Keep Patient Names Out of the Ledger

A medical or dental practice often exports a billing file so accounting can post charges and payments. That file can carry patient names, dates of birth, and chart numbers next to each line. After you read this, you can decide which identifiers may travel into accounting and which must stay in the practice system.

What travels with billing files

Many practices in Chapel Hill send a weekly file from the practice management system, the software that holds appointments and claims. The export is meant to show what was billed and what was collected. Extra columns become a privacy problem when they include a person's name.

A typical file is a spreadsheet or a comma-separated text file, a simple list that any spreadsheet program can open. Columns often include the patient name, the date of service, a procedure code, and an amount. Once that file sits in a shared folder, anyone with folder access can open every row.

You should treat that file as a copy of clinical identity because it can identify a patient as easily as a chart. Accounting needs totals, payer names, and invoice numbers to close the month. A date of birth or a home address does not help a bookkeeper post a payment.

Why the ledger is different

The ledger is the set of books in your accounting system, the record of income, expenses, and deposits. It is built for tax reports, payroll, and cash. It is not built to hold protected health information, which is patient data that can identify a person. This also matters under HIPAA, the federal privacy rule for health information, because a named export is still patient data.

Staff who never open a chart may still open QuickBooks or a similar paid account. If patient names sit on every invoice line, those staff can see who visited and what was billed. That access is wider than the front desk list, and it often lasts because accounting files are kept for tax time.

A practice can post revenue by payer, by provider, or by a visit code that is not a name. The books still balance when the line shows an invoice number instead of a surname. Ask whether anyone in accounting truly needs a name to finish the posting.

A copy sent to a tax preparer can carry the same names if the accounting file is the source. Ask what the preparer receives and whether a trial balance, a summary of accounts without patient rows, would meet the need. A summary still supports the return, and it keeps identities inside the practice.

Checks to run this week

A busy owner can learn the risk from files that already exist, without buying anything. Open last month's export from the practice system and look at it as a stranger would. Run the checks below on that file before the next close.

• Columns. Write down every column header so you know which fields left the practice system.
• Names. Search the sheet for a known patient and confirm whether the name appears.
• Folder. Note the shared folder, drive, or mailbox where the file now lives.
• Access. List every person who can open that location today.
• Copies. Ask whether anyone saved a second copy on a laptop or a personal account.

Those copies matter because a named file on a home laptop is still a copy of patient identity. A personal cloud folder is not a safe place for that sheet. Bring extra copies back under the company account or delete them once the official file is stored.

Questions for your billing vendor

Many practice systems let you pick columns, even if no one has asked in years. A short call is enough if you know what you want the file to contain. Ask the questions below before the next export is scheduled.

• Names. Ask whether the patient name can be omitted and still let accounting post.
• Identity. Ask whether a date of birth or chart number is required for the file to load.
• Invoice. Ask whether an invoice number or encounter code can stand in for the person.
• History. Ask where older export files are stored and who can still open them.
• Email. Ask whether the file is sent as an email attachment to a shared mailbox.

A paper list of systems is enough to start, and this applications assessment page is further reading if you want a fuller inventory. Write down the practice system, the accounting system, and any shared mailbox that receives the file. That list shows where a name can leak even when the next export is clean.

Warning signs worth acting on

Identifiers may already have left the practice system, and the signs are often sitting in mail and folders. You can spot them in shared libraries and in the accounting paid account. Use the list below as a scan of recent months.

• Forwarded sheets. A spreadsheet with patient names has been emailed to someone outside the company.
• Personal drives. A bookkeeper keeps the monthly file on a personal laptop or a home folder.
• Full columns. The accounting invoice screen shows a surname next to every charge.
• Open libraries. A shared library for billing is open to the whole company.
• Old archives. Compressed files from past closes still sit in the same folder as this month's export.

If you find any of these, stop the next export until the columns are agreed. A pause of a few days is cheaper than a named file that lives in several places. Tell the office manager which fields must come out, and put that in writing so the next person does not restore the old layout.

How to keep names out

You have more than one way to keep patient identifiers out of the ledger. The cleanest path is to export only what accounting must post. Compare the options below with your office manager this month.

• Narrow export. Keep payer, amount, date, and invoice number, and drop every name field.
• Visit code. Use an encounter number, a visit code that is not the patient's name, as the only reference.
• Separate report. Give clinical staff a named report inside the practice system, and give accounting a nameless file.
• Folder rights. Store the nameless file in a folder that only the bookkeeper and the owner can open.
• Old files. Remove or lock past exports that still contain names once you have a cleaner file.

A named report inside the practice system still lets the office answer patient billing questions. Accounting can still tie a deposit to an invoice number when a payment arrives. The two jobs do not need the same columns, because one answers the patient and the other posts the deposit.

If the file lives in Microsoft 365, review who has access because shared libraries often include more people than you expect. Further reading on admin rights and sign-in can help you frame that review. Do not leave a named export in a library that the whole company can open.

Do not send a named billing file to a personal email address or a home computer. A bookkeeper who works from home still uses the company account, not a private mailbox. Old attachments stay in sent mail long after the month has closed, so treat email as a poor place for this file.

Key takeaways

Hold these points when you decide what the next export may carry. The list below is short enough to keep beside the billing computer.

• Patient identifiers should stay in the practice system unless accounting cannot post without them.
• Open the last export and list every column before you approve the next one.
• Ask the vendor to drop names, dates of birth, and chart numbers from the file.
• Limit folder access so only people who post the books can open the export.
• Remove or lock old named files that still sit in shared libraries.

An owner in Chapel Hill can act on this without a purchase by opening the last export and striking every name field. Third Shift Group LLC hosts the further reading linked above on applications and on sign-in rights. Keep patient identity in the practice system, and let the ledger hold invoice numbers and totals so both jobs still get done.