Is it HIPAA compliant to use an offshore medical billing team?

Does HIPAA allow an offshore medical billing team to handle PHI?

Yes. Nothing in the HIPAA Privacy, Security or Breach Notification Rules limits where a business associate works or where protected health information (PHI) sits. HHS says so directly in its cloud computing guidance: a covered entity may use a vendor that stores ePHI overseas, provided it signs a business associate agreement (BAA) and otherwise complies with the HIPAA Rules. Billing and claims processing are business associate functions, so the same logic covers an offshore team posting payments, scrubbing X12 837 claims or working denials.

The same HHS guidance adds the caveat most vendor pages leave out. Outsourcing ePHI overseas may increase the risks to the information and present special considerations with respect to enforceability. In plain terms, HHS can fine a US practice far more easily than it can reach a company in another country. HHS expects you to weigh that in your security risk analysis under 45 CFR 164.308(a)(1).

So the legal answer is yes, and the practical answer is that compliance depends on three things you control: the contract chain, the access model and the rules that sit on top of HIPAA. Across 410 Luxen billing reviews, 31% of the practices we reviewed had offshore staff working their billing account.

Access versus storage: why the distinction matters

Offshore billing comes in two shapes. In the first, the offshore team logs in to your US-hosted practice management system, clearinghouse and payer portals, and PHI never leaves US servers. In the second, the vendor pulls files, EOBs, ERA 835 data or scanned charts into its own systems abroad. HIPAA permits both. State data residency laws, covered below, mostly reach the second.

What must a HIPAA BAA cover when the billing team is offshore?

A BAA for an offshore billing company must contain every element in 45 CFR 164.504(e), exactly as a domestic one does, plus the terms that make it enforceable abroad. The regulation requires the vendor to limit its use of PHI to what the contract permits, apply Security Rule safeguards, report breaches, pass the same terms to its subcontractors, support patient access and amendment requests, open its books to HHS, and return or destroy PHI when the contract ends.

For an offshore team, add these terms. None are required by HIPAA, but each closes a gap the regulation leaves open:

• A named list of every subcontractor and country that touches PHI, with 30 days notice before any change.
• A data location clause stating whether PHI is only accessed from abroad or also stored there.
• US governing law and venue, so a dispute is heard in a court you can use.
• Audit rights, including remote review of access logs and a current SOC 2 Type II or HITRUST report.
• Indemnity backed by cyber liability insurance that names your practice.
• Breach notice in days, not the 60-day regulatory ceiling.

The subcontractor chain is where offshore billing breaks

Under 45 CFR 164.502(e)(1)(ii), your vendor may pass PHI to a subcontractor only after that subcontractor signs its own BAA. The risk is not the first vendor you sign. It is the second and third links. The best-known case is UCSF in 2003: transcription work passed through a US vendor, then a Florida subcontractor, then a Texas intermediary, before reaching a transcriptionist in Pakistan who threatened to post patient records over unpaid wages.

We see the same pattern in billing. Among the offshore arrangements in our billing reviews, 78% had no subcontractor BAA on file and 64% could not list every subcontractor. If you already use the vendor compliance checklist we publish, add the subcontractor list as a separate line item.

Which rules restrict offshore medical billing beyond HIPAA?

Four sets of rules add limits HIPAA does not, and they decide whether offshore billing is compliant for your practice in particular.

Medicaid payments must land in US accounts

Section 1902(a)(80) of the Social Security Act, added by Section 6505 of the Affordable Care Act, bars states from paying any financial institution or entity located outside the United States for Medicaid items or services. CMS guidance (SMD letter 10-026) says outsourcing information processing and claims-related call centers is not prohibited. An offshore team can therefore work your Medicaid claims, but every remittance must go to a US bank account in your name, never to a vendor account abroad. Under 42 CFR 438.602(i), Medicaid managed care plans themselves must not be located outside the US, and many state Medicaid contracts pass stricter data rules down to providers.

Medicare Advantage plans track offshore subcontractors

CMS requires Medicare Advantage and Part D sponsors to report every offshore subcontractor that receives, processes or stores beneficiary PHI, and to file an attestation in HPMS within 30 days of signing. Network providers and their vendors sit inside that downstream chain, which is why many MA plans send practices an offshore attestation form at credentialing or recredentialing. Answer it accurately.

Florida and Texas require US data storage

Florida Statute 408.051(3), in force since July 1, 2023, requires health care providers using certified EHR technology to keep patient information stored offsite, including with third parties and cloud vendors, physically in the continental United States, its territories or Canada. Texas Health and Safety Code 183.002, added by SB 1188, requires electronic health records containing patient information to be physically maintained in the US or its territories from January 1, 2026, with Attorney General penalties of $5,000 to $250,000 per violation. Both laws target storage. An offshore team working only inside US-hosted systems can fit within them. A vendor that copies records to servers abroad cannot. Our guide to comparing medical billing companies covers what else to ask a vendor about where your data lives.

Federal contracts and other programs

Practices that bill under DoD contracts can face DFARS 252.239-7010, which keeps government data inside the US unless the contracting officer approves otherwise. Substance use disorder records under 42 CFR Part 2 need their own contract terms, and some state Medicaid agencies ban offshore access outright in provider agreements.

Who is liable if an offshore billing vendor has a breach?

You are, first. The practice is the covered entity, so HHS holds you responsible for signing a compliant BAA, doing a risk analysis that addressed the offshore risk, and acting on any pattern of violations you knew about. A business associate is also directly liable for Security Rule failures and for breach reporting, but HHS enforcement against a company with no US presence is slow at best.

The clock is set by 45 CFR 164.410: the vendor must tell you about a breach without unreasonable delay and in no case later than 60 calendar days after discovery. Your own 60-day deadline to notify patients can start when your agent knew, not when you were told. Civil money penalties, adjusted in January 2026, run from a minimum of $145 per violation where the practice did not know, to $73,011 per violation and a calendar-year cap of $2,190,294 for the most serious tier. Billing errors bring a second exposure: coding mistakes on federal claims can lead to overpayment demands and False Claims Act risk regardless of who keyed the claim.

How do you vet offshore medical billing companies for HIPAA compliance?

Run the same seven checks on every offshore medical billing company, in this order, and stop at the first one it fails.

1. Get the access model in writing. Confirm whether staff only log in to your systems or also store PHI abroad.
2. Collect the full chain. Ask for every subcontractor, country and staffing agency, each with its own signed BAA.
3. Read the BAA against 164.504(e). Check each required element, then the six offshore terms above.
4. Ask for evidence, not claims. A current SOC 2 Type II or HITRUST report, the vendor’s own HIPAA risk analysis and its workforce training records.
5. Check the controls. Named user accounts in your PM system, multifactor authentication, no local downloads, locked-down devices and session logging.
6. Map it to your payers and state. Medicaid remittance to US accounts, MA offshore attestations, and Florida or Texas storage rules if they apply.
7. Document your decision. Add the offshore risk and your mitigations to your security risk analysis and keep it for six years.

Most practices stop after step one. In the Luxen Practice Manager Survey 2026, 48% of practice managers did not know where their billing staff work, and 44% could not name the fee basis in their current billing contract.

What do offshore medical billing services cost once compliance is included?

Offshore teams are usually priced per full-time employee, not as a share of collections.

Medical billing outsourcing to India and the Philippines: typical rates

RCM Staff publishes 2026 ranges of $8 to $12 an hour for a billing specialist, $12 to $18 for a certified coder, and $1,400 to $3,500 a month per FTE. Percentage-of-collections vendors typically charge 3% to 6% of collections, and in-house billing is not free either: across 96 practices that shared payroll data, fully loaded in-house billing cost 7.9% of collections for practices under $2M.

Worked example: 3 providers, $90,000 a month in collections

• In-house team: $90,000 x 7.9% = $7,110 a month, or $85,320 a year.
• Percentage-of-collections vendor at 3% to 6%: $2,700 to $5,400 a month, or $32,400 to $64,800 a year.
• Offshore FTE team, 2 full-time staff at $1,400 to $3,500 each: $2,800 to $7,000 a month, or $33,600 to $84,000 a year.

In this example, the in-house team costs $7,110 a month, a percentage-of-collections vendor $2,700 to $5,400, and a 2-person offshore team $2,800 to $7,000.

The offshore line hides two costs. The practice still owns management, QA and denial strategy, and 42% of practice managers said nobody owns denial follow-up full time. Add the compliance work in the vetting steps above, and the low end of the offshore range often lands close to a percentage vendor that carries those duties itself. See our in-house versus outsourced billing comparison for the full cost model.

What HIPAA mistakes do practices make with offshore billing teams?

The same five gaps appear in almost every offshore arrangement we review. Among offshore arrangements in our billing reviews, 78% had no subcontractor BAA, 71% had no clause naming where data is stored, 64% could not list every subcontractor, 58% gave the practice no audit rights and 49% could not produce a current SOC 2 report.

• Treating the BAA as the whole answer. A signed BAA with the first vendor says nothing about the staffing agency behind it.
• Sharing logins. One shared PM system account for an offshore team breaks the Security Rule’s unique user identification standard and makes audit logs useless.
• Letting remittances route abroad. Medicaid payments must reach a US account in the practice’s name.
• Answering MA attestations from memory. Check the vendor chain before you sign one.

Is offshore billing the right choice, or is outsourcing to a percentage vendor safer?

Location decides your compliance workload. It does not decide claim quality. In the Luxen claim audit of 61,400 claims, eligibility and coverage errors caused 24% of denials, coding and modifier errors caused 21% of denials, and missing or invalid prior authorization caused 17% of denials. Those are process failures that happen onshore and offshore alike.

Offshore FTE teams fit practices that already have a strong billing manager, clean workflows and the time to run vendor compliance. A percentage vendor fits practices that want one party to own eligibility and prior authorization, certified coding and denial follow-up under a single BAA. Staffing churn matters too: 34% of practice managers replaced a biller in the past two years, and open biller roles took a median 67 days to fill. If you are weighing full-service medical billing against an offshore team, ask each option who owns clean claim rate and days in AR, and get it in writing. For how billing fits the wider revenue cycle, compare the stages each option actually covers. If you want a second opinion on your current setup, book a free billing review.

How do offshore, onshore and in-house billing compare on HIPAA risk?

All three models can be HIPAA compliant. They differ in who carries the paperwork, how far PHI travels and how easy the vendor is to hold to account.

Dental

Dental practices are HIPAA covered entities once they bill electronically, and Florida’s storage law reaches a broad list of licensed providers using certified EHR technology. Many dental PMS platforms are cloud hosted, so confirm where your vendor’s data center is before adding an offshore team. Dental billing teams often miss medical cross-coding, onshore or offshore: medical cross-coding opportunities were missed in 64% of dental practices reviewed. Ask whether the team can bill CDT and CPT with ICD-10 support, and keep narratives and X-rays inside your own system rather than on vendor file shares.

Physical therapy

Therapy claims carry rules that are easy to miss remotely: the 8-minute rule, plan of care certification and the KX modifier past the Medicare threshold. The KX modifier was missing on 21% of Medicare therapy claims past the threshold in our claim audit. An offshore team can work these claims inside your EMR, but give it a written modifier checklist and audit a sample every month. See our physical therapy billing guide for the full rule set.

Behavioral health

Behavioral health adds 42 CFR Part 2 for substance use disorder records. The 2024 Part 2 final rule, with compliance required from February 16, 2026, aligns Part 2 more closely with HIPAA, but Part 2 records still need specific consent and redisclosure terms in every vendor contract, offshore or not. Payer carve-outs also trip remote teams: claims sent to the medical plan instead of the behavioral health carve-out caused 12% of behavioral health denials. Our substance abuse billing page covers Part 2 in detail.

Ambulance and EMS

Ambulance agencies often run heavy Medicaid volume, so the Section 1902(a)(80) rule matters most here: remittances must reach a US account in the agency’s name. Documentation is the usual weak point, since Physician Certification Statements were missing or unsigned on 18% of non-emergency transports. An offshore team can chase PCS forms and code mileage, but only if trip records stay in your US-hosted ePCR and billing system rather than being exported.

Primary care

Primary care practices usually hold several Medicare Advantage contracts, so offshore attestations arrive at every recredentialing. Keep one current list of vendors and countries to answer them the same way each time. Offshore teams can handle volume work such as charge entry and payment posting, but care management revenue needs clinical context: chronic care management time went uncaptured for 58% of eligible patients. Our primary care billing guide lists the codes to watch.