Can your virtual assistant be overseas? The BAA and access controls

Does HIPAA say where a business associate can sit?

No. The applicability provision names who the rules reach by entity type: a health plan, a health care clearinghouse, a health care provider transmitting covered transactions, and, where provided, a business associate 1Ref 1U.S. Department of Health and Human Services (2026).§ 160.102 Applicability.The applicability provision's entity-type list and the absence of any location, residency or nationality condition in HIPAA's scope.. It sets no condition on location, residency or nationality. An assistant working from Manila sits under the same paragraph as an assistant working from Ohio, and the same obligations follow the chart wherever it travels.

But silence in the rule text settles nothing on its own. The question gets settled somewhere else: in the contract the practice signs, in the controls it configures, and in the payer agreements it signed long before any of this came up. Each of those can speak to geography even though the applicability section does not.

If it is not yet settled that HIPAA reaches your practice at all, the covered-entity test runs ahead of every question on this page.

Is the overseas assistant a business associate or the agency's?

A contracted assistant who opens charts is a business associate. The definition covers a person who, on behalf of the covered entity but other than in the capacity of a member of the workforce, creates, receives, maintains or transmits protected health information for a regulated function, and the function list names practice management and administration among them 2Ref 2U.S. Department of Health and Human Services (2000).§ 160.103 Definitions.The business associate definition as it applies to a contracted assistant handling charts for practice management, and the rule that a subcontractor handling PHI on behalf of a business associate is itself a business associate.. Where that person sits changes none of it.

Most offshore arrangements run through an agency, which changes who the practice contracts with. A subcontractor that creates, receives, maintains or transmits protected health information on behalf of a business associate is itself a business associate 2Ref 2U.S. Department of Health and Human Services (2000).§ 160.103 Definitions.The business associate definition as it applies to a contracted assistant handling charts for practice management, and the rule that a subcontractor handling PHI on behalf of a business associate is itself a business associate., so the individual abroad carries the same status as the agency that placed them. The practice takes its satisfactory assurances from the agency, and the rule does not require it to obtain assurances directly from the subcontractor; that duty runs from the agency down 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The satisfactory-assurance requirement documented through a written contract, the fact that the practice is not required to obtain assurances directly from a subcontractor, and the minimum-necessary standard as it binds the practice and the business associate alike..

That saves the practice a contract and costs it visibility. The practice sees the agency's terms; the agency sees the person. Ask for the agency's own subcontractor agreement in writing before the engagement starts, and ask which named individuals will hold accounts in your systems.

The same analysis runs for any HIPAA virtual assistant arrangement, whether the person is three time zones away or thirteen.

What the BAA has to say, and where it stops

The written agreement is the mechanism the rule specifies. A practice may let a business associate handle protected health information only after obtaining satisfactory assurance of appropriate safeguarding, and that assurance must be documented through a written contract or other written agreement 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The satisfactory-assurance requirement documented through a written contract, the fact that the practice is not required to obtain assurances directly from a subcontractor, and the minimum-necessary standard as it binds the practice and the business associate alike.. The required terms are set out in the regulation, so a document that omits them falls short of the rule regardless of what it is titled 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.504 - Uses and disclosures: Organizational requirements.The required business-associate contract terms at 164.504(e)(2) including subcontractor flow-down and return or destruction at termination, and the 164.504(e)(1)(ii) cure-or-terminate duty where the covered entity knew of a pattern of material breach..

Among the terms the regulation requires of the business associate:

• no use or disclosure beyond what the contract permits
• appropriate safeguards to prevent use or disclosure outside its terms
• reporting to the practice of any use or disclosure not provided for, including breaches of unsecured protected health information
• an obligation that any subcontractor agree to the same restrictions and conditions that apply to the business associate
• return or destruction of all protected health information at termination, or continued protection under the same terms where return or destruction is not feasible 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.504 - Uses and disclosures: Organizational requirements.The required business-associate contract terms at 164.504(e)(2) including subcontractor flow-down and return or destruction at termination, and the 164.504(e)(1)(ii) cure-or-terminate duty where the covered entity knew of a pattern of material breach.

A signature is not a standing defense.

A covered entity that knew of a pattern of activity or practice of the business associate constituting a material breach of the agreement is out of compliance unless it took reasonable steps to cure the breach or end the violation and, where those steps were unsuccessful, terminated the contract if feasible 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.504 - Uses and disclosures: Organizational requirements.The required business-associate contract terms at 164.504(e)(2) including subcontractor flow-down and return or destruction at termination, and the 164.504(e)(1)(ii) cure-or-terminate duty where the covered entity knew of a pattern of material breach.. The obligation names a sequence, and it attaches to what the practice knows.

The mirror-image problem, where the vendor won't sign a BAA at all, belongs to a different page.

Access controls do the limiting a contract cannot

Minimum necessary decides how much of the chart the assistant sees, and it binds the practice and the business associate alike: reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The satisfactory-assurance requirement documented through a written contract, the fact that the practice is not required to obtain assurances directly from a subcontractor, and the minimum-necessary standard as it binds the practice and the business associate alike.. A scheduling role needs the appointment, the payer and a way to reach the patient. A denials role needs the claim, the codes and the remittance. Neither one needs the progress note.

The Security Rule turns that limit into a configuration. Information access management requires policies and procedures for authorizing access to electronic protected health information, with access authorization and access establishment and modification listed as addressable implementation specifications, and workforce security covers authorization and supervision, clearance, and termination procedures 5Ref 5U.S. Department of Health and Human Services (2026).§ 164.308 Administrative safeguards.The administrative safeguards that scope an assistant's access: information access management with access authorization and access establishment and modification as addressable specifications, and workforce security including termination procedures..

In the EHR itself, the status of a control matters more than its name:

A shared login for an offshore assistant fails a required specification, not an optional one 6Ref 6U.S. Department of Health and Human Services (2026).§ 164.312 Technical safeguards.The technical-safeguard statuses configured in the EHR for an assistant account: unique user identification and audit controls as required, automatic logoff and encryption as addressable..

So give the assistant a named account inside systems the practice controls, scope it to the role, and keep the work there so nothing is downloaded to a machine you will never see. Set a cadence for reading the audit log rather than waiting for a reason to read it. Disable the account the day the engagement ends, which is the termination procedure the administrative safeguards ask for 5Ref 5U.S. Department of Health and Human Services (2026).§ 164.308 Administrative safeguards.The administrative safeguards that scope an assistant's access: information access management with access authorization and access establishment and modification as addressable specifications, and workforce security including termination procedures..

Where a payer contract binds tighter than HIPAA

HIPAA is a floor, and a payer contract can sit well above it. Medicare Advantage is the clearest example written into regulation: the MA organization keeps ultimate responsibility for adhering to its contract with CMS notwithstanding any first tier, downstream or related entity it uses, must include accountability provisions in those contracts, and must flow HHS and Comptroller General audit and inspection rights down to them 7Ref 7Centers for Medicare & Medicaid Services (2026).§ 422.504 Contract provisions.Why a Medicare Advantage participation agreement can bind an offshore arrangement HIPAA does not address: ultimate responsibility notwithstanding first tier, downstream and related entities, required accountability provisions, and the 10-year flow-down of HHS and Comptroller General audit and inspection rights..

Those audit rights run 10 years from the end of the final contract period or from the completion of any audit, whichever is later, so a twelve-month arrangement can carry an inspection obligation for a decade 7Ref 7Centers for Medicare & Medicaid Services (2026).§ 422.504 Contract provisions.Why a Medicare Advantage participation agreement can bind an offshore arrangement HIPAA does not address: ultimate responsibility notwithstanding first tier, downstream and related entities, required accountability provisions, and the 10-year flow-down of HHS and Comptroller General audit and inspection rights..

That regulation states no offshore-specific rule, and this page does not supply one. What a given payer requires when work is performed outside the United States lives in your own participation agreement and the provider manual it incorporates, and those are the two documents to read before the assistant starts.

The lookup is unglamorous. Search the executed agreement and the manual for offshore, outside the United States, and downstream entity, then put anything you cannot find to your provider representative in writing and keep the reply.

What the practice can enforce from a distance

Leverage over an assistant abroad is contractual and operational. The agreement says what is permitted and what happens at termination, the account decides what can be reached at all, and the audit log records what was. Build so the worst plausible outcome stays small: no local copies, one named account, a role scoped to the task, and an engagement the practice can end on short notice.

Read the return-or-destroy term against the physical reality of a laptop in another country 4Ref 4U.S. Department of Health and Human Services (2026).45 CFR 164.504 - Uses and disclosures: Organizational requirements.The required business-associate contract terms at 164.504(e)(2) including subcontractor flow-down and return or destruction at termination, and the 164.504(e)(1)(ii) cure-or-terminate duty where the covered entity knew of a pattern of material breach.. The term is worth more when there is nothing to destroy, which is the argument for keeping every file inside systems the practice already controls. An assistant who touches money as well as charts raises a separate internal-controls question, and it belongs in the same review rather than a later one.

Counsel earns the hour in three places here: drafting or reviewing the BAA and the agency's subcontractor terms, reading a payer agreement's offshore language before signing it, and any question about your own state's health records law or your board's rules, which sit on top of the federal rule and are outside what this page answers. Whether to run the arrangement at all is the practice's call to make.

Before the first chart is opened, put three things in writing: the signed BAA with the agency, the named accounts and the scope of each, and the date the practice will next read the audit log.