Offshore access to PHI: what HIPAA, payers and states actually say
Nothing in HIPAA prohibits a business associate's workforce from being outside the United States. The restrictions that exist come from contracts and programme rules, and they are specific enough to check in an afternoon.
Practice Standards Review is reader-supported. We may earn a referral fee when you contact a provider through our links; it does not affect how we answer the vetting questions. How we make money · How we vet
What HIPAA says
The Privacy and Security Rules regulate how PHI is used, disclosed and protected, through the covered entity's safeguards and its BAAs. They do not regulate where a business associate's workforce sits. Offshore access is permitted provided the BAA is in place and the Security Rule safeguards — risk analysis, access controls, device policy, training — cover the offshore access.
State Medicaid programmes
Several state Medicaid agencies and their managed-care contracts restrict offshore storage or access to member data, or require notice and approval. The rules vary by state and by plan; if you participate in Medicaid managed care, read your participation agreement's data-handling clauses before you choose a provider region.
Payer contracts
Some commercial payer agreements include offshore data clauses, often inherited from the payer's own regulatory obligations. They are rarely enforced against small practices, but they are binding. Look for "offshore", "outside the United States" or "subcontractor" in the data-handling section.
Cyber insurance
Some policies exclude or limit coverage for incidents involving offshore vendors, or require notification. Check the exclusions and the vendor-management conditions.
How to check in an afternoon
- Pull your Medicaid participation agreement(s) and search for offshore/outside the United States.
- Do the same for your three largest commercial payer contracts.
- Read your cyber policy's exclusions.
- If nothing applies, offshore access is a safeguard question, not a permission question — and the seven vetting questions cover it.
Published 8 November 2026 · Last reviewed 8 November 2026 · Report an error