Outsourcing Medical Billing to India: What to Check First

Is outsourcing medical billing to India legal, and what do you have to check first? Federal law does not bar it. Three documents decide whether it is permissible for your payer mix, and none of them is HIPAA.

Two of the three are yours already: your state's Medicaid managed care contract, and your state's record storage statute if you use certified electronic health record technology, known as EHR.

The third is the Medicare rule on who may hold your electronic data interchange credentials, or EDI. Most practices have never read it.

Read all three first and the rest of the decision gets simple. What work moves, what stays in the United States, and whether you buy a billing service or employ the team yourself.

What does outsourcing medical billing to India actually involve?

Medical billing is claims processing and payment posting. An India team submits claims, posts payments, works denials and sends patient statements, using your practice management system under your rules. It is a defined slice of the money cycle, not the whole of it, and that boundary is what keeps the arrangement manageable.

Scope creep is the failure mode here. Buyers say "billing" and mean something much larger, then wonder why the contract does not cover it.

Which billing tasks an India team typically performs

On a normal Tuesday, the desk looks like this:

• Claim submission: scrubbing and transmitting clean claims through your clearinghouse on your submission schedule.
• Payment posting: applying remittances, contractual adjustments and patient payments against the correct encounter.
• Denial follow-up: reading the denial reason, correcting the defect and resubmitting, or routing it to someone who can.
• Patient statements: generating and sending statements, and handling the balance queue that follows.
• A/R follow-up: working aged claims payer by payer rather than by whoever shouts loudest.

Notice what is absent. Clinical coding decisions, payer contracting and cash posting authority are separate questions, and they are worth deciding separately.

How this differs from revenue cycle management

That scope is what separates it from revenue cycle management, which covers the whole cycle rather than claims processing and payment posting alone.

The distinction matters commercially. Billing is a defined output you can price and audit. The full cycle pulls in eligibility, authorization, coding, contracting and patient collections, and it changes who is accountable for cash.

If you are deciding how much of the money cycle to hand over at once, the trade-offs are laid out in revenue cycle management outsourcing.

Billing also sits inside a wider set of functions healthcare organizations move offshore, and the same custody questions apply across healthcare BPO services.

For a practice weighing India specifically, the mechanics are the same ones any employer faces, and they are set out for US companies hiring in India.

With the scope pinned down, the legal question becomes answerable.

Is it legal to send patient data to an India billing team?

Yes under federal law, with conditions. HHS OIG states there are no federal regulations prohibiting offshore outsourcing of Medicaid administrative functions, and HIPAA sets no requirement specific to protected health information held outside the United States. OCR's caution is that risk varies by location.

That is a narrower permission than it sounds, and it is worth reading each half carefully.

What HIPAA actually says about where PHI can sit

OCR's guidance on this point is framed around a cloud service provider, and it generalizes to any other business associate. Read it that way and it says something useful.

It states that the HIPAA Rules include no requirements specific to protecting electronic protected health information processed or stored outside the United States. It then notes that the risks to that information may vary greatly depending on geographic location.

It goes further. Outsourcing storage or other services overseas may increase the risks to that information, or raise special considerations about whether privacy and security protections can be enforced at all.

Covered entities and business associates are told to take those risks into account in the risk analysis and risk management the Security Rule already requires.

So HIPAA does not draw a border. It asks you to write the border into your own risk analysis.

What the BAA has to contain

A written business associate agreement is required, and its contents are prescribed rather than negotiable in outline. Four things have to be in it:

• Permitted uses and disclosures: exactly what the business associate may do with protected health information.
• A bar on everything else: any use or disclosure outside those terms is prohibited.
• Appropriate safeguards: including the Security Rule where electronic information is involved.
• A downstream clause: subcontractors must be bound in writing to the same restrictions and conditions that apply to the business associate itself.

That last one is the clause people skip, and it is the one that matters most here.

On an offshore arrangement that clause is doing a lot of work, because the subcontractor chain is usually longer than the diagram you were shown.

Why a BAA is harder to enforce across a border

Here is the honest limit, in the government's own framing. HHS OIG has observed that a US entity sending protected health information offshore may have limited means of enforcing provisions of BAAs that are intended to safeguard that information.

That is not a reason to avoid India. It is a reason to stop treating the agreement as the whole control and to build access controls, logging and vendor oversight that work whether or not anyone ever sues.

And it is not solved by picking a different delivery model. Both routes described later in this article carry the same jurisdictional problem with a different counterparty.

Federal law is the easy half. The state layer is where this actually stops.

Which state rules can stop an India billing team before you start?

State rules, not federal ones, are the real constraint, and they vary. HHS OIG surveyed 56 Medicaid agencies and found 15 with a state-specific requirement and 41 with none. Florida constrains where the record is stored. Texas constrains where the work is performed. Those are two different constraints, and they get conflated constantly.

Start with your own payer mix, because the rule that binds you is usually in a contract you already signed.

Florida: where the record is stored

Florida is quotable, so quote it. Section 408.051(3) of the 2025 Florida Statutes provides:

In addition to the requirements in 45 C.F.R. part 160 and subparts A and C of part 164, a health care provider that utilizes certified electronic health record technology must ensure that all patient information stored in an offsite physical or virtual environment, including through a third-party or subcontracted computing facility or an entity providing cloud computing services, is physically maintained in the continental United States or its territories or Canada.

Read that precisely. It constrains the storage location of records for a provider using certified EHR technology.

It is not a blanket ban on offshore labor. Overstating it is the single most common error made about this topic, and it kills arrangements that were never prohibited.

Texas: where the work is performed

Texas draws the opposite kind of line, and it sets two conditions rather than one:

• Where the work happens: the HHSC uniform managed care contract prohibits performing the work, or maintaining information obtained under the agreement, outside the United States, absent express prior written permission from HHSC.
• How the data is held: systems accessing HHS Confidential Information must be maintained in the United States, and the data encrypted to FIPS 140-2 with the keys held by someone other than the offshore provider.

Read those together. The encryption condition is an additional duty, not an alternative to the US-maintenance duty, so meeting one does not excuse the other.

A plan that satisfies Florida can still fail Texas, and the reverse is also true.

What the federal survey found

HHS OIG's report is the only systematic count available. Of the 56 Medicaid agencies surveyed, 15 had a state-specific requirement and 41 had none.

Of those 15, four prohibited offshore outsourcing through executive orders and eleven permitted it. Seven of those eleven used offshore subcontractors, and none of them reported sending protected health information offshore.

At least one further state restricts this through executive order. Treat the count as a picture of variation rather than a current tally, and check your own state's instrument.

Medicare Advantage and Part D reporting

If you touch Medicare Advantage or Part D, there is a reporting duty rather than a ban.

CMS requires sponsors using offshore subcontractors that handle Medicare beneficiary protected health information to file the subcontractor's details and an attestation through HPMS.

The window is 30 calendar days from signing the offshore contract, and it covers first-tier, downstream and related entities.

CMS requires the attestation. It has not banned offshoring.

The wider contractual picture around vendors, jurisdiction and enforceability is worth reading in full, and it is covered in legal considerations when outsourcing to India. With the state layer mapped, the practical question is which tasks are actually affected.

What billing work has to stay in the United States?

Less than most people assume, and the line is not where they expect. The constraints split three ways: where the record is stored, where the work is performed, and who may hold a credential. Sort each billing task against those three and the answer falls out without much argument.

Here is the sort, with the instrument that governs each row:

Storage constraints versus work-performance constraints

Rows one and two are the ones that get collapsed into each other, and they should not be.

Florida is about where the record sits. Texas is about where the work happens.

A design that keeps every record on US infrastructure can still breach a work-performance rule. A design that keeps all labor onshore can still breach a storage rule through a backup in the wrong region.

Sort by instrument, not by instinct. Offshore medical billing arrangements fail on the paperwork far more often than on the labor.

Systems and device access

The third constraint is the physical one. Who has a laptop, who has a VPN, who has a login, and what each of those can open.

Device and access control are part of the HIPAA answer, not an IT afterthought. A machine that can open a chart is in scope for your risk analysis whichever country it sits in.

The practicalities of issuing and recovering hardware are covered in equipping and recovering devices from remote employees in India.

The systems themselves sit inside a wider estate decision, and the options there are set out in healthcare IT outsourcing.

One credential deserves a section of its own, because it is the one most vendor conversations get wrong.

Who is allowed to hold your Medicare EDI credentials?

Not a billing agent, and not a clearinghouse. CMS states that a provider must not share its EDI access number and password with any billing agent or clearinghouse, and must not share it with its own staff who do not need the data for a valid electronic claim, a remittance advice, eligibility verification or a claim status check.

That rule is short, specific, and rarely mentioned in a sales conversation.

What the Medicare Claims Processing Manual says

Chapter 24 of the CMS Medicare Claims Processing Manual sets the position. The provider's EDI access number and password serve as the provider's electronic signature.

It goes on to the consequence. A provider would be liable if any entity with which it improperly shared those credentials performed an illegal action.

So the credential is not an operational detail. It is a signature with liability attached to it.

Why this changes the vendor conversation

The rule distinguishes staff with a need to see the data from billing agents and clearinghouses. Those are different categories with different permissions.

That means the two delivery routes do not sit in the same place under this rule, and a provider should put the question to counsel before granting any access. Anyone who answers it confidently in a sales meeting is answering a question their contract cannot settle.

Which brings us to the choice that sits under everything else on this page.

What is the difference between hiring a billing vendor in India and employing your own billing team there?

One question sits under all the others: who holds custody. A billing service employs the people, holds the process knowledge and decides who works your account. Employing the team yourself means you direct the work while an employer of record runs the employment administration. The compliance duties do not disappear on either route. They land differently.

Here is where each duty actually falls:

That last row applies to both columns for a reason, and the scope of the obligation is set out in what the DPDP Act covers.

Who can hire, discipline and remove the person on your account

This is the practical difference most buyers feel first.

On a service contract, staffing is the vendor's decision. You can escalate, but the person on your account changes when the vendor's roster changes, and the vendor decides what "equivalent experience" means.

On a direct employment route, you make the hiring decision, you run the interview, and the person stays yours. An employer of record executes the contract, payroll and filings behind that.

The mechanics are explained in what an employer of record does, and the route is available without registering a company, as set out in hiring in India without a local entity.

Where the process knowledge sits after eighteen months

Eighteen months in, somebody knows exactly why your largest payer denies claim type X on the second Thursday of the month.

If that person is the vendor's employee, that knowledge leaves when the contract does. Transition costs are almost always underestimated for this reason, and they are rarely in the business case.

If that person is your employee, the knowledge stays and compounds. That is the strongest argument for the direct route, and it has nothing to do with cost per hour.

What each route does not fix

Worth saying plainly, because selling around it would be dishonest.

• Cross-border BAA enforceability: limited on both routes. A different counterparty does not create a different jurisdiction.
• The Chapter 24 credential question: unsettled for an EOR-employed worker. Nobody should tell you otherwise.
• India's own data duty: DPDP section 8(1) makes the fiduciary responsible for its processor irrespective of any agreement to the contrary, and that applies symmetrically.
• Your risk analysis: still yours. Neither model performs it for you.

If the underlying question is whether to employ through a provider or stand up an Indian entity of your own, the comparison is worked through in EOR versus your own India entity.

Once you know which route fits, the next question is what the people actually cost.

What does an India billing team actually cost to employ?

Think in loading factors, not salaries. On an illustrative $9,000 gross salary, the employer's total cost comes to about $10,293 a year, or $857.73 a month, including the $99 per month EOR fee and health insurance. Accrued leave and gratuity provisions add $401.28 a year. Supply your own salary and the multiplier holds.

The $99 per employee per month is our own published employer of record rate as of September 2026. Here is the full structure on that illustrative salary:

Three of those terms are worth glossing for a US reader:

• Provident fund: India's mandatory retirement savings scheme, roughly the role a 401(k) plays.
• Gratuity: a statutory lump sum paid on exit after qualifying service.
• Professional tax: a small state-level tax on employment, and it changes at the state border.

Change the salary and the loading holds. The employee cost calculator will run your own number, and the mechanics behind the filings sit in payroll in India.

Why this is a loading factor, not a salary table

We are not publishing India coder or biller salary bands here, and the reason is worth stating.

The published sources for those bands are training-institute content written for Indian job seekers, not employer benchmark data. Building a hiring budget on them would give you a confident number with nothing under it.

So take the loading factor instead. Decide what you would pay for the experience level you want, then apply the structure above.

The wider picture on what employment actually costs is worked through in the true cost of employment in India, and the provider-fee side is covered in what an India EOR costs.

How that compares with paying a percentage of collections

Two numbers decide whether a percentage deal is good value:

• What you pay: percentage-of-collections pricing on billing work generally runs 4% to 8% of net collections.
• What it should cost: cost to collect runs roughly 2% to 4% of net patient revenue, with struggling organizations running past 8%.

Run both against your actual collections before you assume either model is the affordable one.

What the work is worth getting right

The stakes are not abstract. Kodiak Solutions reported an initial claim denial rate of 11.6% in 2025, up from 11.4% in 2024, drawn from 2,300 hospitals and 350,000 physicians, alongside $48.4 billion in denials and uncollected patient bills.

The marketplace picture is similar. KFF's 2024 analysis found insurers denied 20% of ACA marketplace claims overall, 19% of in-network claims and 37% of out-of-network claims.

Those are the numbers a billing desk moves. A one point improvement in first-pass yield is usually worth more than the entire labor arbitrage.

The US comparator

For context on the US side, the Bureau of Labor Statistics puts the median annual wage for medical records specialists at $51,140 as of May 2025.

The lowest ten percent earn under $37,000 and the top ten percent over $81,150. BLS counts 200,700 jobs in 2025, 8% growth to 2035, and roughly 14,000 openings a year.

Two other cost drivers get missed. Indian notice periods run longer than US at-will practice, which is covered in notice periods India actually enforces, and the ramp to a productive desk depends on the India hiring timeline rather than on your go-live date.

Benefits are not optional either. Group cover is standard practice and is explained in employee health insurance in India, and the filing obligations behind the numbers are listed in statutory compliance in HR in India.

With the money settled, the last step is the diligence conversation.

What should you ask before you sign with an India billing vendor or an EOR?

Ask about custody, not capability. Who signs the business associate agreement and who is bound downstream, who holds the credentials, who screens the people, who can remove someone from your account, where the record is stored, and what happens to the India-side data duty. Get every answer in writing before any access is granted.

Capability questions are easy to answer well and hard to verify. Custody questions are the opposite.

The questions that decide the contract

Put these to any of the medical billing outsourcing companies in India you are evaluating, and to any employer of record you would use instead:

1. Who signs the BAA, and who is bound downstream: name every subcontractor that will touch protected health information, and show the written flow-down.
2. Who holds the Medicare EDI credentials: and on what basis, given the Chapter 24 restriction on billing agents and clearinghouses.
3. Where is the record physically stored: country, region and backup region, with your certified EHR obligation checked against it.
4. Where is the work performed: stated by country, and checked against every payer contract you hold, not just your commercial ones.
5. Who can remove a named person from our account: and how fast, and whether we need a reason.
6. Who screens the people: what checks, run by whom, refreshed how often.
7. What happens to the India-side data duty: and who carries it if the arrangement ends badly.

Get the answers on paper. A verbal assurance about a credential rule is worth exactly nothing when the credential is your electronic signature.

Fees belong on the same list. Ours are transparent and quoted up front, and you can see transparent EOR pricing before any conversation starts.

What India's data law puts on you

India's own regime is now a live consideration rather than a future one. The Digital Personal Data Protection Act 2023 and the 2025 Rules together set the obligations.

Substantive employer duties and penalties commence around mid-May 2027. There is no "DPDP Act 2025", and anyone who quotes one has not read the instruments.

Three features matter for a billing arrangement:

• Consent: employee consent is not required for employment purposes.
• Transfer: moving data out of India is permitted by default rather than blocked.
• Responsibility: section 8(1) makes the data fiduciary responsible for its processor, irrespective of any agreement to the contrary.

The Rules add minimum safeguards including one year of log retention, and three separate breach notification clocks. If you are working out which of those duties land on you as the foreign employer, the position is set out in India's Digital Personal Data Protection Act.

Contract terms around ownership of work product sit alongside this, and the drafting points are covered in protecting intellectual property when hiring in India.

Screening the people who touch patient records

Screening is a control, not a procurement box. These people open charts.

The standard set is five checks, and you want every one of them run before access is provisioned rather than after:

• Identity and address verification.
• Education and any claimed billing or coding credential.
• Employment history with the previous employers named.
• Criminal record and court-record screening.

Where screening is worth understanding in detail, the process is described in background checks in India.

Then make it operational. Tie access provisioning to a completed check, and put both into your onboarding sequence, which is set out step by step in the India onboarding checklist.

Most of what is left are the questions buyers ask us on the first call.

How can Wisemonk help you build a medical billing team in India?

Wisemonk is an India-native Employer of Record (EOR) that helps global companies hire, pay, and manage talent in India without setting up a local entity.

For a billing pod, that means named people running claim submission, payment posting and denial follow-up on your systems within weeks, on compliant Indian employment contracts, without registering a company in India first.

Because device and access control are part of the HIPAA answer rather than a perk, equipment procurement and shipping come as an add-on to the EOR service, so the laptop that opens a chart is one we sourced, tracked and can recover.

We support 300+ global clients and more than 2,000 employees across India, process $20M+ in annual payroll, and hold a 4.8/5 rating on G2. Pricing starts from $99 per employee per month as of September 2026.

Here is how we help:

• India Employer of Record: we become the legal employer of your billing team, so you direct the work and keep the same people on your account without holding an Indian entity. See our EOR service.
• Background verification: background verification run before access is provisioned, covering identity, education, employment, address and criminal record, because these are the people who open patient charts.
• PEO services in India: if you already hold an Indian entity, PEO services in India run payroll, provident fund, insurance and statutory filings under your own registrations, with your entity staying the legal employer.
• Mira AI: post the role and every applicant is scored against a scorecard you wrote, with the reasoning shown. See how we hire in India.

From our experience building US-facing back-office teams in India, the billing pods that hold their first-pass yield are the ones where access provisioning is sequenced before the start date, not chased after it.

A biller with no clearinghouse login spends week one reading documentation.