Business associate agreement for offshore medical billing: what the contract must say

HHS guidance on business associates requires a written contract between a covered entity, such as a medical practice, and a business associate that handles protected health information for it. A billing company or a staffing provider whose people work in your billing systems can fit that description, though HHS also lets a covered entity treat a person working under its direct control as workforce; see workforce or business associate. HHS also says the risks vary by location, which is why the contract matters more, not less, when the work is done outside the US. A Business Associate Agreement is signed before anyone touches protected health information.

A business associate must notify the practice of a breach of unsecured protected health information without unreasonable delay, and in no case later than 60 calendar days after discovery (45 CFR 164.410). A breach counts as discovered on the first day it is known to the business associate or would have been known with reasonable diligence, and knowledge by any employee or agent other than the person who caused it counts.

That limit is an outer limit. A practice that depends on its own notice duties to patients and regulators can ask for a much shorter period in the contract. Those duties, and who is liable after a vendor breach, are set out in offshore billing vendor breach liability.

These are negotiation points, not legal requirements. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.

• Name where staff work and from which locations they may reach your systems, and ask who owns the vendor, since the DOJ Data Security Program turns on access by covered persons.
• Keep access within your own EHR and practice management system, under your access controls.
• List each subcontractor with its role and location, and require your approval before a new one is added.
• Require access logs for the people on your account, and say how long they are kept. The standards that apply to each person are in HIPAA training and access rules.
• Set an incident notice period shorter than the outer limit, and say who you are told.
• Reserve the right to audit, and to receive evidence of the controls the vendor describes. What a SOC 2 or ISO 27001 report shows is limited to its scope, and the proposed Security Rule update would add a yearly written verification.
• Require the vendor to check each person on your account against the exclusion lists before assignment and monthly after; see OIG exclusion list screening.
• Say how data is returned or destroyed at the end, and who certifies it. The rules at the exit are in ending a medical billing contract.
• For substance use disorder records, a qualified service organization agreement under 42 CFR Part 2 is a separate instrument; see 42 CFR Part 2 and offshore medical billing.

Payer contracts can add conditions of their own. See HIPAA compliant offshore medical billing for the Medicare Part D and Medicaid rules, offshore medical billing restrictions for state storage laws and payer consent clauses, and how to outsource medical billing for where the contract fits in the steps.