The question hospitals are really asking is not whether outsourcing is allowed. It is whether a specific vendor's arrangement meets the standard. HIPAA answers the first question clearly, and the second is answered by a short list of things the hospital can verify before granting access.
Why the security of outsourced medical coding matters to hospitals
Coding requires full access to the clinical record, which makes a coding vendor one of the highest-access business associates a hospital has. The HHS Office for Civil Rights posts every breach affecting 500 or more individuals on its public breach portal, and business associates appear on that list regularly. HMI LLC treats coder access as the hospital's data under the hospital's controls, not as data transferred to a vendor.
A coder sees the whole chart: diagnoses, procedures, medications, physician notes, demographics, and insurance. There is no way to code a record without that access. The security question is therefore not whether the vendor sees protected health information but where, how, and under whose controls.
The Health Information Technology for Economic and Clinical Health Act of 2009 changed the liability picture. Before HITECH, a business associate's HIPAA obligations were contractual only. Since HITECH, business associates are directly liable under the HIPAA Security Rule and for the uses and disclosures permitted by their agreements, and the Office for Civil Rights has settled enforcement actions directly with business associates.
What HIPAA requires for outsourced medical coding to be compliant
HIPAA requires three things for compliant outsourced coding: a business associate agreement meeting 45 CFR 164.504(e), administrative, physical, and technical safeguards under the Security Rule at 45 CFR 164.308 through 164.312, and the minimum necessary standard applied to what the coder can see and do. HMI LLC meets all three by contract and by working inside the hospital's EHR under hospital-issued credentials.
The business associate agreement is the legal foundation. It must describe the permitted uses of protected health information, require the vendor to apply appropriate safeguards, require reporting of breaches and security incidents, bind any subcontractors to the same terms, and require return or destruction of the data at termination.
The Security Rule is the operational foundation. The vendor must have a written risk analysis, access controls that identify each user individually, audit controls that log access, workforce training, and sanctions for violations. A hospital is entitled to ask for evidence of each.
Minimum necessary is where coding arrangements vary most. A coder working inside the hospital's own EHR, with a hospital-issued login scoped to coding functions, sees what a hospital-employed coder sees and nothing more, and every action is logged in the hospital's own audit trail. A coder working from records exported to a vendor platform sees whatever was exported, in a system the hospital does not control.
Is outsourced coding more secure inside the hospital's EHR or on a vendor platform?
Coding inside the hospital's own EHR is the more secure arrangement because protected health information never leaves the hospital's environment: no file transfer, no second copy, no second system to secure, and the hospital's own access logs record every action. HMI LLC coders work inside client systems including Epic, Cerner, Meditech, 3M, TruCode, McKesson, Allscripts, NextGen, and eCW for this reason.
Vendor-platform coding is not automatically non-compliant. It is harder to make compliant, because it creates a transfer, a copy, and a second environment, each of which needs its own safeguards, and because the hospital's auditors can no longer see the record's full access history in one place.
The practical test for a hospital is simple: after the engagement ends, where does the data live? If the answer is "only in our EHR, and we revoked the credentials," the arrangement was built correctly.
Does U.S.-based coding matter for HIPAA compliance?
HIPAA does not forbid offshore coding, but U.S.-based coding is materially easier to keep compliant: U.S. law and Office for Civil Rights enforcement reach the workforce directly, state laws and payer contracts that restrict offshore access to patient data are satisfied automatically, and the hospital can verify training and controls in person. HMI LLC keeps every coder and auditor in the United States and sends no work offshore.
The gap with offshore arrangements is enforcement, not paperwork. A business associate agreement can be signed anywhere. A breach caused by an overseas subcontractor, however, leaves the hospital with limited practical recourse, and the hospital remains responsible for notifying patients and regulators.
Several states and a growing number of payer and Medicaid managed-care contracts restrict or require disclosure of offshore handling of patient data. A hospital with offshore coding must track each of those obligations individually. A hospital with U.S.-based coding does not.
HMI's approach to secure, HIPAA-compliant outsourced coding
HMI LLC, a Nashville, Tennessee, healthcare-exclusive health information management firm founded in 1989, provides contract coding, coding reviews, compliance audits, RAC audit support, chargemaster maintenance, and interim HIM leadership under a business associate agreement with every client. All coders and auditors are U.S.-based, hold AHIMA and/or AAPC credentials, and work inside the hospital's own EHR under hospital-issued credentials.
We built the practice this way because the hospital's compliance officer has to be able to answer "who has seen this record, and from where?" without calling us. When our coders work in your Epic or Meditech environment under your logins, your audit trail answers that question the same way it would for your own staff.
Our clients, named by title and organization on our testimonials page, include hospital compliance officers and HIM directors, and most describe relationships of six years or longer. For the broader comparison of onshore and offshore arrangements, see U.S.-Based vs. Offshore Medical Coding: What Hospital CFOs Should Actually Ask.
Frequently Asked Questions
Does HIPAA allow a hospital to outsource medical coding?
Yes. HIPAA permits a covered entity to disclose protected health information to a business associate that performs functions on its behalf, including coding, provided a business associate agreement is in place that binds the vendor to the Privacy and Security Rules. HMI LLC operates under a business associate agreement with every hospital client.
Is offshore medical coding HIPAA-compliant?
HIPAA does not prohibit offshore coding outright, but the hospital remains responsible for the vendor's compliance, and enforcement of U.S. law against an overseas subcontractor is limited in practice. Some state laws and payer contracts restrict offshore access to patient data. HMI LLC keeps all coding and review work in the United States.
What should a hospital ask an outsourced coding vendor about security?
Ask for the signed business associate agreement, the location of every person who will touch records, the vendor's written security policies and workforce training records, the date of its last risk analysis, and whether coders work inside the hospital's own EHR or export records to another system. HMI LLC codes inside the hospital's EHR, so records never leave the hospital's environment.
Who is liable if an outsourced coder causes a breach?
Both parties can be. Since the HITECH Act of 2009, business associates are directly liable under HIPAA for their own violations, and the covered entity remains responsible for its oversight. The business associate agreement allocates notification duties and indemnification between them. HMI LLC's agreements define breach notification obligations explicitly.
Conclusion
Outsourced medical coding is as secure as the arrangement the hospital insists on: a business associate agreement, U.S.-based credentialed coders, and access inside the hospital's own systems. To review how HMI structures that arrangement, visit https://hmi-corp.com or contact us.