The short answer
Generally, no, they cannot hold it. HHS guidance says a business associate that blocks a covered entity's access to the PHI it maintains for that entity, including to resolve a payment dispute, has engaged in "an impermissible use" under the Privacy Rule. The same guidance says terminating that access violates the Security Rule.
Every business associate agreement must also require the vendor to return or destroy PHI at termination where feasible, under 45 CFR 164.504(e)(2)(ii)(J). Unpaid fees are a contract dispute. They are not a reason to withhold patient data.
Why the advice online conflicts
Some answers online say a billing company may keep the data until it is paid. HHS guidance points the other way for PHI. The gap usually comes from treating all data as one thing. It splits into three parts:
PHI the vendor maintains for you
Patient accounts, claims and remittances are covered by HIPAA and by the business associate agreement. Access to them is not a bargaining chip.
The vendor's own work product
Internal reports, templates and non-PHI data depend on what the contract says. HIPAA does not decide those.
Fees you genuinely owe
They are still owed. HIPAA does not erase them. It takes data access off the table as leverage.
What you are actually owed
Under HIPAA and the BAA. The PHI the vendor maintains on your behalf, such as patient accounts, claims and remittances, must be returned or destroyed at termination where feasible. If return is not feasible, the agreement's protections must extend to whatever the vendor keeps, and further use is limited to the reasons return was not possible (45 CFR 164.504(e)). HHS adds that where the agreement calls for return, the PHI should come back in a format that keeps it usable.
Under the contract. Data format, final reports and transition help depend on what the service agreement says. Healthcare attorneys at Day Pitney recommend billing contracts require the vendor to transfer all billing data and patient accounts in "an electronic, readable format", deliver final reports within 30 days, and cooperate with the next vendor. That is a recommendation for drafting, not a legal rule, so check what your own agreement actually says.
Under the information blocking rules. These apply only to "actors": health care providers, developers or offerors of certified health IT, and health information networks or exchanges (45 CFR 171.102). A pure billing service usually is not one. A vendor that offers or resells certified EHR software to you may be, since ONC treats an entity that offers certified health IT as a developer even if it does not build it.
The claims clock does not stop
Payer filing limits keep running while the data dispute goes on. Medicare allows 12 months from the date of service (42 CFR 424.44). TRICARE West allows 365 days (TriWest provider handbook). Some commercial payers allow far less, so check which claims are still inside their window first.
You do not need the old vendor to start. Rebuild visibility in parallel from sources the practice already controls:
Payer portals
Portals registered to your NPI and TIN show claim status and remittances, whoever submitted the claim.
Your clearinghouse account
If it is in the practice's name, it holds submission and acceptance reports, which are your proof of timely filing.
Bank and EFT records
Deposits show what has actually been paid, so you can tell open claims from paid ones.
Once you can see the open claims, estimate what the stranded AR is worth so you know what is at stake in the dispute.
What to do this week
Six steps, in order. The first four take a day or two and cost nothing. Steps five and six run in parallel from there.
- 1
Pull the BAA and the service agreement
Find the return-or-destroy clause, the termination terms, any data-format and final-report terms, and the fee terms. These decide what you can ask for and on what timeline.
- 2
Send a written request
Cite the BAA clause. List exactly what you want: AR aging by payer, open claims with payer claim numbers, ERAs and 835 files, denial and follow-up notes, payer correspondence and credentialing files. Give a specific date. Here are the reports to request.
- 3
Keep the fee dispute in a separate letter
Pay or contest the fees on their own track. Mixing them into the data request invites the vendor to treat one as conditional on the other.
- 4
Keep a log
Record every request and reply with the date and the name of the person involved. If the matter escalates, this log is your record.
- 5
Escalate if there is no response
Talk to a healthcare attorney first. A HIPAA complaint to HHS's Office for Civil Rights is also available. HHS says a complaint must be filed "within 180 days" of when you knew of the act or omission, and OCR may extend that for good cause.
- 6
Work the claims still inside their window
Do not wait for the dispute to end. Resubmit, correct or appeal what can still be paid, using the portal and clearinghouse records above. For the full sequence, see how to protect revenue while you switch.
How to never be here again
Most data disputes are decided before they start, by who holds the accounts and what the contract says. Four habits keep the practice in control with any vendor:
- Hold the EHR and practice management license, the clearinghouse account and every payer portal login in the practice's name.
- Put a data-return clause in every billing contract: what comes back, in what format, by when, and at what cost.
- Take scheduled exports of AR aging and claim history, monthly at minimum, and store them where the practice controls access.
- Prefer vendors that work inside your system over vendors that host your data in theirs.
Before you sign the next agreement, check your contract's data clauses.
Sources last checked on hhs.gov, ecfr.gov and healthit.gov: 1 Oct 2026