Practice operations

Our biller just left. What to do now.

Your first job is access, not billing. Capture every payer portal, clearinghouse, Medicare and CAQH login before they lapse. Then pull your clearinghouse rejections and work claims by deadline. Money you have already earned only becomes permanent loss when filing windows close. That can be 90 days on some commercial plans and 365 days for Medicare.

Which situation is this?

The first 24 hours

Do these in order. Access comes first because everything else depends on it.

  1. 1. Capture every login.

    EHR, practice management system, clearinghouse, every payer portal, Availity, Medicare (PECOS and your MAC portal), CAQH, the bank, the card processor. Note which ones the biller was the named administrator on. That distinction matters more than the rest of the list.

  2. 2. Export the audit log before you disable the account.

    If money later turns out to be missing, that log is the evidence. The HIPAA Security Rule requires procedures to review system activity including audit logs (45 CFR 164.308(a)(1)(ii)(D)).

  3. 3. Revoke access the same day.

    The HIPAA Security Rule requires procedures for terminating access to electronic protected health information when a workforce member leaves (45 CFR 164.308(a)(3)(ii)(C)). Change shared passwords, disable the user account, remove them from every portal.

  4. 4. Confirm money is still landing.

    Check that EFT deposits are hitting the correct practice account and that no banking or remittance details were changed recently.

  5. 5. Set a second administrator everywhere you can.

    One person holding all admin rights is how this crisis starts. Fix it now.

If they are working notice

Use the time for handover, not cover. Before the last day get them to: add a second administrator on every portal, document payer quirks and workarounds, list the status of every open claim over 60 days, explain which denials they appeal and how, and hand over patient payment plans. Sit with them while they do it. A list written alone is always thinner.

If they left suddenly

Assume no knowledge transfer. Start password resets on everything you own. Where the biller was the only administrator, expect a formal re-registration rather than a simple reset. Availity requires a new registration with document upload and affiliation verification when the administrator has left. That takes days. Start it today.

What breaks, and when

Very little fails on day one. That is what makes this dangerous. The damage compounds quietly, then becomes permanent at fixed points.

Day 1

Portal and clearinghouse access uncertain. New rejections not retrieved. Prior authorisations in flight unattended.

Days 2–7

Claims not going out. Rejections accumulating. Remittances not posted, so AR no longer matches reality.

Week 2

Corrected-claim windows start closing on claims rejected just before the departure. A rejected claim never reached the payer, so the original filing clock has been running the whole time.

Day 30

First patient statement cycle missed. Payment plans requiring manual charging have lapsed. Shortest commercial filing windows begin threatening the oldest unsubmitted claims.

Day 45

If you started hiring on day one, this is roughly when someone could start. They will still be blind to your worklist for weeks.

Day 90

Permanent write-offs begin on 90-day payers. Patient AR visibly aged.

Day 120

CAQH attestation lapses if nobody re-attested. Nothing breaks loudly. Existing claims keep processing. Damage shows up later in stalled credentialing.

Day 365

Medicare claims from around the departure date hit their absolute limit under 42 CFR 424.44.

Filing deadlines

PayerTypical window from date of service
Medicare365 days (42 CFR 424.44)
UnitedHealthcare, Aetna, Cigna90 days on most plans
Blue Cross Blue Shield plans90–180 days, varies by plan
MedicaidState specific (Texas 95, New York 90, California 180)
Corrected claimsOften 60–90 days from rejection. The rejection does not reset the original clock.

Your binding deadline is in your payer contract and can be shorter. The denial code when the window is missed is CO-29. There is effectively no appeal.

Getting back into your systems

This is the real bottleneck and it is slower than most practices expect. A password reset takes minutes if the account still exists and you control it. Replacing a lost administrator is a formal process measured in days. Re-establishing Medicare electronic submission is measured in weeks. Start all of it today. Filing clocks do not pause.

Payer portals

Major portals use a named administrator model. The administrator adds users, resets passwords and grants tool access. If your biller was the only administrator, you cannot add anyone or reset anything. Availity's process when the administrator has left is a new registration with document upload and affiliation verification. Assume days. While locked out you cannot check eligibility, submit or check authorisations, view claim status, see remittance advice, or respond to record requests.

Clearinghouse

Log in and pull every rejection report first. This is the single highest-value action in the first week. A rejection is not a denial. The claim never reached the payer, so the filing clock has been running as if nothing was submitted.

Medicare

Provider enrolment runs through PECOS. A complete web submission averages about seven days; missing information extends that. EDI enrolment (what lets you submit electronically) is a separate process. MACs commonly ask providers to allow ten business days before chasing status. PECOS approval does not mean you can bill immediately. While EDI is down, file paper CMS-1500 claims. It is slower and more error-prone, and it is still better than letting claims age.

CAQH

Check attestation status for every provider today. Re-attestation is required every 120 days. A lapse breaks nothing loudly. Existing claims keep processing and no payer emails you. The damage surfaces later as stalled enrolments and delayed re-credentialing.

Timely filing countdown

Enter a payer and a date of service to see how long you have. Runs in your browser. Sends nothing. Needs no patient data.

General standards only. Your binding deadline is in your payer contract and can be shorter. Medicare: 365 days from date of service (42 CFR 424.44). Verify before relying on this.

What you can do yourself, today, for free

You do not need a biller to stop the bleeding. Most permanent damage comes from claims sitting still.

  1. 1.Submit new clean claims daily from your EHR. Do not add to the backlog even if you cannot work denials yet.
  2. 2.Pull clearinghouse rejections, fix the obvious ones, resubmit. Wrong member ID, missing modifier, wrong payer ID. Many are clerical.
  3. 3.Post remittances. Until you do, your AR is fiction.
  4. 4.Re-attest CAQH for every provider.
  5. 5.Triage prior authorisations. Find anything pending or expiring, and any scheduled procedure without an active authorisation.
  6. 6.File paper CMS-1500 to Medicare if electronic submission is down.
  7. 7.Reconcile bank deposits against posted payments for the last three to six months. This also serves as your financial check.
  8. 8.Work claims by deadline, not by size. Closest to expiry first, then largest.

First 72 hours checklist

Answer five questions and this produces an ordered checklist for your situation. Print it and work through it.

First 72 hours checklist

Answer five questions and this produces an ordered checklist for your situation. Print it and work through it.

What happened?

Do you have the logins yet?

Do you bill Medicare?

Do you use a clearinghouse?

No patient data. Categorical choices only.

The complete master checklist

Every branch, published in full so the content stays visible and crawlable. The generator above only filters and reorders what is already here.

  1. 1. Make a complete list of every system the biller accessed (EHR, PM, clearinghouse, every payer portal, Availity, PECOS and your MAC portal, CAQH, bank, card processor).
  2. 2. Note which systems the biller was the named administrator on.
  3. 3. Export the user's audit log before disabling the account (45 CFR 164.308(a)(1)(ii)(D)).
  4. 4. Revoke access the same day. Change shared passwords, disable the account, remove from every portal (45 CFR 164.308(a)(3)(ii)(C)).
  5. 5. If sudden and no logins: start password resets; begin formal re-registration for lost-administrator portals (Availity).
  6. 6. If working notice: complete handover (second admin, payer quirks, open claims over 60 days, appeal process, payment plans).
  7. 7. Set a second administrator on every portal you can.
  8. 8. Confirm EFT deposits hit the correct account; check for changed banking or remittance details.
  9. 9. Pull every clearinghouse rejection report. Fix the obvious and resubmit.
  10. 10. Submit new clean claims daily from your EHR.
  11. 11. Post remittances so AR matches reality.
  12. 12. Re-attest CAQH for every provider (every 120 days).
  13. 13. Triage prior authorisations (pending, expiring, scheduled procedures without active auth).
  14. 14. If Medicare: begin PECOS enrolment if needed; file paper CMS-1500 while EDI is down.
  15. 15. Reconcile bank deposits against posted payments for the last three to six months.
  16. 16. Pull write-off and adjustments report by user; check refunds, credit balances, bank-detail changes.
  17. 17. Work claims by deadline, not by size. Closest to expiry first, then largest.
  18. 18. If a vendor left: send a written demand for your data today; consider paying a disputed invoice under protest to recover records fastest.

If it was a billing company that left

Different problem. With an in-house departure you own the systems. With a vendor you may not own the systems, the data, or the software licences. Your leverage is contractual. Your first action is a written demand for your data, sent today.

Send written notice invoking your contract's data-return and transition-assistance clauses and your right to protected health information under the business associate agreement. Be specific about format and deadline.

Vendors do withhold access, and sometimes lawfully. Practices have been locked out of billing systems mid-dispute and told historical records would cost a substantial fee to retrieve. In one documented case a vendor had set itself up as the owner of the practice's EHR and locked the practice out over a final invoice.

Practical advice: if a disputed final invoice is blocking your data, paying it under protest is often the fastest route to your records. Recover the money afterwards. Your data has a deadline attached to it. The dispute does not.

What to establish before you sign with the next one

  1. 1.You own your data, with a complete export in a usable format within a defined number of days, at no charge.
  2. 2.Every open claim has an owner during transition. Who works pre-cutover claims, for how long, and how it is reported to you monthly.
  3. 3.Notice period and any termination fee, stated plainly.
  4. 4.Whether the contract auto-renews, and the assignment clause.
  5. 5.A business associate agreement covering everyone who touches protected health information.

A wind-down period is not by itself a guarantee. In litigation against a large billing vendor, a health system alleged that around $1.6 million in claims went unprocessed, roughly half of which had already passed their submission windows. Those are allegations in ongoing proceedings, not findings. The mechanism applies at any size.

Checking that nothing is missing

This is not an accusation. It should be routine at every departure. The person who leaves is often the same person who controlled both the money and the record of the money. A departure is simply when anyone finally looks. Most reviews find nothing. That is a good outcome and takes an afternoon.

●Deposits against postings for the last three to six months.
●Write-offs and adjustments by user.
●Adjustments on related accounts (the biller's own account, family, staff).
●Patient refunds to addresses or cards that do not match the patient.
●Unapplied credits and suspense accounts.
●Recent changes to bank details, remittance addresses, or newly added vendors.
●Voids and reversals clustered by user.

Small practices cannot achieve full separation of duties. One person often collects payment, posts it, makes adjustments and reconciles the bank. The Association of Certified Fraud Examiners found in its 2024 Report to the Nations that 43% of occupational frauds are detected by a tip, more than three times the next most common method, and that the typical fraud runs about twelve months before detection.

The control worth adding now: the person who collects payments should not also post adjustments and reconcile the bank account. You cannot separate everything. You can separate that.

Hire, temp, or outsource?

Hiring is the right long-term answer for many practices and the slowest fix for the immediate problem. Expect weeks to fill the role and several more weeks before a good hire is productive. The worklist lives in the departed person's head.

Hire a replacement

US Bureau of Labor Statistics median annual wage for medical records specialists (the category covering billers) is $50,250 as of May 2024. Physician offices generally pay less. Add benefits and payroll tax. A single replacement recreates the single point of failure that caused this.

Temp or interim

Faster to place, higher hourly cost. Good for stopping the bleeding on submission and rejections. Less likely to do deep denial and appeal work.

Outsource

Brings a team rather than a person, so there is no single point of failure by design. Onboarding still requires access and enrolment, so it is a structured transition rather than a same-day fix. Cost moves with what is collected.

Clinical staff triage

Free and immediate for the simplest tasks. Not viable for denials or appeals. A stopgap for days, not months.

Do nothing

The most expensive option. Every day moves claims toward permanent write-off. Worth naming because inaction is the default when nobody owns the problem.

Free 48-hour AR audit

Get a free 48-hour AR audit

We look at your claim data and tell you what is at risk before each filing deadline, what is sitting unworked, and what it is costing you. No obligation.

What happened
When
Access
Your details

What happened?

Common questions

How long can claims sit before we lose them?+

Depends on the payer. Medicare allows 365 days from date of service under 42 CFR 424.44. Most commercial plans allow 90 to 180 days; some are shorter. Your binding deadline is in your contract. Once the window closes the denial code is CO-29 and there is effectively no appeal.

Can we keep billing while we hire someone?+

Yes, and you should. Submitting clean claims daily from your EHR needs no specialist knowledge. Pulling and correcting clearinghouse rejections is also within reach of most practice staff. Denials, appeals and aged AR are the parts that need expertise.

Our biller was the only administrator on our payer portals. How do we get back in?+

Expect a formal re-registration rather than a password reset. Availity requires a new registration with document upload and verification of affiliation when the administrator has left. Start it immediately. It takes days.

What if we do not have any of the passwords?+

Start password resets on every system you own (usually your EHR, bank and card processor). For systems where your biller was the named administrator, use the re-registration route. Make the full list first.

Do we have to do anything for HIPAA when a biller leaves?+

Yes. The Security Rule requires procedures for terminating access to electronic protected health information when a workforce member's employment ends (45 CFR 164.308(a)(3)(ii)(C)). Revoke access the same day. Export the user's audit log before disabling the account.

Can we still file a claim 100 days after the date of service?+

For Medicare, yes. For a commercial payer on a 90-day window, no. For a 180-day plan, yes but move now. Check the specific payer and work your oldest claims first.

Our billing company stopped responding. What do we do?+

Send a written demand for your data today, invoking your contract's data-return clause and your rights under the business associate agreement. If a disputed final invoice is blocking your records, paying it under protest is often the fastest way to get them.

Do we need to tell our patients or payers?+

Not usually. Consider telling affected patients if statements or payment plans are disrupted, and update contact details with payers if portal access changes how they reach you.

What if the biller took our data with them?+

Preserve the audit log immediately and document what you find. Practice data and patient records belong to the practice. If protected health information has been taken inappropriately, that is a potential breach with its own notification obligations. Call a healthcare attorney rather than deciding in the moment.

Should we audit for missing money?+

Yes, as routine rather than as an accusation. Reconcile deposits to posted payments for the last three to six months, pull a write-off report by user, and review refunds and credit balances. Most reviews find nothing. It takes an afternoon.

How long until an outsourced company can take over?+

Access and enrolment are the constraint. Portal access, clearinghouse setup and any Medicare EDI work set the pace. Expect a structured transition over weeks, with the most urgent claims worked first.

Will we lose money from this no matter what?+

Some, usually. How much depends almost entirely on how fast access is recovered and whether claims get worked by deadline rather than by size. Practices that move in the first week typically lose very little. Practices that wait a month usually lose the oldest claims permanently.

Sources