name, and the vendor invoices you. A contract that routes payer money to the vendor, or lets the vendor take its fee before you are paid, is the point to stop and ask counsel.
Is a percentage fee for medical billing legal?
It depends on the arrangement and on state law, so it's a question for healthcare counsel. The federal rules govern who receives the payer's money: Medicare and Medicaid may pay a billing agent only if its compensation isn't tied to the amounts billed or collected, and payment always goes in the practice's name. So under a percentage fee, payers should pay the practice and the vendor should invoice its fee. The HHS Office of Inspector General has also said that percentage billing arrangements may increase the risk of upcoding.
None of this is a ruling on your contract. Have healthcare counsel review it, including your state's Medicaid rules.
Term 4: Write-off authority
A write-off is a decision to stop collecting money you are owed, so it should be yours. The contract should say that no claim is adjusted or written off without your written approval. Requests can come as one list a month, but every claim on the list should be named, with the reason and the evidence behind it: the denial, the filing deadline, the payer's final answer.
Naming each claim matters because the incentives are uneven. A vendor paid only on recoveries earns nothing from a hard claim it never collects, and in a monthly total a claim worked to a dead end looks the same as one that was never worked. Your adjustment report shows what was closed and why; here is how to audit write-offs.
Term 5: Appeals in your name
Appeals, corrected claims and reconsiderations should go out in the practice's name, under your own identifiers, and copies should stay in your system, not only in the vendor's. You are the one who answers for them. To submit Medicare claims electronically, a practice signs an EDI enrollment agreement that makes it "responsible for all Medicare claims submitted to CMS or a designated CMS contractor by itself, its employees, or its agents" (Medicare Claims Processing Manual, ch. 24, 30.2).
Copies matter later as well. If a payer reviews a recovered claim after the engagement ends, the appeal and its attachments are what you will need, and they should already be in your records. Ask, too, whether the vendor will work through your payer portal accounts or open its own. Portal accounts used for your claims should be in the practice's name, so they stay with you.
Term 6: Claim-level reporting
Every listed claim should end in one of three states, reported in writing every month:
- Recovered, with the amount and the date paid.
- Closed, with the reason, and your approval if it was written off.
- Still open, with the next action and its deadline.
Each line should carry the claim number, payer, date of service, original balance, amount paid and the reason code for any closure. Ask for it in a format you can sort and filter, such as a spreadsheet, rather than a PDF summary.
Totals alone hide what was dropped. A report that says only how much was recovered tells you nothing about the rest of the list: which claims were closed, why, and whether any could still be paid. Check the count each month. The claims on the list should equal recovered plus closed plus still open.
Terms 7 and 8: Exit, BAA and access
Exit. The contract should set a notice period in days, not tie your exit to a renewal date. It should also define the tail: after you leave, the fee applies only to listed claims paid within a set period, and only for work done before the exit date. An open-ended tail can mean paying a fee long after you leave, on claims your own staff finished. Ask what happens to appeals already filed on the exit date: who follows them up, and whether a payment on one falls inside the tail. Renewal clauses deserve the same reading; see contract auto-renewal and notice traps.
BAA. A vendor working your AR handles protected health information, so a business associate agreement should be signed before it gets any access. HIPAA requires the agreement to cover the end, too: at termination the business associate returns or destroys the information if feasible and keeps no copies, or, if that isn't feasible, extends the agreement's protections to what it keeps (45 CFR 164.504(e)). Put in writing how and when your data comes back; here is more on getting your data back.
Access. Each person on the vendor's team should have an individual login in your system, never a shared one, with two-factor sign-in where your system supports it. The contract should say how soon after the exit date every login is removed: days, not weeks. If the vendor needs to see payments during the tail, that access should be read-only and limited to payment reports, or you can send it a monthly payment report instead.
Rules last checked: 30 Oct 2026
