Offshore handling of protected health information is permitted under HIPAA but it is not invisible. Some payer and facility contracts require disclosure or prohibit it outright, and a few state Medicaid programs restrict it, so the constraint is usually contractual rather than statutory.
A large share of medical billing work is performed outside the United States. It is common, it is lawful under HIPAA, and it is not something to be coy about — because several of the constraints on it are contractual rather than statutory.
The HIPAA position
HIPAA does not prohibit offshore handling of PHI. The obligations are the same wherever the work happens: appropriate safeguards, a business associate agreement, and equivalent terms flowing down to subcontractors.
The practical complication is enforcement. Recourse against an offshore subcontractor is harder, which is why the contractual chain matters more, not less.
Where the real constraints are
- Payer contracts. Some require disclosure of offshore handling, and a few prohibit it.
- Hospital and facility agreements. Frequently stricter than payer contracts, particularly where a practice bills under a facility relationship.
- State law. A small number of states impose additional requirements around offshore access to health information.
- Government program participation, which can carry its own conditions.
The questions to ask a billing vendor
Is any part of this work performed outside the United States, and which parts? Are those staff employees or subcontractors? What does the BAA say about them? Can you provide a written statement suitable for disclosure to our payers?
A vendor that answers directly is easier to trust than one that answers "we are HIPAA compliant", which is not a response to the question.
Our position
We say so plainly, we flow equivalent terms down, and we will put it in writing for your payer or facility if you need it. The alternative — discovering it during a contract review — helps nobody.
Read your payer and facility contracts
The prohibition or disclosure obligation, where it exists, is usually sitting in an agreement you already signed rather than in federal law.
Check hospital and health system agreements especially. They are frequently stricter than payer contracts and are the ones most likely to contain an outright prohibition.
Ask about subcontractors specifically
A vendor may perform work domestically and subcontract a component offshore. A question about where the vendor operates does not surface that; a question about subcontractors does.
Get the answer in writing, and make it a contractual representation rather than a conversation.
Decide deliberately
Offshore arrangements can be well controlled and are often cost-effective. The failure is not choosing them; it is choosing them without knowing, and discovering the obligation during a contract audit.
Common questions
- Is offshore medical billing legal?
- HIPAA does not prohibit it, provided appropriate business associate agreements and safeguards are in place. The real constraints are usually in payer and facility contracts.
- Do I have to disclose offshore billing?
- Sometimes. Some payer contracts, hospital agreements and state Medicaid programs require disclosure or prohibit offshore handling of their data.
- What should I ask a billing vendor about offshore work?
- Whether any work is performed outside the country, by whom, under what agreements, and whether subcontractors are involved. Ask in writing.
- Does a business associate agreement cover offshore subcontractors?
- It should flow down to them. Confirm that subcontractor arrangements exist and are covered rather than assuming the primary agreement is sufficient.
- What is the practical risk?
- Contractual breach with a payer or facility more often than a HIPAA enforcement action. That is why reading your own contracts matters more than reading the statute.
Denials Piling Up?
We handle the revenue cycle end to end — coding by certified coders, claim submission, denial management and appeals, and A/R follow-up, with six reported numbers every month.