Medical Billing Client Onboarding: Contracts, Access, AI Reports

Medical billing client onboarding should cover the signed services agreement and BAA, least-privilege access to each system, a payer enrolment status check, a baseline of claims and AR, a welcome pack and a first-month report. AI can draft the checklists, summaries and reports, while people own the contracts, the logins and the numbers.

Most billing companies onboard by memory, and the failures are predictable: a login shared in an email, a payer enrolment nobody checked, a baseline missing so no one can prove the first month improved anything. A written sequence, the same for every client, fixes all three. It also shows the practice, in its first week, that someone is in control. Run it in week order, and at each step decide in advance where AI helps and where it must not be trusted. For the stage before this, see drafting a practice quote with AI.

Follow me on Instagram@sagnikteaches

Week zero: the paperwork that must exist first

Nothing starts until the documents are signed. Three matter most: the services agreement, the business associate agreement (BAA, the contract that says how you handle a practice's patient information) where the data falls under health-privacy rules, and your own subcontractor terms with any vendor that touches that data.

Connect on LinkedInSagnik Bhattacharya

The services agreement should state scope, who submits what and by when, how fees are calculated and invoiced, what the practice must supply, how long records are kept, how either side ends the contract and what happens to the data afterwards. A BAA is usually a standard template; the practice may send theirs, in which case read it rather than assume it matches yours. I am not giving legal advice here, and your agreement should be reviewed by a qualified adviser.

Subscribe on YouTube@sagnikteaches

AI is useful for reading. Paste a client's draft agreement, which contains no patient data, into an approved tool and ask for a plain-language list.

Read this services agreement and list: (1) what we must do, with any deadlines or percentages, (2) what the client must do, (3) fees and when they are due, (4) termination notice and data return terms, (5) any clause that is unusual or one-sided. Quote the clause number for each. Do not give legal advice and do not guess where the text is silent; say "not stated".

An illustrative summary might list that claims go out within two business days of receiving a complete encounter, that fees are a percentage of collections billed monthly, and that data return is not stated. That last gap is exactly what you raise before signing. The wider principle of describing AI use to clients is covered in how to mention AI use in client contracts and proposals, and your approach to AI vendors matters here. Vendors offer BAAs on particular products only: Anthropic's privacy centre, for instance, lists its API and Claude Enterprise (once the account owner accepts the agreement) but not its consumer plans. Which Claude plans offer a BAA shows the kind of check to run on any tool before client data goes near it.

Access and credentials without email threads

Access is where small companies cause their worst incidents. The rules are short. Each person on your team gets a named account in each client system, so actions are traceable. The practice grants the least access needed: a biller may need to view the schedule and enter charges but not change clinical notes. Credentials never travel by email, chat or text. If a system cannot give you named accounts, the practice should share through a password manager, with the sharing logged.

Build an access register, one row per client system: system name, purpose, account holder, access level, who granted it, date, how it will be removed and the date it was reviewed. Review quarterly and remove access on the day someone leaves your team or the contract ends. A tool can help you draft the register and the removal checklist; it should never hold the credentials themselves, and no prompt should include a password, token or a link that logs someone in.

Access request, filled in

Send the practice a single form listing what you need and why, so nobody receives scattered emails. An illustrative version for a four-provider practice: practice management system (view schedule, enter charges, run reports), clearinghouse (submit and view claims and remittance), payer portals (check eligibility and claim status, one login per payer the practice already holds), and the document store (read-only access to encounter notes and superbills). For each, the practice chooses who sets it up and when. Use AI to turn your standard list into the request email, then edit it so it names the real systems.

Payer enrolment and credentialing status

Claims fail quietly when a provider is not enrolled with a payer, a remittance route is not set up or an electronic funds arrangement is missing. In the first fortnight, build a status table by provider and payer: enrolment state (active, pending, not started), effective date, claim submission route, remittance route and funds transfer set-up, and who owns the next step. Get this from the practice's records and the payers' own portals; AI cannot tell you the status of any enrolment.

Illustrative rows. The point of the table is the "hold claims" decision: submitting claims for a pending provider can produce a pile of denials that become aged AR. Put that rule in your onboarding policy, in writing. Renewals and revalidation dates belong in a tracker too, and tracking payer credentialing renewals with AI shows a way to keep them in view.

The baseline you will be judged against

If you cannot show where the practice started, you cannot show an improvement. In the first two weeks, capture a baseline from the previous period: charges per month for the last six to twelve months, collections per month, the AR ageing summary by bucket, denial rate and top reasons if the practice can supply them, the days from visit to claim, and the number of unbilled encounters. Keep the data in your own spreadsheet and name the source of each figure.

Spreadsheets from practices are messy. AI can help structure them, as long as identifiers are removed first. Export only the summary level for the baseline, since the baseline needs counts and totals, not patient lines. If you need to look at claim-level detail to understand a problem, do it inside your billing system or a tool covered by an agreement, not a consumer chat. Where AR is part of the baseline, prioritising aged claims with AI shows how to turn the aged report into a ranked queue.

A welcome pack that answers the first month's questions

The welcome pack is a few pages the practice can keep on the desk. Start from the questions new clients ask: who is my contact, what do I send you and how, when will claims go out, what do I need to do each week, who do I call when a payer rings me, how do I see what is happening. Ask AI to draft from a facts sheet you maintain.

Write a four-page welcome pack for a new medical practice client of our billing company. Plain British English, friendly and clear, no jargon.
Facts (use only these): our contact is [name], reached by [method], replies within one working day; encounters are sent by [method] by [time] each day; claims go out within two business days of a complete encounter; the practice should forward any payer letters within two days; monthly report arrives by the [date]; urgent issues go to [escalation contact].
Sections: who does what; what we need from you each week; how to send us documents safely; what happens to a claim, step by step; what to do if a payer or patient contacts you; your monthly report; how to raise a concern.
Do not promise collection amounts or timelines beyond those listed.

Check what comes back for promises. An early draft may say "we will maximise your revenue" or "no more denials". Strike both: neither can be guaranteed and a contract may hold you to what you write. What you would add by hand: the day of the week claims are batched, a diagram of the claim's path, and one named person at the practice who owns the weekly handover.

The kickoff call, and a tracker that shows where each client is

A thirty-minute kickoff call with the practice manager and a clinician sets expectations. Use an agenda drafted by AI: introductions, the access list, the enrolment table, the baseline, the weekly rhythm, the first report date. Afterwards, send a summary with owners and dates; a tool can turn your rough notes into that summary, provided the notes contain no patient information.

Keep a single onboarding tracker with one row per client and a column for each milestone: agreement signed, BAA signed, access granted, enrolment table complete, baseline captured, welcome pack sent, kickoff held, first claims submitted, first report sent. Colour the cell on completion and put the date in a note. At a glance you see which clients are stuck and on what, and the tracker is a good place for AI to draft the reminder emails: "Hi [first name], we are still waiting for read-only access to the clearinghouse; here are the three steps."

How the practice will send encounters, agreed in writing

The biggest daily dependency is the handover of encounters, the record of what was done for each patient, so agree the method before the first claim. Options include a shared system the practice already uses, an export your team pulls each morning, or a secure upload folder. For each, write down who sends, by what time, in what format, what counts as complete, and what you do with an incomplete one. A rule such as "an encounter without a diagnosis or a rendering provider is queried within one business day and the claim clock starts when we receive the answer" prevents the argument in month two about whose delay it was.

AI can help draft the rule and a query template for missing information, which keeps your messages consistent: "Hi [first name], encounter [reference] is missing the rendering provider. Please reply with the name and we will submit today." Use references, not patient names, in queries sent through any channel that is not covered by your client agreement.

A client rules sheet your whole team can follow

Every practice has quirks: which providers see which payers, which codes they favour, which payer needs paper, who may approve a write-off. If these live in one person's head, a holiday breaks the account. Capture them on a one-page rules sheet per client, written in the first fortnight and updated whenever something changes. Ask AI to turn your rough kickoff notes into a clean sheet, with identifiers stripped.

Turn these kickoff notes into a one-page client rules sheet with headings: contacts and escalation; systems and who has access; daily handover; payers with special rules; write-off and adjustment approvals; reporting dates; things the client asked us not to do. Use only what is in the notes and write "NOT STATED" where a heading has nothing. Notes: [paste notes without patient names]

The "NOT STATED" rule turns the gaps into an agenda for the next call with the practice. Illustrative result: under write-offs, "NOT STATED", which tells you to ask the practice manager what amount you may adjust without approval. Send the finished sheet to the practice for confirmation, so it is something they have agreed to, not just something you wrote. Teach new staff the rules sheet and your AI rules together in their first week, so nobody learns the client's quirks by trial and error.

The exit plan, written on day one

It sounds odd to plan the end at the start, but it is the clause that clients read most carefully. State how notice works, what you return and in what format, how long you retain records, how access is removed and who confirms it, and what happens to claims in progress. Ask AI to draft a one-page offboarding checklist from those clauses. A practice that sees a clean exit plan in week one tends to trust the rest of your process, and you avoid a rushed scramble if the relationship ends.

A worked example: onboarding a four-provider practice

An illustration, with all figures invented. A small billing company takes on a four-provider practice that sees about 900 patient visits a month. In week zero, the owner reads the services agreement with an AI summary and spots that data return is not stated; the practice agrees to add 30 days. The BAA is signed and a named-account request goes out.

In week one, three of the four systems have named accounts; the fourth, a payer portal, shares one login that the practice's manager is unwilling to split. The billing company records the exception in the access register with a review date and a note that the login will be moved into a password manager. In weeks one and two, the enrolment table shows one provider pending with a payer. The decision is to hold that provider's claims for that payer and to tell the practice why, in writing, with the expected cost of submitting anyway: probable denials that the team would then have to chase.

In week two the baseline shows $79,500 average monthly charges, AR over 90 days at 26 per cent and a first-pass acceptance of about 85 per cent from the previous biller's reports. In week five the first report shows improvements on two of these and a new issue, missing authorisations. Because the baseline existed, nobody argues about whether the improvement is real. That is the value of doing the dull work first.

The first-month report, drafted in a way you can defend

The first report sets the tone. It should be short, honest and comparable with the baseline. Illustrative contents for a practice with four providers: charges submitted, collections received, number of claims submitted and accepted first time, denials grouped by reason, AR by bucket against the baseline, enrolment items still open, and a half-page summary of what happened and what you will do next month. Keep to figures from your billing system, and keep the narrative modest: it is your first month, and the practice knows that.

AI helps with the narrative once you have the numbers. Feed it the figures, not the claims.

Write a half-page summary for a practice's first-month billing report. Use only these figures and no others:
Charges submitted $84,200 (baseline monthly average $79,500); collections $52,300; first-pass acceptance 91%; top three denial reasons: missing authorisation (14), eligibility (11), duplicate claim (6); AR over 90 days 19% of total (baseline 26%); open enrolment items: 2.
Tone: factual, calm. Explain what the figures mean in plain English, name the two biggest issues, and list three actions for next month. Do not claim causes that the figures do not show.

All figures here are illustrative. A reasonable output would say that charges are slightly above the baseline, that AR over 90 days fell, and that denials from missing authorisation are the largest group and the first priority. What you would fix: any sentence that says the fall in older AR was "because of our work" when the cause may be partly the clearing of old items, and any trend claimed from one month's data. Check every figure in the draft against the source report before it leaves the building.

A realistic thirty-day timeline

1. Days 1 to 3: signed agreement and BAA, access request sent, kickoff booked.
2. Days 4 to 10: named accounts created, access register complete, enrolment table drafted from the practice's records and payer portals.
3. Days 8 to 14: baseline captured, welcome pack sent, first encounters received.
4. Days 10 to 20: first claims submitted, status checks on pending enrolments, first denial review.
5. Days 25 to 30: first-month report drafted, figures checked, report sent with a short call.

Practices differ, and a slow enrolment can hold a provider's claims for weeks, so treat the timeline as a target and show the practice the dependencies.

Where onboarding breaks, and how it shows up

A realistic failure is the shared login: a front-desk manager emails a username and password, and a month later nobody knows who used the account. The fix is the access register and a named account for each of your staff. A second is the missing authorisation: claims for a service that required prior approval go out, and the denials arrive in week six. Add a question about authorisations to the first-week checklist. A third is the unwritten scope: the practice assumes you will chase patient balances; you assumed you would not. Put patient statements and calls on the scope page in plain words.

A fourth is AI use that nobody told the client about. If you use AI tools in your process, say so in the agreement or welcome pack, name what they are used for, and confirm that no patient data goes into a tool without an agreement that covers it. For a deeper look at the safeguards, a confidentiality checklist for small practices is a useful companion.

If you would like to map your onboarding steps and choose what to automate, that is what my AI implementation consultation covers. The first useful step is usually the tracker and the access register, because every later improvement depends on knowing where each client stands.

Onboarding questions billing companies ask about AI

What must be signed before a billing company touches patient data?

At minimum a services agreement and, where the client's data is covered by health-privacy rules, a business associate agreement. Your own subcontractors, including any AI vendor that will see the data, need equivalent terms. Have a qualified adviser review your templates; this is not legal advice.

How should a client share logins with us?

Never by email or chat. Ask the practice to create named user accounts for your staff in each system, with the least access the work needs, or to share through a password manager. Record who granted what and when, and remove access promptly when the contract ends.

Can AI read the client's contract for me?

It can summarise a contract's clauses and list obligations, deadlines and unusual terms, which helps a busy owner. It cannot give legal advice, and a missed clause can be costly, so use its summary as a reading guide and have an adviser review anything unusual.

What goes in a welcome pack?

Who does what, how to reach you, how to send documents and questions, the monthly calendar, what the practice must do each week, how issues escalate, and what the first report will show. Keep it to a few pages and send it before the kickoff call.

What should the first-month report contain?

Charges, collections, claims submitted, first-pass acceptance rate, denials by reason, AR ageing and open enrolment items, with a short written summary and the next month's priorities. Compare with the baseline you captured in onboarding, not with a general benchmark.

Further reads

• Best AI Tool for Medical Billing: Scrubbing, Coding, Denials — Pick AI tools for scrubbing, coding and denials.
• AI Denial Management for Medical Billing: Group, Appeal, Track — What to do with the denials the first report shows.
• Can ChatGPT Read PDFs, Spreadsheets and Photos? What Breaks — What breaks when AI reads practice exports and scans.
• What to Ask Before Buying Any AI Tool for a Medical Practice — Questions a practice should ask any AI vendor.
• Physical Therapy Billing: AI Checks for Claims and Time Entries — Pre-submission checks worth adding for a therapy client.
• Optometry Insurance Verification: A Front-Desk Workflow With AI — Insurance verification steps for a new client's front desk.
• Medical Practice KPIs: A Monthly Dashboard Built With AI — Grow the first-month report into a monthly dashboard.
• How to Onboard New Hires Onto Your AI Tools and Rules — Teach your own new staff the AI tools and rules.
• AI Claim Scrubber: What It Catches and What It Misses — Modifier, bundling and diagnosis edits are caught; eligibility, documentation and fresh payer rules often are not. Test one on 50 claims.
• AI for Medical Billing Companies: Seven Jobs to Automate First — Seven jobs for a medical billing company to automate first, ranked by risk, with sample prompts, a worked denial-letter example and the human checks each needs.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: official health-privacy guidance on business associate agreements and subcontractors, Anthropic privacy centre article on business associate agreements (both checked 4 November 2026); common billing-company onboarding practice.