HIPAA does not prohibit sending PHI offshore, but it does not stop applying at the border. What the BAA chain, the Security Rule risk analysis and the CMS offshore subcontractor attestation actually require, which RCM work really moves, and the access controls that break first.