Compliance
Offshore medical billing restrictions: what states and payers add to HIPAA
Offshore medical billing restrictions come from outside HIPAA: state laws that fix where electronic health records may be stored, payer contracts that require written consent before work or protected health information leaves the United States, and Medicaid rules. Florida and Texas regulate where records are stored and Texas also limits who may access them. A Philadelphia behavioral-health payer, CBH, requires consent from April 12, 2026, and the OIG found that 4 of 56 Medicaid agencies prohibit offshore administrative outsourcing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
Starting point
HIPAA allows offshore work; other rules add conditions
HIPAA has no geographic ban. HHS notes that the risks vary by location, and the HIPAA guide covers the Business Associate Agreement and safeguards. The rules below sit on top of HIPAA. Each binds only some providers, plans or programs, so the first job is to find out which of them bind you.
State law
State laws that fix where health records are stored
| State | What the text requires | What it does not say | Source |
|---|---|---|---|
| State: Florida | What the text requires: A provider that uses certified electronic health record technology must ensure that patient information stored offsite, including with a third-party or cloud provider, is physically maintained in the continental United States, its territories or Canada. | What it does not say: Who may view the information, or from where. The subsection is about physical storage. | Source: Florida Statutes 408.051(3) |
| State: Texas | What the text requires: A covered entity, which includes a health care practitioner, must ensure that electronic health records under its control that contain patient information are physically maintained in the United States or a US territory, including records held by a third-party or cloud provider. It must also ensure that Texas residents' record information is accessible only to individuals who require it to perform duties within the scope of their employment related to treatment, payment or health care operations. Section 183.002 applies to storage on or after January 1, 2026, and the attorney general can seek injunctions and civil penalties. | What it does not say: Where those individuals may be located, or whether a vendor's staff count as acting within the scope of a covered entity's employment. The storage duty is about physical location. | Source: Texas SB 1188 |
Storage and access are different questions. Where staff log in to your EHR under your access controls, the records stay where your EHR vendor hosts them, so ask the vendor in writing where that is. Texas also limits who may access Texas residents’ record information, to individuals who need it for their duties within the scope of their employment. Whether a vendor’s staff meet that test, and whether a state treats remote access from abroad differently from storage abroad, are not things these texts answer, so put both questions to counsel in your state. Florida and Texas are examples found in public sources, not a survey of all states.
Payer contracts
Payer clauses that require consent, notice or an attestation
Payers can add offshore terms by contract and change them by bulletin. The Philadelphia change below reached providers as a one-page notice dated March 12, 2026 that took effect a month later.
| Payer or program | What the document says | Source |
|---|---|---|
| Payer or program: Community Behavioral Health (Philadelphia) | What the document says: From April 12, 2026, covered services may not be performed outside the United States without CBH's prior written consent. The provider must notify CBH of any offshore subcontractor. Member health information may not be disclosed, transmitted or made accessible beyond the United States without prior express written authorization. | Source: CBH provider bulletin 26-05 |
| Payer or program: Medicare Part D | What the document says: Plan sponsors submit an offshore subcontract attestation to CMS, through HPMS, for each offshore subcontractor that accesses beneficiary protected health information. | Source: CMS Part D application |
| Payer or program: Medicare plan provider forms | What the document says: Wellcare California's attestation form for participating providers sets a deadline of 20 calendar days from signing with an offshore subcontractor. | Source: Wellcare provider attestation form |
| Payer or program: Texas Medicaid managed care | What the document says: Contract terms bar moving HHSC confidential information outside the US and bar remote access to it from outside the US. | Source: Summary of the HHSC contract terms |
Medicaid
Medicaid: a federal payment rule and what states chose to do
Federal law bars State Medicaid payments for items or services to any financial institution or entity located outside the United States (42 U.S.C. 1396a(a)(80)). CMS reads that ban as covering payments for State plan items or services to entities such as provider bank accounts or business agents outside the United States and its territories, and not a State’s own outsourced administration (CMS letter SMD 10-026).
States also set their own rules. In a report dated April 11, 2014, the HHS Office of Inspector General asked all 56 Medicaid agencies about offshore outsourcing of their administrative functions. 15 had a State requirement: 4 prohibit it and 11 allow it. The other 41 reported no requirement and did not outsource those functions offshore (OIG report). The survey covers the agencies’ own contracts, not a provider’s billing vendor, and it is more than a decade old, so check the current rule for your state.
More instruments
State and federal-program terms read at the source
The table lists instruments read at the source on 2026-10-10. Most bind a State agency’s contractors, a managed care plan or a business associate of the agency, and none of the texts says in terms that it binds a practice’s own billing vendor. Whether a plan or agency passes a term down to providers is for each provider contract to say. Other States’ contracts may carry similar terms; only what was read is listed.
| Instrument | Who it binds | What the text says | Source |
|---|---|---|---|
| Instrument: Ohio Medicaid managed care provider agreement, Article XIII (Rev. 7/2025), which applies Executive Order 2019-12D | Who it binds: Medicaid managed care organizations | What the text says: The managed care organization must comply with the Governor's executive order against using public funds for services outside the United States, and shall not transfer personal health information to any location outside the United States or its territories. The sentence says transfer, not access. | Source: Ohio Department of Medicaid |
| Instrument: Virginia Medallion 4.0 and Cardinal Care managed care contracts | Who it binds: Medicaid managed care organizations, and subcontractors and agents that receive their protected health information; a network provider is not a subcontractor in the definition | What the text says: The contractor must ensure there is no offshore servicing of Member protected health information. | Source: Medallion 4.0; Cardinal Care |
| Instrument: TennCare business associate agreement form TC-0151 (Rev. 7/24 and 10/25), section 4.4.2 | Who it binds: Business associates of TennCare | What the text says: No sharing, use or disclosure of protected health information with a third party beyond the boundaries and jurisdiction of the United States without TennCare's express written authorization. The clause applies to the business associate itself. | Source: TennCare |
| Instrument: New Jersey N.J.S.A. 52:34-13.2, and Missouri Executive Order 04-09 (2004) | Who it binds: State contracts for services and their subcontracts | What the text says: New Jersey: services under a State contract or subcontract are to be performed within the United States, with exceptions by written certification. Missouri: bidders certify where work will be performed, and an award to a vendor planning offshore work needs one of four stated conditions. | Source: OIG report appendix |
| Instrument: 42 CFR 438.602(i) | Who it binds: States and their Medicaid managed care plans | What the text says: The plan may not be located outside the United States, and claims paid to a provider, subcontractor or financial institution outside it are not counted in capitation rates. | Source: eCFR |
| Instrument: OPM FEHB and PSHB Carrier Letter 2026-04 (August 27, 2026) | Who it binds: Federal Employees Health Benefits and Postal Service Health Benefits carriers, and their vendors at all tiers | What the text says: No new contracts or extensions with vendors based outside the United States for this business, and protected health information and personal information may not be accessed, stored, processed or transmitted outside the United States or its territories without the Contracting Officer's written approval. Existing offshore contracts are to end by December 31, 2026, and contracts for direct patient care are exempt. | Source: OPM |
The OIG report quoted above names only the States that allow offshore outsourcing, not the four that prohibit it, so a list of prohibiting States cannot be drawn from it.
Your exposure
How to find out which rules bind you
- Read the offshore, subcontracting and data-location clauses in each payer contract, and any bulletin that amends them.
- Ask your EHR vendor, in writing, where your records are physically hosted.
- Check whether your state has a record-storage statute like Florida’s or Texas’s.
- If you serve Medicare Advantage or Part D members, ask each plan for its offshore attestation form and its deadline.
- If you bill Medicaid or a Medicaid managed-care plan, ask whether offshore access needs consent or notice.
- Check who owns your vendor and where its staff live against the federal bulk data rule in DOJ Data Security Program and medical billing.
- If you treat substance use disorders, read 42 CFR Part 2 and offshore medical billing; Part 2 sits beside, and does not displace, State law.
- Keep a list of each vendor and location that can reach patient data, so a payer’s request for it can be answered quickly.
- Put the remote-access question to counsel in your state before go-live.
The contract that binds a vendor to these terms is covered on the business associate agreement page, and the order of the steps is in how to outsource medical billing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- Puerto Rico medical billing
Same HIPAA rules as the mainland, heavy Medicare Advantage, and what the offshore checks mean for Puerto Rico practices.
- How to outsource medical billing
Five steps from choosing roles to go-live, with the compliance and cost checks in the right order.
- Offshore medical billing cost
Seat fee, US in-house cost and percentage-of-collections fees side by side, with the method shown.
- Offshore subcontractor attestation
What CMS requires of plans, what one plan's provider form asks and what a practice should have ready.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- 42 CFR Part 2 and billing
Billing data as a Part 2 record, the qualified service organization route, consent, HIPAA penalties and what the rule does not say about location.
- DOJ Data Security Program
When a vendor's access to bulk health data is restricted, who a covered person is, the conditions, the dates and what is not exempt.
- Data privacy by country
No general ban in six places, the contract each expects, the UK and EU transfer rules, Australia's disclosure approach and one narrow ban.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.