The question everybody asks second
It can be, and where it is not, the reason is almost never the one people fear. Here is what HIPAA actually says, and the ten questions to ask any offshore vendor — including us.
HIPAA does not prohibit offshore processing. It requires that anybody handling protected health information on a practice’s behalf is a business associate under a signed agreement, and applies the same safeguards a US vendor would. Where offshore work is restricted, the restriction is usually contractual — a payer agreement or a state Medicaid program — rather than a HIPAA rule, and it has to be checked for your payers rather than assumed either way.
Compliance is a property of how an organization operates, not of where it sits. The controls that decide whether your data is safe are identical onshore and offshore, and so are the ways they fail.
Working with a team in Pakistan
The rule asks for a signed business associate agreement and the same safeguards a US vendor would apply. HHS answers the question directly: a business associate outside the United States is allowed, provided the agreement is in place and the rules are otherwise followed (HHS).
CareCloud, a publicly traded US revenue cycle company, reports about 3,300 employees in its offshore offices, about 98% of them in Pakistan, serving about 2,900 practices and hospitals (CareCloud, Inc., fiscal 2025). Our floor is in Rawalpindi.
Each person works inside your system, on your clock, under a named login you issue. You can read every note they leave. Access ends the same day you say so, and because you issued the login, you can end it yourself without waiting for us.
In 2014 the HHS Office of Inspector General found no federal regulation prohibiting offshore outsourcing of Medicaid administrative work, and 4 of 56 state Medicaid agencies with rules that did (HHS-OIG). Some payer contracts bar it too. So we do not touch Medicaid work for Texas, Arizona, Alaska, Ohio or Wisconsin, TRICARE claims, or any payer whose contract with you bars offshore access, unless you show us in writing that the work is permitted. That is our rule, not a legal opinion.
Not on this list yet: backup power, a second internet line, the contracting entity and governing law, how you pay us, and insurance. Each goes here the day we can show it. Until then, ask us on the call and you get a straight answer.
The fear is an attacker in another country. The characteristic failure is far more ordinary: a shared login that makes the audit trail useless, an account still active a month after somebody left, or a screenshot pasted into a chat by a person trying to help a colleague.
Every one of those happens onshore too, at the same rate, for the same reason. Which is why the questions below are about access hygiene rather than about geography.
Useful whoever you end up buying from. Our own answers are below each one, so you can hold us to the same standard you would hold anybody else.
What a good answer sounds like: Signed before a single credential is issued, never after. A vendor who says "we will get that over to you" while your login is already working has told you what their compliance is worth.
Ours: Before access, always. Access without a BAA is an impermissible disclosure by the practice and a direct violation by us.
What a good answer sounds like: One account per person. A shared credential destroys the audit trail, which means an investigation can never rule anybody out — including the innocent.
Ours: Named individual logins, always. We will refuse a shared login even when a client offers one to save time.
What a good answer sounds like: A vendor should ask for less access than you expect, and should be able to say which queue each permission is for.
Ours: We ask for the narrowest role that covers the queue. An AR caller needs the claim, the payer and the balance — not the clinical note.
What a good answer sounds like: Same day, with a written checklist covering every system. It is also entirely within a vendor’s control, which is why a vague answer here tells you so much.
Ours: Same day, confirmed to you in writing. And because the login is one you issued, you can end it yourself at any moment without waiting for us.
What a good answer sounds like: Ask specifically about USB storage, personal email, personal cloud sync and phones at working positions. Most PHI that escapes an organization leaves through a helpful person, not an attacker.
Ours: The rule is no personal devices on client systems, no removable storage, no client data on anything that leaves the floor, and no screenshots. The machine and floor controls that enforce it are being put in place now; ask to be shown each one during the BAA process, and the security page says which are done.
What a good answer sounds like: The honest answer names the systems where it is not available, rather than claiming universal coverage.
Ours: On every client system that offers it, on the login you issue — ask for it and we will use it. Where a system does not support it, we will say so in writing as a known risk rather than pass over it silently.
What a good answer sounds like: A person, not a department. Ask who you would ring at 2am about a suspected breach.
Ours: Ibtesam Asif, founder, whose profile is public.
What a good answer sounds like: Report within the hour, contain without destroying evidence, and a four-factor risk assessment documented every time — including when the conclusion is that nothing was compromised.
Ours: Exactly that, and the client hears it from us on the timeline in the BAA. A client who finds out from anybody else does not stay a client, and should not.
What a good answer sounds like: This is a trick question, and the right answer is no. No body certifies an organization as HIPAA compliant — there is no such certification. A vendor who claims one has either misunderstood the rule or is hoping you have.
Ours: No, and nobody is. What we can show you is the BAA and the safeguards, including which ones are still being put in place.
What a good answer sounds like: A vendor should raise this before you do. HIPAA does not prohibit offshore processing, but some contracts and some state Medicaid programs restrict it, and it is a per-client question with no general answer.
Ours: We check it before go-live rather than after a denial, and we will tell you if the answer is no. Some work we carve out by default, listed above: it stays with you unless you show us in writing that it is permitted.
Whether your notice of privacy practices requires you to tell patients that billing is handled by a business associate abroad is a question for your own counsel. A vendor who answers it definitively is answering a legal question they are not qualified to answer, and we are not going to be that vendor.
Soft Home Global operates from Rawalpindi, Pakistan. We say so on the first call rather than at contract stage, because a practice that discovers offshore delivery after signing has been misled whatever the paperwork says — and because being straightforward about it is the only thing that makes the rest of this page worth reading.
Yes. HIPAA does not prohibit processing protected health information outside the United States. What it requires is that the offshore party is under a business associate agreement and applies the same safeguards. Separately, some individual payer contracts and some state Medicaid programs do restrict offshore access to claims data — that is a contractual restriction rather than a HIPAA one, and it has to be checked per client.
It can be, and compliance is a property of how an organization operates rather than of where it sits. The controls that matter are the same onshore or offshore: a signed BAA before access, named individual logins, least privilege, same-day deprovisioning, encryption, training records and a written risk analysis.
No. No government body or accreditor certifies an organization as HIPAA compliant, and there is no such certificate to hold. Any vendor advertising one is describing something that does not exist. What a vendor can show you is its safeguards, its training records, its risk analysis and its BAA.
Not what most people fear. The characteristic failure is not an attacker abroad — it is ordinary access hygiene: a shared login that makes the audit trail useless, an account left active after somebody left, or a screenshot pasted into a chat by a person trying to be helpful. Those are the same risks an onshore vendor has, and the same controls fix them.
Your notice of privacy practices governs what you must disclose, and a business associate relationship does not normally require patient-level notification. That is a question for your own counsel rather than for a vendor — and a vendor who answers it definitively is answering a legal question they are not qualified to answer.
Sources checked September 2026.
Next step
Twenty minutes. If an answer is no, we would rather say so before you sign than after.
Or write to ops@softhomeglobal.com
