How to Handle Receipts That Contain Patient Information

To handle receipts that contain patient information, small healthcare businesses must comply with HIPAA regulations, including the Privacy and Security Rules, provide Notices of Privacy Practices, and understand patient rights such as access to records and accounting of disclosures. You should also ensure that third-party vendors handling protected health information (PHI) have a Business Associate Agreement in place. Furthermore, consider investing in healthcare expense management for under $10/user (2026) to streamline your billing process and reduce errors. For a complete overview, see our expense management guide.

Understanding HIPAA Regulations for Patient Information on Receipts

HIPAA, or the Health Insurance Portability and Accountability Act, sets national standards for protecting patient health information, also known as PHI.

• Healthcare providers must give patients a Notice of Privacy Practices (NOPP) explaining how health information is used/shared, typically on the first visit or by mail.
• Patients are not required to sign an acknowledgement of receipt for the NOPP, and refusal does not prevent provider use/disclosure under HIPAA.

Under HIPAA, patients have certain rights, including the right to inspect and obtain copies of their health information within a designated record set. Requests are generally fulfilled within 30 calendar days.

Additionally, the HIPAA Security Rule mandates administrative, physical, and technical safeguards for electronic PHI, including policies, training, risk assessments, controlled access, encryption, and firewalls.

When complying with HIPAA, it's essential to be aware of these regulations to avoid any potential breaches or non-compliance issues.

Complying with HIPAA: Storage, Disposal, and Business Associate Agreements

When handling patient information on receipts, it's essential to comply with HIPAA regulations for storage, disposal, and business associate agreements.

Storage: Store receipts containing patient information in a secure, locked location, such as a file cabinet or a designated storage area. Ensure that only authorized personnel have access to these receipts.

Disposal: Dispose of receipts containing patient information by shredding or otherwise destroying them to prevent unauthorized access. Use a secure shredder or hire a reputable shredding service to ensure proper disposal.

Business Associate Agreements: If a third-party vendor handles patient information on behalf of your healthcare business, a Business Associate Agreement (BAA) is required. A BAA outlines the terms and conditions for handling patient information and ensures that the vendor complies with HIPAA regulations.

When creating a BAA, ensure that it includes the following:

• A description of the patient information to be handled
• The permitted and required uses of patient information
• The responsibilities of the business associate
• The procedures for reporting breaches

Patient Rights and Responsibilities: Access to Records and Accounting of Disclosures

Patients have certain rights and responsibilities when it comes to their protected health information (PHI) on receipts. Under the HIPAA Privacy Rule, individuals have the right to access, inspect, and request corrections to their PHI. They also have the right to receive an accounting of PHI disclosures made by your healthcare business.

When a patient requests an accounting of disclosures, you must provide them with a list of the following:

• The date of each disclosure
• The name of the recipient of the disclosure (if applicable)
• A brief description of the PHI disclosed

However, the HIPAA Privacy Rule excludes certain disclosures from the accounting requirement, including those made for treatment, payment, and healthcare operations. Additionally, you are not required to provide an accounting of disclosures made within the last six years; instead, you must provide disclosures made within the last three years.

Patients also have the right to request a copy of their PHI, and you must provide it to them in a format that they can access easily. You can charge a reasonable fee for the cost of copying and mailing the documents.

It's essential to keep accurate records of all PHI disclosures and to provide patients with a clear understanding of their rights and responsibilities under HIPAA. This will help you avoid potential disputes and ensure compliance with the law.

Tax Implications for Healthcare Businesses: Deductibility and Credits

As a healthcare business owner or office manager, it's essential to understand the tax implications of handling patient information on receipts.

• Self-Employed Health Insurance Premiums: As a self-employed individual, you may be able to deduct the cost of health insurance premiums for yourself and your family on your tax return.

When handling receipts that contain patient information, there are additional considerations beyond HIPAA regulations. Many thermal paper receipts contain Bisphenol A (BPA) or Bisphenol S (BPS), which are endocrine disruptors. Handling these receipts can transfer these chemicals to the skin, and using hand sanitizers can increase absorption.

• Wash your hands thoroughly after handling thermal paper receipts.
• Avoid using hand sanitizers or other chemicals that can increase absorption of BPA and BPS.
• Consider using digital receipts or paper receipts with non-thermal paper.

Be sure to comply with any additional requirements.

When it comes to disposing of thermal paper receipts, consider recycling them or using a secure shredder to prevent identity theft and minimize exposure to BPA and BPS.