Medicare plans
Offshore subcontractor attestation for Medicare Advantage: what providers are asked to sign
An offshore subcontractor attestation is a form a Medicare Advantage or Part D plan can ask a provider to sign when people outside the United States and its territories handle member protected health information. CMS requires plan sponsors to submit attestations for offshore subcontractors, and one plan’s provider form sets a deadline of 20 calendar days after the contract with the offshore subcontractor is signed. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
The requirement
What CMS requires of plans, and why providers are asked
The CMS Part D application for the 2025 contract year has an applicant confirm that it submits the Offshore Subcontract Information and Attestation, through HPMS, for each offshore subcontractor that receives, processes, transfers, handles, stores or accesses Medicare beneficiary protected health information. The submission covers first tier, downstream and related entities, including downstream offshore subcontractors, and is due by the last Friday in September for the upcoming contract year.
A plan stays responsible for its CMS contract however much work it delegates. The regulation says a Medicare Advantage organization remains responsible for complying with all of its contract terms and must require its first tier, downstream and related entities to agree that HHS and the Comptroller General may audit and inspect their books, contracts, electronic systems and medical records (42 CFR 422.504(i)); Part D sponsors have the same rule (42 CFR 423.505(i)). A provider that contracts with a plan can be one of those entities, which is why plans send providers their own forms.
The definition
What counts as offshore
The plan form quotes CMS’s definition. Offshore means any country that is not within the United States or one of its territories: American Samoa, Guam, the Northern Marianas, Puerto Rico and the Virgin Islands. The form’s examples include both of the United States’ land neighbours, so nearshore delivery does not avoid the definition. A subcontractor can be an American-owned company that performs part of its operations abroad or a foreign-owned company, and what matters is that the work is done by workers located offshore, whether they are employees of an American or a foreign company.
Two points follow from that wording. Puerto Rico is not offshore for this purpose, which matters for Puerto Rico medical billing, where staff in Puerto Rico are not offshore but staff elsewhere would be. And placing staff through a vendor does not change the test, because the location of the worker decides it.
The form
What one plan's form asks for
| Part | What it asks | Source |
|---|---|---|
| Part: Deadline and scope | What it asks: A form for each new offshore subcontractor, submitted within 20 calendar days of signing the contract. It first asks whether the provider uses offshore subcontractors, and whether any handle, process or access protected health information. | Source: Wellcare California form 25-1301 |
| Part: Part I: the subcontractor | What it asks: Its name, country and address, a description of its functions, and its effective date. | Source: Same form |
| Part: Part II: precautions | What it asks: The protected health information that will be provided, why providing it is necessary, and the alternatives considered to avoid providing it. | Source: Same form |
| Part: Part III: safeguards | What it asks: Yes or no attestations that the arrangement has security policies (copies attached), bars access to data unrelated to the contract, allows immediate termination after a significant security breach (policy attached), and carries the required Medicare Part C and Part D contract language (a copy of the agreement attached for Medicare Advantage). | Source: Same form |
| Part: Part IV: audits | What it asks: That the provider will audit the subcontractor each year, will use the results to decide whether to continue, and will share the results with the plan or CMS on request. | Source: Same form |
The same form states that the plan’s own policy prohibits transferring or storing data outside the United States. It is one plan’s form in one state; other plans use their own forms, deadlines and policies.
What to prepare
What to have ready before a plan asks
- A list of each vendor and location that can reach member information, with the date each contract was signed.
- Written security policies and a termination procedure for a significant breach, ready to attach.
- Contract terms that give the plan, CMS and HHS the audit access the regulation describes, and a plan for the annual audit the form mentions.
- The Medicare Part C and Part D contract language the form lists, added to each subcontract that touches member data.
- A written answer, for each plan contract, to whether the plan has an attestation form, its deadline and who receives it.
How a particular plan applies the requirement to your arrangement is a question for the plan and your counsel. The other state and payer rules that can limit offshore work are on the offshore medical billing restrictions page, the contract terms are on the business associate agreement page, and the wider HIPAA position is in HIPAA compliant offshore medical billing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Offshore restrictions by state and payer
State storage laws, payer consent clauses and Medicaid rules that can restrict offshore billing, and how to check which ones bind you.
- Puerto Rico medical billing
Same HIPAA rules as the mainland, heavy Medicare Advantage, and what the offshore checks mean for Puerto Rico practices.
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- How to outsource medical billing
Five steps from choosing roles to go-live, with the compliance and cost checks in the right order.
- Medicare Advantage RADV audits
What RADV checks and how it is scored, the 2024 CMS-HCC model, the vacated 2023 rule and OIG's guidance on coding vendors.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.