Privacy by country
Offshore medical billing data privacy by country: US, Ontario, UK, EU, Australia and New Zealand
Offshore medical billing data privacy rules in the US, Ontario, the UK, the EU, Australia and New Zealand do not ban the work. In each, a written contract is required or expected and the practice stays accountable; the UK and EU add a transfer mechanism, Australia treats most overseas contractors as a disclosure, and Ontario and New Zealand treat a true agent as the practice’s own handling. Australia’s My Health Records Act bans offshore handling of that system’s records for four named entity types. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 17, 2026. How we check our numbers.
The grid
What each place says about handling patient data abroad for billing
| Place | General ban? | What the practice must do | What triggers the extra rules |
|---|---|---|---|
| Place: United States | General ban?: No. HHS says the HIPAA Rules do not include requirements specific to ePHI processed or stored by a business associate outside the United States. State storage laws exist. | What the practice must do: Sign a Business Associate Agreement and take location into account in the risk analysis. | What triggers the extra rules: No transfer mechanism. HHS says overseas outsourcing may raise risks and enforceability questions (HHS FAQ). State rules are on the restrictions page. |
| Place: Ontario (PHIPA) | General ban?: No. The IPC says there is no legislative prohibition on storing and accessing personal health information outside Ontario (IPC FAQ). | What the practice must do: The custodian stays responsible for its agents (PHIPA s 17(3)(b)) and may attach conditions; the IPC FAQ says safeguards can be set through contractual arrangements. | What triggers the extra rules: Giving information to an agent is a use, not a disclosure (PHIPA s 6(1)). If the recipient is not an agent, s 50(1) limits disclosure outside Ontario, and s 50(1)(f) covers administering payments. Details: OHIP billing staff. |
| Place: United Kingdom (UK GDPR) | General ban?: No. Restricted transfers are allowed with a mechanism. | What the practice must do: A written Article 28 processing contract with a processor (ICO). | What triggers the extra rules: Making information accessible to a separate company or a contractor abroad is a restricted transfer; an employee abroad is not. It needs adequacy regulations, or appropriate safeguards plus the data protection test, or an exception (ICO, ICO adequacy list). |
| Place: European Union (GDPR) | General ban?: No. Transfers outside the EU need a Chapter V mechanism. | What the practice must do: A written Article 28 contract (GDPR); standard contractual clauses are a safeguard for importers not subject to the GDPR. | What triggers the extra rules: Remote access from a third country counts as a transfer (EDPB guidelines 05/2021). Adequacy decisions are listed by the Commission, which also publishes the standard contractual clauses. |
| Place: Australia (Privacy Act 1988) | General ban?: No general ban. The My Health Records Act bans holding or processing that system’s records outside Australia for the System Operator, registered repository operators, portal operators and registered contracted service providers. | What the practice must do: Take reasonable steps so the overseas recipient does not breach the Australian Privacy Principles; the OAIC expects an enforceable contract. | What triggers the extra rules: The OAIC says giving information to an overseas contractor is a disclosure in most circumstances, and the entity can be treated as having done the recipient’s breach (OAIC chapter 8, Privacy Act). The collection notice and privacy policy must say whether overseas disclosure is likely. |
| Place: New Zealand (Privacy Act 2020) | General ban?: No. | What the practice must do: The principal remains fully responsible for what a third-party provider does; the Commissioner advises an agreement that requires the provider to keep the information safe and gives a remedy if things go wrong. | What triggers the extra rules: A provider that only stores or processes for the principal is not treated as holding the information, so the foreign-disclosure rule (IPP 12, and rule 12 of the Health Information Privacy Code) applies to a disclosure to a foreign person or entity (OPC, OPC on third-party providers). |
Staff or vendor
Own employee abroad or a separate company
- The ICO says a restricted transfer happens when a separate company or a contractor outside the UK accesses personal information, even on UK servers. Its own worked example is an overseas IT company reaching UK servers by VPN. An employee of the same organisation working abroad is not a restricted transfer, though security measures still apply (ICO).
- The EDPB reaches the same split for the EU: remote access by a processor in a third country is a transfer, and an employee of the controller on a business trip is not (EDPB).
- That split is why the HIPAA question of workforce or business associate matters in other places too: how the team is employed decides which rules attach.
Destination
Where the destination country matters
- In the UK and EU the destination decides whether adequacy can be used. The ICO list, updated July 30, 2026, covers the EEA, New Zealand, South Korea and several other places in full, and Canada, Japan and the United States in part. It has no entry for Australia, and the ICO says a UK business cannot rely on adequacy there.
- The Commission’s list, updated July 23, 2026, includes Brazil, Canada for commercial organisations, Japan, New Zealand, South Korea, the United Kingdom and United States organisations in the Data Privacy Framework. Check the destination country against each list before assuming adequacy.
- In Australia and New Zealand the destination matters less than the contract and the safeguards. No country or scheme was found prescribed for APP 8.3 in the Privacy Regulations 2025(other instruments were not checked).
Limits
What the sources do not say
- None of the sources read says that a country, a vendor or an arrangement is permitted. Each place’s rules turn on the facts, and a lawyer should answer for a given practice.
- Whether PIPEDA applies to a given Ontario physician practice was not settled by the sources read; the IPC FAQ says it continues to apply to transfers outside Canada.
- Whether an offshore team working in the practice’s own systems is a use or a disclosure under Australian APP 8 is not answered by the OAIC text. Whether the My Health Records Act ban reaches a billing vendor depends on whether the vendor is a registered contracted service provider, which the text does not answer for billing work.
- The UK legislation was read from an archive copy and is not quoted, the EU Regulation is cited only for Article 28, and the New Zealand Act was read only through the Commissioner’s descriptions. National health-data rules in EU Member States, Australian state and territory laws and NHS-specific rules were not researched.
Country pages: Ontario, United Kingdom and the HIPAA position on HIPAA compliant offshore medical billing. The Business Associate Agreement page covers the US contract. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Offshore restrictions by state and payer
State storage laws, payer consent clauses and Medicaid rules that can restrict offshore billing, and how to check which ones bind you.
- OHIP billing staff for Ontario
How designated billing agents fit MCEDT, and what PHIPA and PIPEDA say about offshore agents.
- UK private practice billing staff
Insurer invoicing with CCSD codes through Healthcode, and the UK GDPR documents an offshore team needs.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.