Office admin

Vendors, PHI, and money

The BAA gate that decides who may receive patient data, the Square connection, and the fee and statement settings behind every bill.

8 min · Administrators · lesson v1

Three cards decide who may touch patient data and how money is described. They are the ones to get right before go-live.

The BAA gate

  1. Integrations & vendors states the practice's rule outright: no PHI goes to any vendor without a signed BAA (plus no-train and short-retention terms). A vendor can only be marked cleared for PHI once its BAA is signed, or when a BAA is not required because the vendor never receives PHI.

    Each vendor gets a Name, a Category (e-fax, e-Rx, Eligibility, Labs, Clearinghouse, Messaging, AI model, Payments, Telephony, Other), a BAA status (no BAA, BAA requested, BAA signed, BAA not required), a Cleared for PHI checkbox, a Connection and notes.

    Screenshot pending capture

The table's PHI column shows ✓ or ✗ at a glance. That column is the thing to review before a go-live.

Card payments

Connect Square account links the practice's own merchant account, so card payments settle into your account. You paste an Application ID and OAuth secret from the Square developer dashboard, add the shown redirect URL to the Square app, choose Sandbox (testing) or Production (real money), then Connect Square.

Payment terminals (Square) maps each location to its device: the front desk's Charge terminal button pushes the amount to this device. It also reassures you where the secret lives — Device ids only; the Square access token stays in the server environment.

Two warnings appear here and both mean "cards will not work":

  • Square is not PHI-cleared in Integrations & vendors, so charges are refused.
  • no active device mapping yet; charges are refused until one is saved below.

Fees, payers, statements

Fee schedule is the practice's CPT/HCPCS → fee list — drives charge amounts and patient statements. One fee per code + modifier. This is where the amount on a claim starts.

Payers is the insurance list. The identifier is what claims actually carry — MEDICARE, ACME-PPO — which is why the patient Billing tab tells staff to pick from this list rather than typing a payer name.

  1. Statements & discounts — flagged config + display only — no payment vendor — sets three things:

    • Statement header note — how to pay, office contact
    • Statement footer note — financial-responsibility boilerplate
    • Self-pay / prompt-pay discount (%)

    with a live Sample statement preview (synthetic) beside it.

    Screenshot pending capture

Write the header and footer as though a patient is reading them upset, because sometimes they are. Empty ones are called out in the preview: No header note — patients see no how-to-pay line.

What usually goes wrong

Ticking BAA signed to unblock the checkbox. That is a statement about a contract. If it isn't signed, it isn't signed.

Connecting Square in Production for testing. Production (real money) means it.

A fee schedule with holes. A code with no entry has no default amount, and somebody types one under pressure at sign-off.

Blank statement notes. The patient gets a bill with no way to pay it and no context.

Check yourself

No score, no account — just make sure you can answer these before you move on.

  1. Why can't you tick Cleared for PHI on a new vendor?

    Show the answer

    Because its BAA status is still no BAA. The disabled tooltip is the practice rule in one sentence — no PHI goes to any vendor without a signed BAA — set BAA status to 'signed' (or 'not required' if the vendor never receives PHI) first. The control enforces the policy rather than trusting you to remember it.

  2. The front desk says card payments are being refused. What are the two things to check here?

    Show the answer

    Whether Square is PHI-cleared in Integrations & vendors — if not, the terminal card warns Square is not PHI-cleared in Integrations & vendors, so charges are refused — and whether that location has an active device mapping, since without one charges are refused until one is saved below.

  3. A biller says a claim went out with the wrong charge amount. Where does that number come from?

    Show the answer

    Fee schedule — one fee per code plus modifier. It prefills the amount at sign-off, and the clinician can edit it before finalizing. So the answer is either the schedule entry or the edit, and the claim will tell you which.