Billing involves protected health information, so every vendor must follow HIPAA privacy and security rules. That includes encrypted transmission, role-based access, staff training and a signed business associate agreement.
Ask any billing partner how they store data, who can access it and how they respond to incidents.