Compliance
Offshore billing vendor data breach: who is liable and who must notify under HIPAA
An offshore billing vendor breach puts two separate HIPAA duties on two parties. The vendor, as a business associate, must tell the practice no later than 60 calendar days after discovery. The practice, as the covered entity, must notify each affected individual and HHS, and must notify prominent media when more than 500 residents of one State are involved. The practice can be liable for the vendor’s acts when the vendor is its agent acting within the scope of the work, and the vendor is directly liable for its own listed violations. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
Notice
Who must tell whom, and by when
| Duty | Who must act | Deadline | Rule |
|---|---|---|---|
| Duty: Tell the practice about the breach | Who must act: The vendor (business associate) | Deadline: Without unreasonable delay and no later than 60 calendar days after discovery. | Rule: 45 CFR 164.410 |
| Duty: Tell each affected individual | Who must act: The practice (covered entity) | Deadline: Without unreasonable delay and no later than 60 calendar days after discovery. | Rule: 45 CFR 164.404 |
| Duty: Tell HHS | Who must act: The practice | Deadline: 500 or more individuals: at the same time as the individual notice. Fewer: within 60 days after the end of the calendar year in which the breach was discovered. | Rule: 45 CFR 164.408 |
| Duty: Tell prominent media | Who must act: The practice | Deadline: Only when more than 500 residents of one State or jurisdiction are involved, with the same outer limit as the individual notice. | Rule: 45 CFR 164.406 |
These duties apply to a breach of unsecured protected health information: information that was not rendered unusable, unreadable or indecipherable to unauthorized persons. An impermissible use or disclosure is presumed to be a breach unless the practice or vendor shows a low probability that the information was compromised, based on a risk assessment of at least four factors (45 CFR 164.402).
The clock
The practice’s 60 days can start on the vendor’s discovery date
A breach is treated as discovered on the first day it is known, or would have been known with reasonable diligence, to a workforce member or agent of the practice other than the person who committed it, as the federal common law of agency decides (45 CFR 164.404(a)(2)). In the 2013 Omnibus rule, HHS said that when the vendor is the practice’s agent, the vendor’s discovery is imputed to the practice, so the practice’s 60 days run from the date the vendor discovered the breach, not from the date the vendor reported it. When the vendor is an independent contractor, the practice’s clock runs from the date the vendor tells it (78 FR 5655). HHS encouraged the parties to settle the timing in the contract. Whether a vendor’s staff are instead the practice’s own workforce is covered in workforce or business associate.
The 60 days are an outer limit. Both rules put “without unreasonable delay” first.
Liability
Who is liable for what
- The practice, for an agent’s acts. A covered entity is liable for a civil money penalty for a violation based on the act or omission of any agent, including a business associate, acting within the scope of the agency (45 CFR 160.402(c)). Whether a vendor is an agent turns on federal common law.
- The vendor, for its own violations. OCR can enforce against a business associate for a listed set of requirements (HHS fact sheet), covered in the next section.
- The vendor, for its subcontractors. A business associate is liable on the same footing for the acts of a subcontractor that is its agent, and when more than one party is responsible for a violation the Secretary imposes a penalty on each of them (45 CFR 160.402).
HHS explained in the Omnibus preamble how agency is judged. The essential factor is the covered entity’s right or authority to control the business associate’s conduct in performing the service. The labels in a contract, such as independent contractor, do not decide it. A contract that gives the practice only the right to amend terms or sue for breach points away from agency, and the preamble gives parties in different countries as an example of a relationship that can still be one of agency (78 FR 5581). HHS also described the change as making covered entities liable for their business associate agents’ acts whether or not a compliant business associate agreement is in place.
Direct liability
What a vendor answers for directly
HHS says OCR can take enforcement action against a business associate only for the requirements it lists. The list includes:
- Failing to comply with the Security Rule.
- Failing to notify the covered entity, or another business associate, of a breach.
- Impermissible uses and disclosures of protected health information, and not limiting use to the minimum necessary.
- Failing to enter into agreements with its own subcontractors, or to act on a known material breach of one.
- Failing to give the Secretary records and cooperate with an investigation, and retaliating against a complainant.
The fact sheet’s list does not include the notices to individuals, HHS and the media. Those are the practice’s duties, and the practice can delegate them to the vendor by contract while staying ultimately responsible for making sure they go out (HHS breach notification page). Who sends which notice is a business decision of the parties, according to HHS.
Penalties
The civil money penalty tiers, with the current amounts
| Tier | Level of culpability | Per violation | Calendar-year cap for identical violations |
|---|---|---|---|
| Tier: 1 | Level of culpability: Did not know, and would not have known with reasonable diligence | Per violation: $145 to $73,011 | Calendar-year cap for identical violations: $2,190,294 |
| Tier: 2 | Level of culpability: Reasonable cause, not willful neglect | Per violation: $1,461 to $73,011 | Calendar-year cap for identical violations: $2,190,294 |
| Tier: 3 | Level of culpability: Willful neglect, corrected within 30 days | Per violation: $14,602 to $73,011 | Calendar-year cap for identical violations: $2,190,294 |
| Tier: 4 | Level of culpability: Willful neglect, not corrected within 30 days | Per violation: $73,011 to $2,190,294 | Calendar-year cap for identical violations: $2,190,294 |
The amounts come from 45 CFR 102.3, as adjusted by HHS in the Federal Register on January 28, 2026. The regulation on penalties, 45 CFR 160.404, prints the original statutory figures and says they are updated each year. HHS said in 2019 that it applies a lower annual limit to each of the lower tiers, indexed for inflation (84 FR 18151); the table above shows the figures in the regulation.
- Size and harm matter: the factors include the number of individuals affected, the time period, the harm, the compliance history and the size of the entity (45 CFR 160.408).
- A violation that was not willful neglect and is corrected within 30 days of when the party knew or should have known is not penalized (45 CFR 160.410).
- OCR can penalize the underlying Privacy Rule violation as well, even where all the notices were sent (78 FR 5658).
Offshore
What location changes, and what the sources do not say
HIPAA has no rule that bans offshore work, and HHS has said a covered entity or business associate may use a service that stores information outside the United States if a business associate agreement is in place and the Rules are otherwise met. HHS adds that overseas outsourcing may raise risks, including questions about enforceability of protections over the data, which belong in the risk analysis (HHS on offshore storage). A 2014 HHS Inspector General review observed that State Medicaid agencies may have limited means of enforcing business associate agreement terms abroad (OEI-09-12-00530); that is an observation about State agencies, not a rule.
The sources read for this guide do not say how OCR would pursue a business associate with no presence in the United States, and none reports an OCR resolution agreement that involved an offshore billing vendor. State breach notification laws can apply as well: HHS has no authority to preempt a State breach law that is not contrary to the federal rule (78 FR 5658).
In practice
What to settle in writing before an incident
- A notice period from the vendor much shorter than 60 days, and who it goes to. The contract terms are on the business associate agreement page.
- Which party sends the individual, HHS and media notices, and who bears the cost of sending them.
- How the practice directs the work, because agency decides whether the vendor’s discovery date starts the practice’s clock. Settle this with a compliance advisor.
- Records: the practice or vendor carries the burden of showing that all the notices were sent or that the event was not a breach (45 CFR 164.414), so keep the risk assessment and the notices.
- Subcontractors: the same terms must flow down, and the vendor answers for an agent subcontractor’s acts.
- Contingency notice: a proposed Security Rule update would add a report of contingency plan activation within a set number of hours; where it stands is in HIPAA Security Rule update for business associates.
The questions to put to a vendor before signing are in offshore medical billing vendor questions, and the wider position on offshore work is in HIPAA compliant offshore medical billing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- HIPAA Security Rule update
Where the proposed update stands, what it would require of business associates and what to do while it is a proposal.
- Workforce or business associate
What the HIPAA definitions say, what HHS said about contractors on site, what changes with the label and where the sources stop.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.