Is offshore medical billing safe and HIPAA compliant?
Yes, HIPAA allows a business associate to process or store patient data outside the United States provided a signed business associate agreement is in place and the HIPAA Rules are otherwise met; location itself is not the barrier. No federal regulation bans offshore processing, though a handful of states carve out exceptions for their own Medicaid work.
The detail
HHS has stated directly, in FAQ guidance on exactly this question, that the HIPAA Rules do not prohibit a covered entity or business associate from using a vendor that stores protected health information on servers outside the United States, as long as there is a business associate agreement and the safeguards HIPAA requires are actually in place. Safety is a function of the agreement and the controls, not the country.
A 2014 federal review of state Medicaid agencies found no federal regulation prohibiting offshore outsourcing of administrative functions, though four of the fifty-six agencies reviewed had adopted their own state-level restriction. Our own list of states where we do not take on new work for exactly this reason is published in the full safety page.
The full detail, including the ten questions worth asking any offshore vendor and our own answers to the uncomfortable ones, is on /is-offshore-medical-billing-safe/.
What can offshore billing staff actually access of my patient data?
Only what their role needs, if the vendor is run properly: an AR caller typically needs the claim, the payer and the balance, not the clinical note. Ask any vendor for the specific access level each role is given, in writing, rather than accepting a general assurance that access is limited.
The detail
Role-based access is the control that actually matters, and it is checkable: ask what system permissions an AR caller, a coder or a payment poster is given, and whether that permission is scoped to billing data or extends to the full clinical chart. A vendor who cannot describe this specifically, by role, has probably not thought about it specifically either.
What offshore staffing vendors do not always volunteer is exactly this detail: the narrowest role that covers the work, named individual logins rather than a shared account, and a defined process for revoking access the same day someone leaves the account. Our own answers to all three, including where they are uncomfortable, are on /is-offshore-medical-billing-safe/.
Is there such a thing as a billing company that is "HIPAA certified"?
No. There is no government body, and no official federal process, that issues a HIPAA certification to a company or a vendor. A page advertising one has either bought a private training provider's certificate of completion or is simply making a claim with nothing behind it. What matters is a signed business associate agreement and verifiable controls.
The detail
HHS, the federal department that administers HIPAA, does not certify covered entities or business associates as HIPAA compliant, and does not endorse any third party that claims to do so. Private companies do sell training certificates with HIPAA in the name, and completing one is not the same thing as being compliant.
What a vendor can actually show you is a signed business associate agreement, named individual logins rather than a shared account, and a description of what happens in the first hour of a suspected breach. Those are checkable; a certificate logo on a website is not. See /is-offshore-medical-billing-safe/ for the full list of what to ask instead.
Why is offshore medical billing so much cheaper, and what is the catch?
Mostly because wages and the cost of living are genuinely lower where the staff live, the same reason any offshore service costs less. The real catch, when there is one, is usually hidden in what is not included: hours, seniority, training, or a shared rather than dedicated person, not a secret quality gap by default.
The detail
Wage levels differ by country for reasons that have nothing to do with billing quality, and a lower price reflects that difference first. The actual risk in offshore billing is not the country; it is a vendor that is vague about hours, access controls or who specifically is assigned to your account.
Read a vendor's own page for what the rate buys before assuming the low price means lower quality: a full-time rate that assumes forty hours a week is not the same purchase as a part-time rate at a fraction of the hours, even when both are advertised as offshore pricing. See /compare/ for named vendors' own published numbers.
Do offshore billing staff work during my practice’s own US business hours?
It depends on the vendor; ask directly rather than assuming. Some offshore staff work their own local daytime, overnight relative to the US; others are scheduled specifically to work US daytime hours. A vendor's shift schedule, stated in writing, is the only reliable way to know which you are buying.
The detail
Time-zone alignment is a scheduling choice a vendor makes, not an automatic feature of being offshore. A vendor based where it is evening or overnight during US business hours can still schedule staff to work exactly during your open hours, the same way a US night shift works daylight hours elsewhere; it has to be stated as a commitment, not assumed.
Ask for the specific hours your assigned person will be working, in your time zone, before signing, and get it in writing. Our own floor runs on US daytime hours by design, stated on /how-it-works/.
What happens if my offshore biller quits or is out sick?
That depends entirely on the vendor's own policy, so get it in writing before signing. A vendor should state a specific replacement timeline and whether coverage continues during a short absence; a vague assurance with no stated number is a sign the question has not been thought through.
The detail
This is one of the most consequential questions a buyer can ask and one of the easiest for a vendor to answer vaguely, because the honest answer sometimes reflects badly on the vendor. Ask specifically: what happens to the queue during a single sick day, and what is the stated timeframe to replace someone who resigns.
A vendor's own published terms, not a verbal promise on a call, are the only version worth relying on. Our own replacement and notice terms are published rather than negotiated per client; see /founding-clients/ and /questions-to-ask/ for the full list of questions this one sits alongside.
Does an offshore billing company need to already know my EHR or PM system?
Not necessarily, but it changes onboarding time either way. A vendor already trained on your specific system can start faster; one that is not will need roughly a week or more of training before working live claims. Ask which practice-management systems a vendor currently supports before assuming either answer.
The detail
Practice-management and EHR systems vary enough between vendors that no single answer covers every platform; a vendor experienced in your specific system removes a real chunk of onboarding time, while one new to it needs a defined training period before working live claims unsupervised.
Ask for a specific onboarding timeline tied to your actual system, not a generic 'a few days' answer. Training on a new workflow here runs about a week and is not billed as a separate setup fee; see /integrations/ for the systems already supported.
