Medical Billing Company Red Flags: 12 Warning Signs to Check Before and After You Sign

Medical billing company red flags are warning signs that a vendor will mishandle claims, compliance or data. Refusing a business associate agreement, controlling Medicare deposits, pressuring coding and withholding data justify walking away. Hidden fees, lock-in terms and rising balances justify a documented fix plan before any termination.

Most medical billing company red flags show up in the first two sales calls or the first 90 days of reports, long before a practice feels the cash-flow damage. This guide sorts twelve warning signs into three tiers: walk away, negotiate and monitor. It adds thresholds, four worked examples with real numbers and a self-assessment checklist near the end.

It is written for practice owners, office managers and billing decision-makers at small and mid-size US practices, whether they are screening a new vendor or doubting a current one. Figures reflect information available in October 2026, and each is labeled by source type.

Which numbers and terms should make you suspicious?

Ten signals cover most vendor problems: five performance thresholds, three behaviors and two rules with legal weight. Use the table as a reference during demos and monthly reviews. Only the filing limit and the screening guidance come from published sources; the performance thresholds are industry conventions that vary by a few points.

Metric	Practical red-flag threshold	Review frequency	Source type
Net collection rate	Below about 90% is a clear flag; below about 95% needs review	Monthly	C
First-pass clean claim rate	Below about 90%–92%, or not reported at all	Monthly, by payer	C
Initial denial rate	Above about 8%–10%, or one payer far above the rest	Monthly, by payer	C
Days in A/R	Above about 45–50 days	Monthly	C
Share of A/R older than 90 days	Rising two months in a row, or above about 20%	Monthly	P
Monthly report delivery	Not delivered within about 30 days of month end	Monthly	P
Proactive account contact	No contact from a named account manager in 30+ days	Monthly	C
Exclusion-list screening	Less often than monthly, or no written policy	Monthly	G
Medicare Part B timely filing	Any claim approaching 12 months from date of service	Weekly backlog check	S
Data return at exit	Final data and reports not promised within about 30 days	At contract signing	L

Source types: S = published rule from a named government body. G = published guidance from a named body that is not a mandate. C = commonly reported across industry sources, mostly vendor guides that cite no underlying data; thresholds conflict by a few points. P = practical planning threshold used in this guide. L = law-firm commentary (Day Pitney, 2025). Illustrative figures elsewhere in this article are labeled as such.

A threshold is a prompt to investigate, not a verdict. Vendors define clean claim rate, net collection rate and denial rate differently, so ask for written definitions first. A vendor that reports only blended figures, or cannot show the calculation, has already shown you its first red flag.

What makes something a red flag, and which ones end the conversation?

A red flag is any vendor behavior or number that predicts compliance exposure, lost revenue or lost control of your data. Sort each one by consequence. Compliance and data-control flags justify walking away, commercial flags justify renegotiating and performance flags justify a documented fix plan. The table lists all twelve, with what to verify for each.

#	Red flag	Tier	What to verify
1	Hedges on a signed BAA	Walk away	Written BAA with subcontractor terms and breach reporting
2	Vague on exclusion screening	Walk away	Written policy and date of the last monthly check
3	Wants Medicare deposits in its own account	Walk away	Deposits to a practice-owned account, reviewed by counsel
4	Coding follows incentives, not documentation	Walk away	Coding audit sample and compensation structure
5	Hides offshore work or data location	Walk away	Where staff and data sit; payer and state limits
6	Hidden fees and add-ons	Negotiate	Line-item scope and gross-versus-net fee basis
7	Lock-in terms and exit penalties	Negotiate	Term, renewal, notice period and exit fees
8	No data export rights	Negotiate	Export format, timing and cost in writing
9	Blended-only or paid reports	Negotiate	Payer-level reports included in the fee
10	Key rates missed or drifting	Monitor	Three-month trend by payer against your baseline
11	Aged A/R keeps growing	Monitor	Aging buckets and a plan for claims over 90 days
12	Silence and unexplained denials	Monitor	Named contact; payer-specific denial explanations

Tier assignments are this guide’s practical judgment, based on consequence; they are not drawn from a published standard.

Which red flags during sales calls should end the conversation?

Five red flags justify walking away before signing: hedging on a BAA, vague exclusion screening, Medicare deposits routed to the vendor, coding that follows incentives and hidden offshore work. Each one signals risk that a better price cannot offset, because the practice, not the vendor, answers to payers and regulators when something goes wrong. Ask about all five in the first call.

Hedging on a business associate agreement

A billing company handles protected health information, so HIPAA requires a signed BAA with the practice. Be wary of a vendor that offers only its own template, resists subcontractor terms or delays signing. Compare the draft with HHS’s sample provisions (2013), and read our guide to data security and privacy in medical billing. The HIPAA Security Rule update proposed in January 2025 was still not final as of May 2026, so ask whether the vendor could support annual safeguard verification.

Vague answers on exclusion screening

Contracting with an excluded person creates liability for the practice. The OIG’s 2013 bulletin says monthly exclusion screening of contractors best minimizes exposure, and it describes civil monetary penalties of up to $10,000 per item or service plus up to three times the amount claimed. Penalty amounts are inflation-adjusted. Ask for the written policy and the last check date. A vendor with neither fails a basic compliance program test.

Medicare deposits routed to the vendor

Medicare may pay a billing agent only when the conditions in 42 CFR 424.73(b)(3) are met. They include agent pay unrelated to dollars billed or collected, and payment issued in the provider’s name. When a vendor wants remittances deposited into an account it controls, walk away or have counsel review the arrangement first. Keep the practice’s own account as the destination.

Coding that follows incentives, not documentation

The OIG’s compliance guidance for third-party billing companies (1998, voluntary) warns that percentage-based compensation can encourage upcoding, and it suggests claim-sample audits at least annually. In a 2016 OIG action, a New Jersey biller agreed to pay $100,000 and accept a five-year exclusion after OIG alleged she billed CPT 91122 for visits where it was neither performed nor on the superbill.

Ask who compares codes with the visit notes, and how the vendor handles bundling and unbundling of CPT codes. Our guide to medical billing audits explains how to sample claims. In coding reviews, a common pattern is that the incentive sits in the compensation formula, not in any written policy.

Why a vendor’s mistakes remain your problem

Outsourcing does not transfer accountability. In a 2022 settlement announced by the US Attorney’s Office for the Northern District of New York, a neurology practice paid $850,000 and admitted its billing was improper. Its billing company had told the owner about separate violations years earlier. Treat a vendor’s compliance warnings seriously, document how you responded, and keep documentation standards in-house.

Hidden offshore work or unclear data location

HIPAA does not bar offshore access to protected health information, but HHS says location can raise risk and belongs in the Security Rule risk analysis. A June 2026 client alert from Brennan, Manna & Diamond adds that Medicaid rules and managed care contracts may restrict offshore work. Ask where staff and data sit, whether subcontractors sign your terms and whether any payer contract bars offshore handling.

Which contract and pricing red flags should you negotiate before signing?

Four commercial red flags are negotiable: hidden fees, lock-in terms, missing data export rights and restricted reporting. Fix each in writing before signing. A vendor that refuses all four is telling you how the relationship will work, so treat refusal as information. Do this review before signature, when the practice still has leverage.

Hidden fees and an unclear fee basis

Ask whether the percentage applies to gross collections, net collections or charges submitted. Ask whether appeals, credentialing, statements and reporting are included. A July 2025 Day Pitney contract review advises clarifying whether fees apply to denials or appeals, and whether the vendor is paid when its own errors reduce collections. Request a line-item scope, and price each clause with our contract review checklist.

Lock-in terms and exit penalties

Long initial terms with automatic renewal can trap a practice in a weak arrangement. The same law-firm review suggests checking whether either party can terminate without cause on notice of roughly 30 to 90 days, and whether penalties apply. In contract reviews, a common pattern is that nobody reads the exit clause until the practice wants out. Read it first, while leverage is highest.

No data export rights

Confirm in writing who owns the billing data, which formats the vendor will export, how fast and at what cost. A Frier Levitt analysis of EHR vendors (updated December 2025) says blocking a practice’s access to its own patient information raises HIPAA problems. The same reasoning is a fair basis for demanding readable exports from a billing vendor at no charge, or at a fee agreed in advance.

Blended-only or paid reports

Request a sample monthly report before signing. It should show clean claim rate, denial rate and A/R aging by payer, included in the fee. Our metrics dashboard examples show what a useful layout contains. A practice-management consultant writing in Medical Economics (2026) advises asking how each rate is calculated and how claims older than 90 and 120 days are worked.

Which warning signs appear after you sign?

Three post-contract signals matter most: key rates that miss their thresholds for three months, aged balances that keep growing and silence. Silence means late reports, no account-manager contact or denials the vendor cannot explain. Check these signals monthly, and act when two appear together.

Rates that miss thresholds or drift

Compare clean claim, denial and net collection rates with your pre-contract baseline, by payer, over at least three months. A Medical Billers and Coders guide (2026) treats a net collection rate under 90%, a clean claim rate under 92% and a denial rate over 8% as flags, though it cites no source for them. Use them as prompts. Our explainer on clean claim rate covers definitions and common causes of rework.

Aged A/R that keeps growing

A stable total balance can hide a worsening mix. Track the share of aged A/R older than 90 days every month, and ask for a written plan when it rises two months in a row. Percentage-based pay can steer effort toward easy collections, according to the Medical Economics consultant. Our guide to reducing A/R days lists the tactics to ask the vendor about.

Silence and unexplained denials

Late reports, no contact from an account manager for 30 days or more, and an inability to explain why a payer denies a code are the most common early signs. In onboarding reviews, a frequent pattern is that silence precedes the numbers: reports slip first, and rates follow a few months later. Ask for payer-specific denial explanations and a denial management workflow in writing.

What do these red flags cost in real numbers?

Four calculations turn a vague worry into a dollar figure: denial leakage, aged A/R drift, a blended denial rate that hides one payer, and claims lost to the Medicare filing limit. Each example below is an illustrative scenario with stated assumptions; replace them with your own data.

Denial leakage

Annual denial leakage = allowed charges x denial rate x share of denials never recovered. Illustrative scenario (not an actual client record): a practice has $2,400,000 in annual allowed charges. At a 12% denial rate, $288,000 is denied; if 35% is never reworked, $100,800 is written off. At an 8% rate with 15% unrecovered, the loss is $28,800. The $72,000 gap is the cost of weak denial follow-up. EZMedPro’s service page describes denial follow-up and appeals within its revenue cycle management service.

Aged A/R drift

Aged share = A/R older than 90 days / total A/R. Illustrative scenario (not an actual client record): total A/R holds at $300,000 for three months, so days in A/R looks steady. The aged share moves from 15% ($45,000) to 19% ($57,000) to 24% ($72,000). Total A/R never moved, yet $27,000 more sits in the hardest-to-collect bucket. Ask for aging buckets, because the headline average hid the drift.

A blended denial rate that hides one payer

Denial rate = denied claims ÷ claims submitted × 100. Illustrative scenario (not an actual client record): a practice submits 1,000 claims. Payer A has 500 claims and 20 denials (4.0%), Payer B has 300 and 24 (8.0%), and Payer C has 200 and 36 (18.0%). The blend is 80 of 1,000, exactly 8.0%, which looks acceptable. Payer C is the problem. In report reviews, a common pattern is one payer producing most denials while the blend looks fine.

Claims lost to the Medicare filing limit

Loss = claims past the filing limit x average allowed amount. Medicare Part B claims must be filed within 12 months of the date of service, rejected claims do not count as filed, and timely-filing denials carry no appeal rights, according to Noridian’s guidance. Illustrative scenario (not an actual client record): 150 claims rejected at the front end are never corrected in time. At an average allowed amount of $110, the loss is $16,500. See our Medicare timely filing rules guide.

How should you read these signals without overreacting?

Compare like for like: the same payer mix, period and written definitions, measured against your own pre-contract baseline. One missed threshold is a signal to investigate, not a verdict, because a single month can reflect a payer policy change or a batch of old claims.

• Judge each metric over at least three months before concluding that performance has changed.
• Break every rate out by payer; when only blended figures are offered, request the split first.
• Treat compliance flags differently: one unresolved Tier 1 flag matters even when collections look strong.
• When a threshold is missed, ask for the top three drivers, such as denial reasons or aging buckets, before assigning blame.

What should you do the day you spot a red flag?

Document the signal, request a written explanation with payer-level data, agree a dated corrective plan, review progress at 30 and 60 days, then decide whether to keep, renegotiate or exit. The sequence protects the practice whichever way the decision falls.

• Record the signal with dates, the report or contract clause involved, and your baseline figures.
• Send a written request for an explanation within about 10 business days, asking for payer-level data and the top three causes.
• When the explanation is credible, agree a corrective plan with owners, metrics and dates; when it is evasive, escalate in writing.
• Review progress at 30 and 60 days against the agreed metrics, using three months of trend rather than one month.
• Decide: keep and monitor if metrics recover, renegotiate scope or fees if the cause is commercial, exit if a Tier 1 flag stays unresolved.

How long should a fix take?

As general planning ranges, expect about 10 business days for a written explanation, 30 days for a corrective plan and roughly 60 to 90 days before denial and aged-A/R trends visibly move. Compliance flags do not get fix periods. These are practical ranges, not guarantees, and results vary by practice. If you exit, secure data export first and sequence the handoff with our transition checklist for a new billing system.

Which mistakes make red flags more expensive?

Delay and missing evidence turn manageable flags into losses. Each mistake below has a direct fix. The pattern is consistent: practices that write down the problem and set a review date recover faster than those who wait for a quarter-end surprise.

• Waiting for an annual review. Check payer-level figures monthly; when a threshold is missed, open the written-explanation step immediately.
• Excusing compliance flags because collections look fine. Resolve Tier 1 flags first; strong revenue does not cure a missing BAA.
• Giving notice before securing data. Obtain exports, test them and confirm return-or-destroy terms before the termination clock starts.
• Confronting without payer-level evidence. Bring dated figures by payer; vague complaints invite vague answers.
• Accepting verbal reassurance. Require written definitions, written plans and named owners for every fix.
• Switching vendors without a baseline. Capture twelve months of your own numbers first, or the next vendor cannot be measured either.

Quick summary

• Sort red flags by consequence: walk away on compliance and data-control flags, negotiate commercial ones, monitor performance ones.
• Treat a net collection rate below about 90%, a clean claim rate below about 90%–92% and a denial rate above about 8%–10% as prompts to investigate.
• Watch aged A/R: a share older than 90 days that rises two months in a row, or exceeds about 20%, needs a written plan.
• Keep Medicare deposits in a practice-owned account, and have counsel review any other arrangement.
• Secure data export and exit terms before signing and again before giving notice.
• Plan roughly 60 to 90 days for a corrective plan to show in the trends.

Self-assessment: how many red flags does your billing vendor trip?

Answer yes or no for your current or shortlisted vendor, using written evidence rather than sales assurances. A yes means the flag is absent. Questions 1 to 3 carry extra weight: a no on any of them is serious regardless of your total score.

1. Is a signed BAA in place, including subcontractor terms and breach reporting?
2. Can the vendor show a written monthly exclusion-screening policy and the last check date?
3. Do Medicare payments deposit to an account the practice owns, confirmed with counsel?
4. Does the vendor audit coding samples against documentation at least annually?
5. Do you know where staff and data are located, including subcontractors?
6. Are the fee basis (gross or net) and every included service in writing?
7. Does the contract allow termination on reasonable notice with electronic data return?
8. Do you receive payer-level clean claim, denial and aging reports within about 30 days of month end?
9. Have net collection, clean claim and denial rates stayed inside the thresholds above for three months?
10. Has a named account manager contacted you in the last 30 days?

Yes answers	Tier	What to do
9–10	Low concern	Keep monitoring monthly and keep the baseline current.
6–8	Mixed	Close each gap in writing within about 30 days.
0–5	High concern	Start a corrective plan now, secure data export and prepare an exit option.

When has your current billing arrangement reached its limit?

Outside support makes sense when the red flags persist after a written plan. Five signals suggest the current arrangement has hit its limit. When two or more apply after a written 60-to-90-day plan, an outside review is a reasonable next step:

• A Tier 1 compliance flag stays unresolved after a written request.
• Denial or aged-A/R thresholds are missed for three months despite a corrective plan.
• The vendor cannot produce payer-level reports on request.
• Data export is refused, delayed or priced as a penalty.
• In-house staff spend more time checking the vendor than the vendor saves.

When evaluating a replacement, look for a signed BAA, monthly exclusion screening, payer-level reporting, a written scope with a stated fee basis, practice-owned Medicare deposits and electronic data return. Those requirements apply to any vendor, whatever its size, and they are easier to negotiate before the first claim is transferred.

EZMedPro is one example. It delivers medical billing, coding, credentialing, denial management and compliance support through a US-based team, with an emphasis on transparent reporting and no hidden fees. Its RCM service page describes monthly reports covering performance, payer trends and denial reasons. Results vary by practice, so request a sample report and written scope, as you would from any vendor, through its revenue cycle management service.

Expert Insights

Medical billing company red flags are manageable when they are sorted by consequence. Compliance and data-control flags end the conversation, commercial flags get renegotiated in writing, and performance flags get a dated plan with a 60-to-90-day review. One missed number is a signal to investigate, not a verdict on the vendor.

Only a few items here are firm published standards or guidance: the 12-month Medicare Part B filing limit, the HIPAA requirement for a business associate agreement, the 42 CFR 424.73(b)(3) conditions for paying a billing agent and the OIG’s exclusion-screening bulletin. The performance thresholds and timeframes are industry conventions or practical targets, and every dollar example is illustrative.

The natural next question is which of these twelve flags your own vendor trips today. Start with questions 1 to 3 of the checklist, then pull three months of payer-level data. To discuss the results or compare options, begin with EZMedPro’s revenue cycle management team.

Frequently asked questions

What is a good net collection rate?

A net collection rate of about 95% or higher is commonly reported across industry sources, and sustained rates below about 90% are widely treated as a warning sign. Neither figure is a mandated standard. Ask the vendor to define the formula in writing, because gross and net versions differ sharply.

What is a normal turnaround for a monthly billing report?

No published standard exists. A practical expectation is a payer-level report within about 30 days of month end, with aging available on request. Late reports are often the first visible sign of trouble, so put the delivery date in the contract and track whether the vendor meets it.

What is a good share of A/R older than 90 days?

Roughly 10% to 20% or less is a practical range; one vendor guide attributes a figure under 10% to HFMA without linking the data. The direction matters more than one reading. A share that rises for two months in a row deserves a written explanation and a plan.

Is a percentage-of-collections fee a red flag?

No. Percentage fees are common. The concerns are the ones the OIG raised in 1998: possible coding incentives, plus Medicare rules limiting agent compensation tied to dollars collected. Pair a percentage fee with coding audits, payer-level reports and Medicare deposits into a practice-owned account.

How can I tell whether my billing company is upcoding?

Audit a random sample of claims against the visit documentation each quarter, and compare your visit-level mix with specialty peers. The OIG’s guidance suggests at least an annual sample review. A rising share of higher-level codes without clinical change is a prompt to investigate.

Can I leave a billing company before the contract ends?

Only as the contract allows. Check the termination clause, notice period and any early-exit fees; a July 2025 law-firm review suggests looking for termination on roughly 30 to 90 days’ notice. Securing data export and a signed return-or-destroy confirmation before notice protects the practice.

Sources and methodology

(a) Published standards, rules and definitions from named bodies

• HHS Office for Civil Rights, Sample Business Associate Agreement Provisions (January 25, 2013): hhs.gov/guidance/document/sample-business-associate-agreement-provisions.
• HHS Office of Inspector General, Special Advisory Bulletin: The Effect of Exclusion From Participation in Federal Health Care Programs (May 8, 2013): oig.hhs.gov/exclusions/special-advisory-bulletin-and-other-guidance/the-effect-of-exclusion-from-participation-in-federal-health-care-programs/.
• HHS Office of Inspector General, Compliance Program Guidance for Third-Party Medical Billing Companies, 63 Fed. Reg. 70138 (December 18, 1998); voluntary guidance.
• HHS OIG enforcement action, New Jersey medical biller settlement (settlement dated September 19, 2016).
• HHS Office for Civil Rights, HIPAA FAQ on cloud service providers storing ePHI outside the United States (content last reviewed December 28, 2022).
• 42 CFR 424.73 (payment to agents) and 42 CFR 424.44 (timely filing), as described by Noridian JE Part B, Claim Submission Timeliness (med.noridianmedicare.com/web/jeb/topics/claim-submission/timely-filing).

(b) Named benchmarking data providers

No proprietary benchmarking dataset was used. MGMA and HFMA publish revenue cycle benchmarks and metric definitions; the thresholds in this article are not drawn from those datasets and are not attributed to them. Practices needing specialty peer data should obtain it from a named benchmarking provider.

(c) Practical or illustrative targets from general industry sources

• Medical Billers and Coders, Medical Billing Company Red Flags: 7 Signs (June 2026): net collection rate under 90%, clean claim rate under 92%, denial rate over 8%, no account-manager contact in 30+ days. Vendor publication; thresholds unsourced.
• OmniMD, How To Choose The Right Medical Billing Company (2026): clean claim rate 90% or higher, denial rate under 8%, days in A/R under 40–45. Vendor publication; figures unsourced.
• Medwave Billing & Credentialing (2026): days in A/R above 50 described as a problem; clean claim rate 95% or higher. Vendor publication; figures unsourced.
• ADSC (2026): A/R over 90 days under 10%, attributed to HFMA without linked data; treated here as commonly reported only.
• Medical Economics, What independent practices get wrong when they hire a billing company (2026), on percentage-based pay, aged claims and data ownership.
• BillFlash, 10 Red Flags to Watch for When Outsourcing Medical Billing (November 2025), used to confirm the common vendor red-flag themes.

(d) Survey, study and legal commentary

• US Attorney’s Office, Northern District of New York, announcement of the North Country Neurology, P.C. False Claims Act settlement (August 3, 2022), as published on Oversight.gov.
• Day Pitney LLP, Where There’s a Bill, There’s a Way: Understanding Key Nuances of Medical Billing Contracts Before You Sign (July 21, 2025).
• Brennan, Manna & Diamond, The Risks of Outsourcing Medical Billing and the Importance of State-Law Compliance, client alert (June 24, 2026).
• Frier Levitt, Can EHR Vendors Block or Terminate a Medical Practice’s Access to Patient Information? (originally 2016; last modified December 2025).
• Paubox, What’s changing with HIPAA in 2026 (May 13, 2026), on the status of the proposed HIPAA Security Rule update.

Methodology: the SERP and AI-source review was a research-based approximation of live US results, not rank-tracking data from a paid tool. Results vary by practice, and figures reflect information available at the time of research (October 2026). This article is general information, not legal or financial advice; confirm contract and payment questions with qualified counsel.