Compliance
Offshore staff: HIPAA workforce or business associate? What the definitions say
Whether offshore staff are a practice’s HIPAA workforce or business associate turns on the definitions in 45 CFR 160.103. Workforce means people whose work for the practice is under its direct control, whether or not it pays them. A business associate handles protected health information on the practice’s behalf other than as a member of its workforce, and billing is a named function. HHS has said a contractor working on site can be treated either way, and no HHS text found says that a person’s country decides it. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
The text
Three definitions in 45 CFR 160.103
| Term | What the definition says | Source |
|---|---|---|
| Term: Workforce | What the definition says: Employees, volunteers, trainees and other persons whose conduct, in the work they do for a covered entity or business associate, is under that entity's direct control, whether or not the entity pays them. The regulation does not define direct control further. | Source: 45 CFR 160.103 |
| Term: Business associate | What the definition says: A person who, on behalf of a covered entity and other than in the capacity of a member of its workforce, creates, receives, maintains or transmits protected health information for a regulated function. The listed functions include claims processing, billing and practice management. | Source: 45 CFR 160.103 |
| Term: Subcontractor | What the definition says: A person to whom a business associate delegates a function, activity or service, other than in the capacity of a member of the business associate's workforce. A subcontractor that handles protected health information for the business associate is itself a business associate. | Source: 45 CFR 160.103 |
The business associate definition carries its own exclusion for workforce, so the two categories are meant to be mutually exclusive for one person doing one job. A “person” includes a natural person, so an individual can be a business associate as well as a company.
What HHS said
Contractors with a duty station at the practice can be either
- In the 2000 Privacy Rule preamble HHS said that where persons under contract have their assigned work station on the covered entity’s premises and do a substantial proportion of their work there, the covered entity may choose to treat them either as business associates or as part of its workforce. It added that if there is no business associate contract, it assumes the person is a member of the workforce (65 FR 82480).
- In the same preamble it said an employee of a vendor whose primary duty station is on site may be treated as the covered entity’s workforce member instead of treating the vendor as a business associate for that person. For a volunteer who works off site and needs protected health information, it said a business associate arrangement will be required (65 FR 82643 and 82645).
- In the 2013 Omnibus preamble HHS repeated that a covered entity may treat a contractor with an on-site duty station and more than incidental access to protected health information as workforce or as a business associate. It also said an agent could always fall within workforce because of the direct-control test, and that a covered entity must train a workforce member but not a business associate’s agent (78 FR 5574 and 5582).
- HHS’s business associate guidance restates that business associates are persons other than a workforce member who are engaged for a covered function, and names billing and practice management among the activities (HHS on business associates).
What attaches
What changes once the label is chosen
| Topic | A workforce member of the practice | A business associate relationship |
|---|---|---|
| Topic: Written contract | A workforce member of the practice: None is needed with workforce members, because the business associate definition excludes them. | A business associate relationship: Required: a written contract that meets 45 CFR 164.504(e) before the information is shared. |
| Topic: Training and sanctions | A workforce member of the practice: The practice must train workforce members on its policies and apply sanctions to those who break them. | A business associate relationship: The practice need not train the business associate's agents. The business associate has its own training and sanction duties under the Security Rule and its contract. |
| Topic: Who answers to HHS | A workforce member of the practice: The practice answers for its workforce, and for an agent's acts within the scope of the agency. | A business associate relationship: The business associate answers directly for the listed requirements, and the practice can still be liable for an agent business associate's acts. |
| Topic: Breach clock | A workforce member of the practice: Knowledge of any workforce member or agent other than the person who committed it starts the practice's clock. | A business associate relationship: The business associate must notify the practice within 60 calendar days at the outside; whether its discovery starts the practice's clock turns on agency. |
The liability and clock rows are set out in offshore billing vendor breach liability, and the contract terms are on the business associate agreement page.
Where the texts stop
What the sources do not say
- No HHS text found addresses staff supplied by a staffing agency, temporary staff or interns, and none defines direct control beyond the words of the regulation.
- The location factors HHS ties to the choice are premises-based: an on-site duty station, a work station on the premises, work done off site. None of them mentions work from a home or from another country.
- HHS has said the HIPAA Rules have no requirements specific to business associates outside the United States and that overseas work belongs in the risk analysis (HHS on offshore storage). The sources read do not make the country of work a factor in workforce status.
- Control for agency liability is a different test from workforce status. The 2013 preamble says labels such as independent contractor do not decide agency, and that parties in different countries can still be principal and agent.
In practice
Facts to record, and who decides
- Whose policies, systems and supervision the person works under, and who can direct and correct the work.
- Who trains the person, who applies sanctions and who can end the person’s access.
- Whether the person is employed by the practice, by a vendor, or by a staffing company, and the contract that says so.
- Where the person works, and the risk analysis that covers that location.
The classification is the practice’s decision to make and document, with its compliance advisor. The access and training standards that apply to each person are on the HIPAA training and access rules page. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Vendor data breach: liability and notice
Who notifies the practice, individuals, HHS and the media, who is liable for what, and the current penalty tiers.
- HIPAA training and access rules
The access and training standards that attach to each person, which parts are required, and what the 2025 proposal would add.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- Billing company vs clearinghouse
Who is a covered entity, a business associate or a clearinghouse under HIPAA, the transaction standards and where offshore billing staff fit.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.