Offshore Billing and What You Have to Disclose

A large share of medical billing work is performed outside the United States. It is common, it is lawful under HIPAA, and it is not something to be coy about — because several of the constraints on it are contractual rather than statutory.

The HIPAA position

HIPAA does not prohibit offshore handling of PHI. The obligations are the same wherever the work happens: appropriate safeguards, a business associate agreement, and equivalent terms flowing down to subcontractors.

The practical complication is enforcement. Recourse against an offshore subcontractor is harder, which is why the contractual chain matters more, not less.

Where the real constraints are

• Payer contracts. Some require disclosure of offshore handling, and a few prohibit it.
• Hospital and facility agreements. Frequently stricter than payer contracts, particularly where a practice bills under a facility relationship.
• State law. A small number of states impose additional requirements around offshore access to health information.
• Government program participation, which can carry its own conditions.

The questions to ask a billing vendor

Is any part of this work performed outside the United States, and which parts? Are those staff employees or subcontractors? What does the BAA say about them? Can you provide a written statement suitable for disclosure to our payers?

A vendor that answers directly is easier to trust than one that answers "we are HIPAA compliant", which is not a response to the question.

Our position

We say so plainly, we flow equivalent terms down, and we will put it in writing for your payer or facility if you need it. The alternative — discovering it during a contract review — helps nobody.