Serving US healthcare clients from India.

• Hosting or building a platform. Your product stores patient records, appointments or claims for a US provider or plan.
• Revenue cycle and billing. Your team works claims, denials or payment postings.
• Medical coding and transcription. Staff read clinical notes to code or transcribe them.
• Support with production access. Engineers or agents can see live patient data while fixing issues.
• Analytics on identifiable data. You build reports from data that still identifies patients.

You are not a business associate if you never touch PHI, or if you only receive data properly de-identified under one of the two methods HIPAA recognises. Check that claim carefully: removing names alone does not de-identify a dataset.

Business associates are directly liable under the Security Rule wherever they sit. In practice, the strongest lever on an Indian vendor is usually the contract with the US client.

The lesson is the chain. Your BAA with the client binds you to get equivalent written assurances from every subcontractor that handles the PHI. The ticketing tool is the one most often missed.

1. The client confirms you will handle PHI and sends its BAA, often alongside a master services agreement and a security schedule.
2. You check the required terms: permitted uses, safeguards, incident and breach reporting, subcontractor flow-down, return or destruction at the end.
3. You check the extra terms. A breach reporting window shorter than the rule's outer limit, audit rights, insurance and data location clauses are common.
4. You confirm you can meet every term before signing, including the reporting window.
5. You sign, and only then receive PHI.
6. You put matching BAAs in place with each subcontractor that touches the PHI.

Some US clients ask for written approval before any PHI is accessed from outside the United States. Read the agreement for that clause specifically.

HIPAA does not, by itself, forbid PHI from being stored or viewed outside the United States. Your risk analysis must still cover the offshore access path, and your client's contract or its own regulators may restrict it.

Clients in some US government health programmes face their own offshore reporting or restriction duties, which they pass down to you. Ask early whether any apply.

1. AX.1
   Keep data in the client's regionAccess it from India through a virtual desktop or similar, so no copy lands on local devices.
2. AX.2
   Block local storageDisable download, print, clipboard and USB on sessions that show PHI.
3. AX.3
   MFA and named accountsNo shared logins; every action traceable to one person.
4. AX.4
   Log and reviewRecord who viewed what and review it on a schedule.
5. AX.5
   Secure the work areaControlled floor access, clean desks, no personal phones at PHI workstations where the risk calls for it.

• HIPAA training for every person with PHI access, at joining and periodically, with signed records.
• Role modules: coders and billers on minimum necessary use; engineers on test data and logs.
• Background checks commonly used in India, such as identity, education, employment and address or police verification, applied consistently and with the candidate's consent.
• Confidentiality agreements that name PHI.
• A written sanction policy for violations, applied and recorded.
• Same-day removal of access when someone leaves.

There is no HIPAA certificate to show. HHS certifies no one, and a badge from a private body is not a government approval. The answer to a request for one is your evidence pack, and if you have it, an independent report on your controls.

The Digital Personal Data Protection Act, 2023 (DPDP Act) covers personal data in digital form whenever it is handled on Indian soil. Your employees' data is covered in full. For the US patient data you handle under contract, the Act carves out much of its scope for processing done in India for a contract with a person outside India, about people outside India.

Our reading is that reasonable security safeguards remain a duty even under that carve-out. In practice the safeguards you run for HIPAA will largely serve both. Neither law has a certificate.

• Role confirmed. Written view of whether you are a business associate for each client.
• BAA chain complete. Client BAAs signed; subcontractor BAAs in place.
• Risk analysis current. Covers offshore access, devices and every subcontractor.
• Access path locked down. Virtual desktop, MFA, no local copies, logs reviewed.
• People controls. Training, vetting, sanctions, prompt leaver removal.
• Incident plan. Meets the shortest reporting window in any client contract.
• DPDP view. Employee data handled under the DPDP Act; client data carve-out confirmed with counsel.

Sources: 45 CFR 160.103 (definitions of business associate and subcontractor); 45 CFR 164.308, 164.314 and 164.502(e) (business associate safeguards and contracts); 45 CFR 164.514 (de-identification); 45 CFR 164.410 (notice by business associates); HHS guidance on business associates; the Digital Personal Data Protection Act, 2023.