Billing service providers in healthcare: C5 attestation for platform and claims processing

This page is for billing centres in healthcare that bill on behalf of healthcare providers and run their own cloud services for this: a portal for customers, billing software and transmission to the payers. Whether you fall under Section 393 SGB V (Book V of the German Social Code) as a processor for healthcare providers, and what that means for your attestation, is explained on the Section 393 SGB V page. This page does not repeat that and is not legal advice.

What social law says about billing through third parties

Several provisions of SGB V allow healthcare providers to use third parties for billing, each with its own conditions. We reproduce the wording without interpreting it. There is no official English version; the quotations are our translation:

Which of these provisions applies to your business and what each requires in detail needs a legal assessment. For the C5 attestation, the key point is this: these provisions govern whether and how you may process data. The attestation covers the information security of your service; according to the BSI FAQ, C5 focuses primarily on information security rather than on data protection.

The example: billing for therapy practices and nursing services

Fictitious example, not a client. A billing centre bills the health insurers on behalf of physiotherapy practices and outpatient nursing services. Its service:

• Portal in the browser, where customers enter services, upload prescriptions and see the status of their billing; run on a cloud platform in a region in Germany.
• Scanning unit in its own office for prescriptions that arrive on paper. The originals are destroyed in-house after a fixed period.
• Claims processing by its own employees, who check prescriptions, handle queries and approve billing.
• Transmission of the billing data electronically to the health insurers and payment to the customers.

Who is responsible for what: billing centre, platform, customer

Decision 1: claims processing as access to customer data

For most SaaS providers, access by their own staff to customer data is the exception, for example in support. For a billing centre it is the core of the service. That changes how IAM-07 “Access to Cloud Service Customer Data” should be read:

• IAM-07.06B requires the provider to disclose, through contractual agreements and before offering its services, all instances in which it may access customer data in unencrypted form. Claims processing is such an instance; it belongs in the contract with its purpose and scope.
• IAM-07.03B governs informing the customer about access without their prior consent. By its wording, the criterion only allows the contract to exclude information on each access where data is not accessed in unencrypted form; claims processing reads prescriptions and billing data in plaintext. If the provider wants to avoid informing the customer of each access by claims processing, the only option is therefore the customer’s prior consent, in our assessment in the contract on claims processing. Whether its form is sufficient is something to clarify with your auditor. Access outside this purpose, for example by developers troubleshooting an error, is subject to the duty to inform.

Our recommendation: design roles so that each claims processor sees only the customers they look after, and log every access. Then you can show that access stayed within the agreed scope, and access outside it stands out. C5 does not check whether a bill is correct in substance; what is audited is whether the information security of the processing is ensured. For how to make permissions audit-ready overall, see the IAM domain.

Decision 2: scanning unit and paper documents

Is the scanning unit part of the subject matter of the audit? In our assessment, yes, if receiving paper documents is part of the service offered; it then belongs in the system description together with the process up to destruction. That does not yet decide which physical criteria apply to the room. According to the supplementary information on PS-01, PS-01 to PS-07 are aimed at data centres and server rooms housing system components that process customer data; the catalogue refers to PS-08 for premises and buildings in which no cloud service customer data is processed or stored, such as offices. Customer data is processed in the scanning unit. Whether PS-01 to PS-07 apply to it or PS-08 is sufficient should therefore be clarified with the auditor before the audit, with the allocation justified in the system description. For office environments, PS-08.01B calls for security requirements based on a risk assessment, including no openly visible confidential data at unattended workstations and disposal of company documents that are no longer required within the company premises.

For a scanning unit, these are exactly the points that matter: lockable storage until scanning, a fixed period until destruction and a record showing that it was kept. If a service provider handles the destruction, it belongs in the directory of service organisations under SSO-04.

Decision 3: clarify the cloud platform and social law before the audit starts

Under section 3.4.6, a service run on the infrastructure or platform of another cloud service provider is generally treated as a subservice organisation relationship. The system description names the platform with the company name, the location of processing and storage and your assessment of the dependency (section 3.4.5.1 no. 8). The report therefore makes the relationship visible.

Whether it is permissible under social law is a question the report does not answer. If you bill for contracting parties under Section 295a SGB V, the wording there excludes subcontracting relationships. Whether and how this affects the use of a cloud platform is a legal question you should settle before the audit starts, because changing the architecture afterwards shifts the subject matter of the audit. The same applies to other service providers with access to customer data, such as a scanning or printing service provider. For how to classify service providers as subservice organisations and keep the inventory, see subservice inventory.

Decision 4: transmission to the insurers and purpose limitation

The health insurers receive the billing data. In our assessment, that does not make them subservice organisations: they do not provide any part of your service. The transmission path to them does belong in your subject matter, though. The relevant criteria are CRY-04 “Protection of Data for Transmission (Transport Protection)”, which requires state of the art encryption and authentication for the transmission of customer data over public networks, and COS-08 “Policies for Data Transmission”, with documented safeguards that are implemented and reviewed regularly. PI-01, by contrast, concerns the interfaces through which your customers and their IT systems access the service, in the example the portal. A transmission log for each delivery to the insurers is the natural evidence.

The purpose limitation in Section 302(2) sentence 3 SGB V affects your product planning: analyses across several customers, such as benchmark figures in the portal, should be checked legally beforehand. For the attestation, in our view, what matters is that the system description shows which data you process for which purpose, and that anonymised analyses are technically separated from the billing data.

Evidence billing centres should prepare

Possible gaps at billing centres