Compliance
HIPAA compliant offshore medical billing: what the rules require
HIPAA compliant offshore medical billing is possible. HIPAA does not prohibit offshore work, but it requires a signed Business Associate Agreement, and HHS notes that the risks to patient data vary by location. A Business Associate Agreement is signed before anyone touches protected health information. Other rules can still restrict offshore access: Medicare Part D plans file an offshore subcontractor attestation with CMS, and some state Medicaid contracts, such as Texas managed care, bar remote access to state confidential information from outside the US. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
HIPAA
What HIPAA requires before offshore staff touch patient data
- A Business Associate Agreement. A billing company or staffing provider that handles protected health information for you is a business associate. HHS sets out the written contract that must be in place under 45 CFR 164.502(e) and 164.504(e) (HHS guidance on business associates).
- Safeguards that fit the location. HIPAA has no geographic ban, but HHS notes that the risks vary by location, so your risk analysis should cover where the work happens and how data is accessed.
- No official certification to rely on. HHS does not endorse or otherwise recognize private HIPAA compliance certifications. Ask a vendor for its signed BAA, its controls and its audit evidence instead of a badge. What a SOC 2 report, an ISO 27001 certificate or a HITRUST certification does and does not show is on the SOC 2, ISO 27001 and HITRUST page, and the proposed Security Rule update is covered in HIPAA Security Rule update for business associates.
Payer and state rules
Rules beyond HIPAA that can restrict offshore billing
| Rule | What it says | Source |
|---|---|---|
| Rule: Medicare Part D | What it says: Part D organizations submit an offshore subcontract attestation to CMS, through HPMS, for each offshore subcontractor that accesses beneficiary protected health information. | Source: CMS Part D application |
| Rule: Federal Medicaid | What it says: No Medicaid payments for items or services to any financial institution or entity located outside the US. | Source: 42 U.S.C. 1396a(a)(80) |
| Rule: CMS guidance on that ban | What it says: CMS reads the ban as covering payments for State plan items or services to entities such as provider bank accounts or business agents located outside the US and its territories. It says a State's own outsourced administration, such as information processing or enrollment and claims call centers, is not covered. | Source: CMS SMD letter 10-026 |
| Rule: Medicare billing agents | What it says: A provider may not share its personal Medicare EDI access number and password with any billing agent or clearinghouse. A clearinghouse or other third-party representative must obtain and use its own, and the provider keeps a signed agreement with it. | Source: Medicare Claims Processing Manual, chapter 24 |
| Rule: Texas Medicaid managed care | What it says: Contract terms bar moving HHSC confidential information outside the US and bar remote access to it from outside the US. | Source: Summary of the HHSC contract terms |
Your own payer contracts may carry similar clauses. Read the offshore, subcontracting and data-location sections of each contract before any offshore staff member gets access, and ask your compliance advisor about state rules where you see patients. State record-storage laws and a payer consent clause are covered on the offshore medical billing restrictions page.
Our side
What to ask OffshoreMeds for before you start
A Business Associate Agreement is signed before anyone touches protected health information. Staff log in to your EHR under your access controls, so patient records stay in your own systems. Nothing on this page replaces your own review: ask for the evidence behind each control we describe to you, in writing.
- The written security policies that cover staff access, workstation controls and incident handling.
- How staff are vetted and trained, and how often the training is repeated.
- Access logs for the people working on your account, and how long they are kept.
- The incident process: who tells you, and how fast, if protected health information is exposed. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410). Who notifies patients and HHS, and who is liable, is covered in offshore billing vendor breach liability.
Checklist
Questions to ask any offshore billing vendor
- Will you sign our Business Associate Agreement before anyone sees patient data?
- Do your staff work in our systems under our access controls, or do you copy data into yours?
- Can we see access logs for the people working on our account? The standards that apply to each person are in HIPAA training and access rules.
- Do you check each person on our account against the OIG exclusion list, and how often? See OIG exclusion list screening.
- Are the people on our account our workforce or your business associate staff? The definitions are in workforce or business associate.
- Who owns the vendor and where its staff live: the DOJ rule on bulk data access by covered persons is in DOJ Data Security Program and medical billing.
- Do you handle substance use disorder treatment records? See 42 CFR Part 2 and offshore medical billing.
- Do any of our payer contracts or state Medicaid programs restrict offshore access?
- Which payer portals will staff use, and under whose login? CMS says a provider may not share its Medicare EDI access number and password with a billing agent.
- Who supervises the staff, and how is a departure or a security incident reported to us?
Cost matters too, once the compliance questions are answered. See what offshore medical billing costs next to an in-house hire, and how prior authorization staff work with protected health information day to day.
This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- Offshore medical billing cost
Seat fee, US in-house cost and percentage-of-collections fees side by side, with the method shown.
- Offshore medical coding staff
ICD-10, CPT and HCC coders working in your EHR, audited daily against a published accuracy standard.
- Denial management staff
Appeals, A/R follow-up and root-cause work, measured against published denial-rate benchmarks.
- Prior authorization staff
Staff who prepare, submit and track prior authorizations, with the clinical line kept where it belongs.
- Puerto Rico medical billing
Same HIPAA rules as the mainland, heavy Medicare Advantage, and what the offshore checks mean for Puerto Rico practices.
- How to outsource medical billing
Five steps from choosing roles to go-live, with the compliance and cost checks in the right order.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- Offshore restrictions by state and payer
State storage laws, payer consent clauses and Medicaid rules that can restrict offshore billing, and how to check which ones bind you.
- Offshore subcontractor attestation
What CMS requires of plans, what one plan's provider form asks and what a practice should have ready.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- Vendor data breach: liability and notice
Who notifies the practice, individuals, HHS and the media, who is liable for what, and the current penalty tiers.
- OIG exclusion list screening
Who is told to check the OIG exclusion list, what OIG says about billing work and contractors, and what the sources leave open for staff abroad.
- SOC 2, ISO 27001 and HITRUST
What HIPAA requires, what each of the three frameworks proves, where they stop and what evidence to ask a vendor for.
- HIPAA Security Rule update
Where the proposed update stands, what it would require of business associates and what to do while it is a proposal.
- Workforce or business associate
What the HIPAA definitions say, what HHS said about contractors on site, what changes with the label and where the sources stop.
- 42 CFR Part 2 and billing
Billing data as a Part 2 record, the qualified service organization route, consent, HIPAA penalties and what the rule does not say about location.
- HIPAA training and access rules
The access and training standards that attach to each person, which parts are required, and what the 2025 proposal would add.
- DOJ Data Security Program
When a vendor's access to bulk health data is restricted, who a covered person is, the conditions, the dates and what is not exempt.
- Billing company vs clearinghouse
Who is a covered entity, a business associate or a clearinghouse under HIPAA, the transaction standards and where offshore billing staff fit.
- Data privacy by country
No general ban in six places, the contract each expects, the UK and EU transfer rules, Australia's disclosure approach and one narrow ban.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.