Choosing a vendor
Offshore medical billing vendor questions: what to ask before you sign
Offshore medical billing vendor questions should cover four areas: the contract and breach notice, who can see patient data and how access is logged, where staff and records are and which payer and state rules apply, and how the vendor is paid and the arrangement ends. HIPAA requires a written business associate contract and a documented risk analysis, and each question below names the rule or source behind it. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
How to use this
Send the questions in writing and compare the answers
Put each question to all the vendors on your shortlist in writing, ask for documents instead of descriptions, and keep the answers together. A vendor that cannot answer a question has told you something. The order of the steps around these questions is in how to outsource medical billing.
1. Contract
Contract, subcontractors and breach notice
| Question | Rule or source behind it |
|---|---|
| Question: Will you sign our business associate agreement before anyone sees patient data? | Rule or source behind it: A written contract with the terms the Privacy Rule lists is required before a business associate handles protected health information (45 CFR 164.504(e)); the terms are set out on the business associate agreement page. |
| Question: Which companies employ the people who will work on our account, and are they bound by the same terms? | Rule or source behind it: A business associate contract must bind any subcontractor that handles the information to the same restrictions and conditions (45 CFR 164.504(e)). |
| Question: How soon will you tell us about a breach, and who do you tell? | Rule or source behind it: The outer limit is 60 calendar days after discovery (45 CFR 164.410). Ask for a much shorter period in the contract; the duties that follow are on the vendor breach liability page. |
2. Access
Who can see patient data, and how it is logged
| Question | Rule or source behind it |
|---|---|
| Question: Does each person have a unique login, and is there an emergency access procedure? | Rule or source behind it: Unique user identification and an emergency access procedure are required implementation specifications of the access control standard (45 CFR 164.312(a)(2)). |
| Question: What activity is logged, who reviews the logs, and how long are they kept? | Rule or source behind it: The audit controls standard requires mechanisms that record and examine activity in systems that contain or use electronic protected health information (45 CFR 164.312(b)). The retention period is a contract term. |
| Question: Does your written risk analysis cover where the work is done and how staff reach our systems? | Rule or source behind it: A risk analysis is required: an accurate and thorough assessment of the risks to electronic protected health information held by a covered entity or business associate (45 CFR 164.308(a)(1)). HHS notes that the risks vary by location. |
| Question: Do you check each person on our account against the OIG exclusion list before assignment and monthly after? | Rule or source behind it: OIG says federal programs do not pay for items or services furnished by an excluded person, including administrative work such as billing, and recommends monthly checks; no federal text read says how this applies to staff abroad. See OIG exclusion list screening. |
3. Location and rules
Where staff and records are, and which payer and state rules apply
| Question | Rule or source behind it |
|---|---|
| Question: Where are your staff, and where are our records physically kept? | Rule or source behind it: Some states regulate where electronic health records are stored; see offshore medical billing restrictions. |
| Question: Which of our payer contracts restrict offshore work or require consent, notice or an attestation? | Rule or source behind it: Payer clauses and Medicare plan forms differ; see offshore subcontractor attestation and the restrictions page. |
| Question: How will your staff use payer portals, and under whose login? | Rule or source behind it: A provider may not share its personal Medicare EDI access number and password with a billing agent (Medicare Claims Processing Manual, chapter 24). |
4. Pay and exit
How the vendor is paid, how it ends and what you can see
| Question | Rule or source behind it |
|---|---|
| Question: How are you paid, and does any payer payment reach an account you control? | Rule or source behind it: Medicare and Medicaid set conditions on paying an agent that receives payment for a provider (42 CFR 424.73(b)(3) and 447.10(f)); see medical billing percentage of collections. |
| Question | Rule or source behind it |
|---|---|
| Question: What happens to our information when the contract ends? | Rule or source behind it: The contract must provide for return or destruction of the protected health information at termination, if feasible (45 CFR 164.504(e)). The Medicare and access steps are in ending a medical billing contract. |
| Question: What written evidence can you show us? | Rule or source behind it: HHS does not recognize private HIPAA certifications, so ask for policies, training records and audit results instead of a badge (HHS on certification). What a SOC 2 report or an ISO 27001 certificate shows is on the SOC 2, ISO 27001 and HITRUST page, and a proposed update would require a yearly written verification from business associates (Security Rule update). |
| Question: Can we audit you, and what do you share if a plan or CMS asks? | Rule or source behind it: Medicare Advantage organizations must require their downstream entities to allow HHS audit access to records and electronic systems (42 CFR 422.504(i)), and plan forms ask for an annual audit of an offshore subcontractor. |
| Question: Who owns you, and do any people with access to our data live in a country the DOJ data rule lists? | Rule or source behind it: The DOJ Data Security Program restricts vendor and employment agreements with covered persons that give access to bulk health data. See DOJ Data Security Program and medical billing. |
| Question: Are the people on our account our workforce or yours, and what training and access rules apply to each? | Rule or source behind it: HIPAA defines workforce by direct control (45 CFR 160.103), and the Security Rule applies to a business associate directly. See workforce or business associate and HIPAA training and access rules. |
| Question: Do you handle substance use disorder treatment records, and will you sign a qualified service organization agreement? | Rule or source behind it: 42 CFR Part 2 adds a separate agreement and consent layer; see 42 CFR Part 2 and offshore medical billing. |
| Question: How is coding accuracy audited, by whom, and with what sample? | Rule or source behind it: OIG’s guidance gives a basic sample guide and asks billing companies for a yearly statistical review; see how to audit medical coding accuracy. |
The wider rules for offshore work are in HIPAA compliant offshore medical billing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- How to outsource medical billing
Five steps from choosing roles to go-live, with the compliance and cost checks in the right order.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Offshore restrictions by state and payer
State storage laws, payer consent clauses and Medicaid rules that can restrict offshore billing, and how to check which ones bind you.
- Percentage-of-collections fees
How the fee works, what Medicare, Medicaid and the OIG say about paying a billing agent, and questions to ask before you sign.
- Offshore medical billing cost
Seat fee, US in-house cost and percentage-of-collections fees side by side, with the method shown.
- Vendor data breach: liability and notice
Who notifies the practice, individuals, HHS and the media, who is liable for what, and the current penalty tiers.
- OIG exclusion list screening
Who is told to check the OIG exclusion list, what OIG says about billing work and contractors, and what the sources leave open for staff abroad.
- SOC 2, ISO 27001 and HITRUST
What HIPAA requires, what each of the three frameworks proves, where they stop and what evidence to ask a vendor for.
- HIPAA Security Rule update
Where the proposed update stands, what it would require of business associates and what to do while it is a proposal.
- Workforce or business associate
What the HIPAA definitions say, what HHS said about contractors on site, what changes with the label and where the sources stop.
- 42 CFR Part 2 and billing
Billing data as a Part 2 record, the qualified service organization route, consent, HIPAA penalties and what the rule does not say about location.
- Ending a vendor contract
Return or destruction of data, ending access, the Medicare notice when a billing agent changes and who keeps control of payment.
- Auditing coding accuracy
OIG's sampling guidance, why no source sets an accuracy percentage, how to read the CERT rate and how to check a coder's credential.
- HIPAA training and access rules
The access and training standards that attach to each person, which parts are required, and what the 2025 proposal would add.
- DOJ Data Security Program
When a vendor's access to bulk health data is restricted, who a covered person is, the conditions, the dates and what is not exempt.
- Billing company vs clearinghouse
Who is a covered entity, a business associate or a clearinghouse under HIPAA, the transaction standards and where offshore billing staff fit.
- Medicare enrollment effective date
The later-of effective date rule, the retrospective billing window, change reporting, revalidation and deactivation, and the CAQH attestation cycle.
- Medicare Advantage RADV audits
What RADV checks and how it is scored, the 2024 CMS-HCC model, the vacated 2023 rule and OIG's guidance on coding vendors.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.