HIPAA does not prohibit sending PHI offshore, but it does not stop applying at the border. What the BAA chain, the Security Rule risk analysis and the CMS offshore subcontractor attestation actually require, which RCM work really moves, and the access controls that break first.
Does Your Indian Medical Billing Partner Have a HIPAA Business Associate Agreement? Here Is Why It Matters
Does your Indian medical billing partner have a HIPAA Business Associate Agreement? Essential compliance checklist for US providers.