This guide is for information only. It describes what the rules say and common practical safeguards; it does not replace legal advice on each hospital's situation.
Billing concentrates the hospital's most sensitive data
Billing is sensitive because it puts patient identity, diagnosis, procedures, supplies and amounts in one place, then sends all of it outside the hospital. LGPD classifies any health-related data linked to an individual as sensitive personal data (Art. 5, II) [1]. A hospital claim, a TISS claim form or a denial (claim denial) appeal with a medical report attached is therefore a set of sensitive data.
The data moves through registration, clinical care, in-house or outsourced billing, the health plan's auditor and several systems. Each step is processing, which under LGPD includes accessing, transmitting, archiving and deleting (Art. 5, X) [1].
The pillar guide Hospital billing outsourcing treats LGPD as a contract safeguard with the vendor. This guide covers the whole flow, with or without outsourcing.
Does the hospital need patient consent to bill?
As a rule, no. Consent is only one of the legal bases in Article 11, and billing usually relies on others [1]. Article 11, II lists seven situations in which sensitive data may be processed without consent when indispensable. Three show up in the revenue cycle:
- compliance with a legal or regulatory obligation (item a): Normative Resolution (Resolução Normativa, RN) 501/2022 of Brazil's National Supplementary Health Agency (Agência Nacional de Saúde Suplementar, ANS), the health plan regulator, makes electronic data exchange in the TISS standard mandatory between providers and health plans [6];
- regular exercise of rights, including in contracts and proceedings (item d): billing the health plan for care delivered and appealing a denial are rights exercised under the hospital–health plan contract;
- health protection, exclusively by health professionals and services (item f): covers clinical use, such as prior authorization and charting.
Consent is the least stable basis for billing because the patient can revoke it at any time (Art. 18, IX) [1]. That does not remove the duty of transparency: patients may ask with whom the hospital shares their data (Art. 18, VII) [1].
Article 11, § 4 allows data to go to the health plan for payment
Article 11, § 4 is the provision that matters most for billing. It bans the communication or shared use of health data between controllers to gain an economic advantage. The exception covers health services, pharmaceutical services and health care, including diagnostic and therapy services, for the benefit of the individuals [1].
Within that exception, the law expressly allows two cases: data portability requested by the individual (item I) and financial and administrative transactions arising from the use and provision of those services (item II) [1]. Sending the claim, the claim forms and supporting documents to the health plan to get paid is that kind of transaction.
The limit is in § 5: health plans may not process health data to select risks when enrolling or removing members [1]. Data the hospital sends for payment cannot be used that way. The exception also does not allow selling or handing over patient data for other purposes, such as third-party marketing.
Is the health plan a “processor”? Who is who in billing
No: a health plan (operadora) and a data processor (operador) are different things. In Brazil's private health system, operadora means the health plan company. Under LGPD, the processor (operador) handles personal data on behalf of the controller, and the controller makes the decisions about processing (Art. 5, VI and VII) [1].
In billing, the split is usually:
- The hospital is the controller of its patients' data: it decides what to collect, how to bill and with whom to share.
- The health plan is usually a separate controller: it receives the data for its own purposes (reviewing the claim, paying, auditing, meeting ANS obligations) and is responsible for what it does with it.
- The outsourced billing company is a processor: it handles data on the hospital's behalf and must follow its instructions; the hospital must check that they are followed (Art. 39) [1]. A processor that breaks the law or the controller's lawful instructions is jointly liable for damages and treated as a controller (Art. 42, § 1, I) [1].
- Hospital employees are usually treated as part of the controller, not as processors.
Vendors of hospital management systems, portals, cloud services and automation tools that access the data also tend to be processors; see AI in hospital billing for artificial intelligence tools.
See the steps as a table
| Step | Data | Role under LGPD |
|---|---|---|
| 1. Registration and eligibility | Identity, member card, plan | Hospital: controller |
| 2. Medical record and care | Diagnosis, procedures, supplies | Hospital: controller |
| 3. Billing | Claim, claim forms and TISS batch | Hospital: controller; outsourced billing company: processor (Art. 39) |
| 4. Health plan (operadora) and audit | Claim forms and documents for review and payment (Art. 11, § 4, II; risk selection banned, § 5) | Health plan: separate controller |
| 5. Denial appeal and payment | Reports and justifications, only as needed | Hospital and health plan: controllers |
| 6. Archiving and deletion | Medical record kept at least 20 years (Law 13,787/2018, Art. 6) | Hospital: controller |
Legal basis, role and safeguard at each billing step
The table summarizes the data path. The legal-basis column shows the basis usually relied on; the final choice is the hospital's, documented in its record of processing activities (Art. 37) [1].
| Step | Data processed | Legal basis usually relied on (LGPD) | Each party's role | Practical safeguard |
|---|---|---|---|---|
| Registration and eligibility | Identity, member card, plan | Art. 7, V, for registration data; Art. 11, II, d and f, for health data | Hospital controller; health plan controller when it responds | Collect only what is needed; visible privacy notice |
| Prior authorization | Diagnosis, report, tests | Art. 11, II, a, d and f | Hospital and health plan controllers | Use the official channel; no personal email or messaging apps |
| Medical record → claim | Procedures, supplies, progress notes | Art. 11, II, d and f | Hospital controller; management system as processor | Role-based access; access logs |
| TISS batch submission | Claim forms, amounts, TUSS codes | Art. 11, II, a (RN 501/2022) and d; § 4, II | Hospital controller; outsourced company as processor | e-CNPJ digital certificate (TISS item 21) [5]; batch with only what is required |
| Health plan audit | Medical record, claims, documents | Art. 11, II, d; § 4, II | Hospital and health plan controllers; auditor bound by professional confidentiality | On-site or electronic access with restricted profile and audit trail |
| Denial appeal | Medical report, justifications | Art. 11, II, d | Hospital controller; processor if outsourced | Attach only what supports the appeal |
| Management reports and BI | Aggregated production and denial data | Prefer anonymized data | Hospital controller | Anonymize or pseudonymize whenever possible |
| Archiving and deletion | Medical record and claim | Art. 16, I (legal obligation) | Hospital controller | Medical record: kept at least 20 years (Law 13,787/2018) [8]; outsourced company returns or deletes data at contract end |
The necessity principle (Art. 6, III) [1] runs through the whole table: process only the minimum for the purpose. In billing, that means, for example, not attaching the full medical record when a single prescription sheet proves the denied item. The TISS standard bars health plans from requiring the ICD (CID, disease code) on claim forms, as a result of a court decision (item 28 of the Organizational Component) [5].
What do the TISS standard and medical confidentiality add to LGPD?
The TISS standard (Troca de Informações na Saúde Suplementar, Brazil's mandatory claims data exchange standard) has a Security and Privacy Component that sets the protection requirements for health care data and rests on professional confidentiality (items 119 to 121 of Organizational Component 202609) [5]. The requirements apply to every system and portal that processes data in the standard (item 123), and clinical information that can identify a member may not be given to third parties except where the law allows (item 122) [5].
Medical confidentiality adds to LGPD. Brazil's Code of Medical Ethics (Código de Ética Médica) bars disclosing facts learned in professional practice, except for just cause, legal duty or the patient's written consent (Art. 73). It also bars allowing people not bound by confidentiality to handle medical records (Art. 85) and requires physicians to instruct their assistants to respect confidentiality (Art. 78) [7]. So the contract with the billing company and the agreements signed by billing staff should include explicit confidentiality terms.
In claim audits, Federal Council of Medicine (Conselho Federal de Medicina, CFM) Resolution 2,448/2025 grants the physician auditor on-site access to the medical record but bars removing the record or copies (Art. 10, II). That provision is not among those marked as suspended by a court decision in the official text [9]. The guide On-site vs. electronic claim audit explains how this affects remote audits.
The contract with an outsourced billing company needs seven clauses
The contract has to turn Article 39 into verifiable rules: the processor handles data only on the hospital's instructions, and the hospital must be able to check that [1]. In practice, the key clauses are:
- scope and instructions: purpose (billing, denial appeals, reconciliation), data processed and a ban on other uses;
- subprocessors: LGPD does not use the term, but the company may subcontract cloud services, systems or people. The contract should require the hospital's prior approval, an up-to-date list and the same obligations for each subcontractor;
- security: the technical and administrative measures of Art. 46, access control, encryption and access logs, including after the contract ends (Art. 47) [1];
- incidents: notice to the hospital without undue delay, with the information it needs to report to the ANPD and patients [2];
- confidentiality: agreements signed by everyone who accesses records and claims;
- audit and evidence: the hospital's right to audit and receive reports;
- contract end: return or deletion of data, with a deadline and proof.
These points belong in the vendor assessment described in How to choose a revenue cycle company.
What is the deadline to report a security incident?
The deadline is 3 business days. The controller must report to the ANPD and the affected individuals any incident that may cause relevant risk or harm (Art. 48) [1], and ANPD Board Resolution (Resolução CD/ANPD) 15/2024 set that deadline, unless specific legislation provides otherwise [2]. The ANPD treats incidents involving sensitive data as relevant, among other criteria, and gives the example of a hospital with exposed health data [2].
The hospital, as controller, reports the incident even when the leak happens at the outsourced company. That is why the processor's notice to the hospital must be fast. Small processing agents get double deadlines, but not if they carry out high-risk processing, which includes large-scale use of sensitive data (Resolution CD/ANPD 2/2022, Arts. 3, 4 and 14) [4]. A hospital or clinic that bills health plans is unlikely to qualify.
Penalties under Art. 52 range from a warning to a simple fine of up to 2% of the company's revenue in Brazil, capped at BRL 50 million per violation, plus publicizing the violation and blocking or deleting the data [1].
The data protection officer is the hospital's link to the ANPD and patients
The data protection officer (encarregado, DPO) is the person the controller appoints as the channel to individuals and to the ANPD (Art. 5, VIII, and Art. 41) [1]. Resolution CD/ANPD 18/2024 requires appointment by a formal written, signed act (Art. 3) and publication of the DPO's identity and contact details in a prominent place on the website (Art. 9) [3]. The DPO may be an employee, an outside individual or a company (Art. 12) and may not hold roles that create a conflict of interest (Arts. 18 to 21) [3]. For processors, such as an outsourced billing company, appointing one is optional but counts as good practice (Art. 6) [3].
In billing, the DPO should take part in mapping data flows with health plans, reviewing outsourcing contracts and the incident response plan.
What we see in operations
When it provides the service, Accrua acts as data processor under the LGPD (Brazil's General Data Protection Law), and the hospital is the controller: Accrua processes data only for the contracted service and follows the hospital's documented instructions. The contract provides for encryption in transit and at rest, role-based access control and audit logs of access, with individual, named accounts and notice of staff departures within 1 business day.
In case of an incident, the hospital is notified within 24 hours of confirmation; notifying the ANPD (the national data protection authority) is the hospital's role as controller. The list of sub-processors, with purpose, data categories and location, is available to the hospital; a new sub-processor is announced 15 days in advance, with a right to object; and no sub-processor may use the data to train models or keep it longer than needed.
Where to start
- Map the data path in billing, from registration to archiving: who accesses it, through which system and to which health plan it goes.
- Record the legal basis for each flow in the record of processing activities (Art. 37), with the DPO and legal team.
- Review contracts with processors: billing company, management system, portals and cloud, covering instructions, subprocessors, incidents and data return.
- Shut down informal channels for clinical documents and limit attachments to what proves the claim.
- Test the incident response plan, including notice from the outsourced company, to meet the ANPD's 3 business days.