Offshore medical billing and HIPAA: what practices should check

Does HIPAA allow offshore medical billing?

Yes. The HIPAA Privacy and Security Rules don’t prohibit a covered entity from using a business associate located outside the United States. A billing company in another country is held to the same requirements as one down the street: a signed Business Associate Agreement, appropriate safeguards for protected health information, and breach reporting back to the practice.

That’s the legal starting point, and it’s only the starting point. Whether a particular offshore vendor is a sensible choice depends on what the contract says, how the vendor actually protects data, and whether any of your own payer contracts restrict where patient data can go.

What the Business Associate Agreement has to cover

HIPAA sets out what a BAA must contain. Among other things, the vendor agrees to:

• Use PHI only for the services in the contract, or as the law requires.
• Apply the Security Rule’s safeguards to electronic PHI.
• Report breaches and other improper uses to your practice. The breach notification rule sets an outer limit of 60 days from discovery, and you can negotiate a shorter window.
• Bind its own subcontractors to the same restrictions, so data handed further down the chain is still covered.
• Return or destroy PHI when the relationship ends, where feasible.
• Make its practices available to HHS if regulators ask.

Read the vendor’s BAA before you sign the service contract, and pay particular attention to the subcontractor clause. Some offshore arrangements involve a US company that subcontracts the work to a team overseas. That can be legitimate, but you should know about every company in the chain that will touch your data.

The safeguards that matter for an offshore billing team

A BAA is a promise. The safeguards are what make it true. For offshore billing, the ones worth asking about are practical:

• Access control. Each person has their own login, with access limited to what their role needs. Shared logins are a serious problem, because they make audit logs meaningless.
• Where the data lives. Ideally staff work inside your EHR or a secured remote environment, so PHI stays on systems you or the vendor control and isn’t saved to local computers.
• Device and workspace controls. Restrictions on downloads, USB storage, printing and personal phones in the work area, plus disk encryption on any device that can reach PHI.
• Encryption. Data encrypted in transit and at rest.
• Multi-factor authentication on every system that holds PHI.
• Audit logs. A record of who accessed what and when, kept long enough to investigate an incident.
• Training and background checks. HIPAA training at hiring and at regular intervals, with records the vendor can show you.
• Offboarding. Access removed the same day someone leaves.

None of these is unique to offshore vendors. A domestic billing company should meet the same standard. The difference is that you can’t walk into an overseas office, so you rely more on documentation, policies and the vendor’s willingness to answer questions in detail.

Payer contracts and government programs that restrict offshore PHI

This is the part practices most often miss. HIPAA allowing offshore work doesn’t mean every contract you’ve signed does.

• State Medicaid. Some state Medicaid programs restrict or prohibit sending beneficiary data outside the US, either by state law or through their contracts.
• Medicaid managed care and Medicare Advantage plans. Medicare Advantage plans have offshore reporting obligations to CMS, and some managed care plans pass offshore restrictions or notice requirements down to network providers and their vendors.
• Other government work. Federal programs and contracts can carry their own limits on where data is accessed or stored.
• Commercial payer agreements. Less common, but worth checking.

Before you sign with any offshore vendor, have someone read your payer participation agreements for clauses about offshore access, data location or subcontractor approval. If a restriction applies, you may need to keep those patients’ billing onshore or get the payer’s approval first.

The honest risks of an offshore billing vendor

Offshore billing can be done well, and it carries real trade-offs you should weigh:

• Enforcement is harder. If something goes wrong, pursuing a vendor in another country is slower and more expensive than suing a local company. Your contract, insurance requirements and the vendor’s track record matter more as a result.
• Your practice stays responsible. Using a business associate doesn’t transfer your own HIPAA obligations. Your risk analysis should include the vendor, and if you learn of a pattern of violations you’re expected to act on it.
• Time zones. Billing work can run overnight, which is useful, but you need overlap hours when someone can answer your front desk’s questions.

Questions to ask an offshore medical billing company

1. Will you sign a BAA before any data moves, and can we read it now?
2. Is your team employed by you, or by a subcontractor? Who else touches our data?
3. Will your staff work in our systems, or will our data be copied to yours?
4. How do you control devices, downloads and printing?
5. Is multi-factor authentication required on every system with PHI?
6. What do your audit logs capture, and can we see them?
7. How often is HIPAA training done, and can you show records?
8. How fast will you tell us about a breach, and who will call us?
9. Do you carry cyber liability insurance, and what does it cover?
10. Can we export all our data at any time, including on the way out?

Where we stand

We’re open about this: RCM24 Billing’s team works from Pakistan. We sign a Business Associate Agreement before any patient data moves, keep claims data in systems we agree with you, access-controlled and logged, and give you a full export whenever you ask. The short version is in our privacy summary, and the details are in our privacy policy. If any of your payer contracts restrict offshore access, tell us at the start so those accounts are handled the way the contract requires.

If you’d like to see how your claims are performing before deciding anything, ask for a free A/R audit. The findings are yours whether or not you work with us.