Compliance
HIPAA training and access rules for offshore staff: what applies to each person who touches patient data
HIPAA training and access rules attach to each person who touches patient data, and the Security Rule applies to a business associate directly. It requires access authorization and a unique user ID for each person, audit controls, a sanction policy and a training program for all workforce members, and it sets no repeat interval for training. A January 2025 proposal would add training at least once a year and a one-hour access cutoff, but it is not final. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
Who is bound
The vendor directly, and the practice for its own systems
The Security Rule says a covered entity or business associate must comply with its standards (45 CFR 164.302), so a billing vendor owes training, sanction and access duties for its own people. The practice stays bound for its own systems: the user accounts it creates in its EHR, and the access it grants, reviews and ends. The Privacy Rule’s training, sanctions and policy standards are written for covered entities, and HHS has said the covered entity must train its workforce but not a business associate’s agent, and that a business associate remains contractually bound for the Privacy Rule duties its contract includes (78 FR 5582 and 5591). Whether a vendor’s staff are the practice’s workforce is covered in workforce or business associate.
Access
The Security Rule standards, and which parts are required
| Provision | What it requires | Required or addressable |
|---|---|---|
| Provision: Workforce security, 164.308(a)(3) | What it requires: Policies so each workforce member has appropriate access and those without access rights cannot get it. | Required or addressable: Standard (mandatory) |
| Provision: Authorization and supervision | What it requires: Procedures to authorize or supervise people who work with the information. | Required or addressable: Addressable |
| Provision: Workforce clearance | What it requires: Procedures to decide that a person's access is appropriate. | Required or addressable: Addressable |
| Provision: Termination procedures | What it requires: Procedures to end access when employment or another arrangement ends. The current text sets no time limit. | Required or addressable: Addressable |
| Provision: Information access management, 164.308(a)(4) | What it requires: Policies for authorizing access consistent with the Privacy Rule, including establishing, documenting, reviewing and modifying each user's access. | Required or addressable: Standard (mandatory); the specifications are addressable |
| Provision: Unique user identification, 164.312(a)(2) | What it requires: A unique name or number to identify and track each user. | Required or addressable: Required |
| Provision: Emergency access procedure | What it requires: A way to obtain the information during an emergency. | Required or addressable: Required |
| Provision: Audit controls, 164.312(b) | What it requires: Mechanisms that record and examine activity in systems that hold the information. | Required or addressable: Standard (mandatory) |
| Provision: Person or entity authentication, 164.312(d) | What it requires: Procedures to verify that the person seeking access is the one claimed. No method is named in the text. | Required or addressable: Standard (mandatory) |
| Provision: Sanction policy, 164.308(a)(1)(ii)(C) | What it requires: Apply sanctions to workforce members who do not follow the security policies. | Required or addressable: Required |
HHS says addressable does not mean optional: an entity assesses whether a specification is reasonable and appropriate, implements it or an equivalent alternative, and documents the choice (HHS Security Series paper). The provisions are in 45 CFR 164.308 and 164.312.
Minimum necessary
Role-based access and the minimum necessary standard
The minimum necessary standard in 45 CFR 164.502(b) is written for a covered entity or business associate: make reasonable efforts to limit protected health information to the minimum needed. A separate provision, 164.514(d), requires a covered entity to identify the persons or classes of persons in its workforce who need access, the categories of information each needs and any conditions, and to make reasonable efforts to limit access to match (45 CFR 164.514). HHS applied the minimum necessary standard directly to business associates in the 2013 rule and said the contract must limit the business associate’s uses and disclosures consistently with the covered entity’s minimum necessary policies. A whole medical record may not be used or requested unless the entire record is specifically justified.
Training
What the rules say about training, and what they leave out
- The Privacy Rule requires a covered entity to train all workforce members as necessary and appropriate for their functions: everyone by the compliance date, each new member within a reasonable period after joining, and each member affected by a material change within a reasonable period. It must document that the training was provided (45 CFR 164.530(b)).
- The Security Rule requires a security awareness and training program for all members of the workforce, including management. The program is a standard, so it is not addressable. Its specifications, security reminders, protection from malicious software, log-in monitoring and password management, are addressable, and the only recurring word is “periodic.”
- Neither set of rules sets a repeat interval. HHS’s paper says periodic retraining should be given whenever environmental or operational changes affect the security of the information, and OCR’s audit protocol looks for the entity’s policy to say how frequently training is provided.
- Fixed intervals appear in individual settlements. OCR’s resolution agreement with a practice management company that acted as a business associate required training at least once a year and for new members within 30 days (OCR resolution agreement); it binds that company only and is not a rule.
Proposed, not final
What the January 2025 proposal would change
The Security Rule proposal would require training for all workforce members by the compliance date and at least once a year after, for new members within 30 days of first access, and after a material change within 30 days; end access as soon as possible and no later than one hour after an arrangement ends; notify another covered entity or business associate within 24 hours when a person’s authorization to its systems changes or ends; review the workforce security procedures at least yearly; and remove the distinction between required and addressable specifications (90 FR 898). It is a proposal; its status is on the HIPAA Security Rule update page.
In practice
What to ask for, person by person
- A unique login for each person on the account, never a shared one, and the list of who holds one.
- The access each role has and why, matched to the minimum needed for the work.
- The training each person received, when, and the policy that says how often it is repeated.
- The procedure and time limit for ending access when a person leaves the account, and who tells you.
- The sanction policy and the activity reports reviewed, with who reviews them and how often.
- The terms of each payer or prior authorization portal on who may hold an account and from where; an example is in prior authorization for drugs.
The wider list is in offshore medical billing vendor questions, and the contract terms are on the business associate agreement page. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- Workforce or business associate
What the HIPAA definitions say, what HHS said about contractors on site, what changes with the label and where the sources stop.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- HIPAA Security Rule update
Where the proposed update stands, what it would require of business associates and what to do while it is a proposal.
- Prior authorization for drugs
The Part D and Medicaid clocks that apply to drug requests, the electronic standards and what staff track.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.