The BAA that made you compliant in January isn’t necessarily protecting you in December
This article is a submission by Connext, a back-office BPO service provider. Connext helps companies build custom, dedicated support teams in the Philippines, India, Mexico and Colombia. The company has been providing highly skilled professional staffing services at a minimal cost since 2014.
Signing a business associate agreement (BAA) with an offshore billing vendor feels like the finish line. The vendor passed your review, the contract is filed, and HIPAA compliance looks handled. That relief is understandable, but the signature only proves where the relationship started.
Within months, your practice adds a new clearinghouse, a trained biller is replaced, and the team picks up denial follow-up. The BAA still reads the same. The operation behind it has changed.
What protects you is keeping the relationship compliant as it evolves, with both sides watching for changes. That takes change-triggered reviews, a named owner on each side, and records that show BAA compliance was maintained.
What does a BAA actually cover?
HIPAA’s 45 CFR 164.504(e) lists what a BAA must cover. That includes PHI use and disclosure, Security Rule safeguards, breach reporting, subcontractor terms, and returning or destroying PHI when the contract ends.
What a BAA usually does not describe is the day-to-day operation. The systems the offshore team logs into, the fields they can see, and the tasks they perform typically live elsewhere. They sit in the statement of work, access authorization records, training logs, and your security risk analysis.
That distinction matters. A BAA can remain perfectly valid while those operational documents go stale. When they stop matching reality, you lose the evidence that access fits the work. You also lose proof that your risk analysis covers every place electronic PHI (ePHI) now flows.
4 ways a compliant relationship drifts
Drift rarely starts with a bad decision. It starts with a reasonable operational change that nobody routes through compliance.
1. New systems are added without review
A practice adopts a new EHR module, clearinghouse, or reporting tool, and the offshore team gets a login. The access makes sense for the work. However, the risk analysis was never updated to include the new system, and nobody confirmed the team’s access level.
The Security Rule’s information access management standard expects access to be authorized and documented, system by system.
2. Staff turnover happens without reverification
The biller who was trained and approved at onboarding moves to another account or leaves. A replacement starts working claims the following week.
If training, access approval, and the removal of the previous user’s credentials are not documented, the access record no longer matches the people doing the work.
3. The team’s scope expands
An offshore team hired for claims submission starts handling denial follow-up, then patient balance calls. Each step is logical. Each one also changes what PHI the team touches and why.
HIPAA’s minimum necessary standard still applies. Someone needs to confirm the new work falls within the BAA’s permitted uses and that access was adjusted to match.
4. Vendor-side changes go unreported
The vendor adds a cloud host, a quality monitoring tool, or a subcontractor. The BAA already requires the vendor to bind subcontractors to equivalent terms.
The covered entity, however, may not know the change happened. Its risk analysis and vendor records then describe a data flow that no longer exists.
What is HHS enforcing in 2026?
Risk analysis is a key focus of HIPAA enforcement. HHS’s Office for Civil Rights (OCR) runs a Risk Analysis Initiative, and its June 2026 settlement was the initiative’s 14th enforcement action.
A recurring issue is incomplete assessments of where ePHI is stored, who can access it, and how it could be exposed.
Business associates are also directly subject to HIPAA enforcement. In March 2026, OCR settled with MMG Fusion, a business associate, over a breach affecting 15 million people.
HHS has proposed Security Rule changes, but they are not yet law. The January 2025 proposal would require covered entities to obtain annual written verification from business associates that required technical safeguards are in place. The final rule has been delayed, with regulatory planning pointing to 2027.
For now, annual vendor verification is a proactive step, not a current HIPAA requirement.
What should trigger an off-cycle review?
An annual review alone catches drift late. The Security Rule’s evaluation standard already calls for periodic evaluation in response to operational changes. Each of these events should prompt a review:
| Change event | What to reverify | Who confirms |
|---|---|---|
| New system, module, or tool goes live | Risk analysis scope, access levels, data flow | Covered entity’s security official, with vendor input |
| Offshore team member joins or leaves | Training record, access approval, credential removal | Vendor, reported to the covered entity |
| Team takes on a new task or workflow | Permitted uses under the BAA, minimum necessary access, statement of work | Covered entity’s compliance lead |
| Vendor adds a subcontractor, host, or tool | Subcontractor agreement, data location, risk analysis | Vendor discloses before go-live; covered entity reviews |
HIPAA requires both covered entities and business associates to designate a security official. Name those two people, and agree on who notifies whom and how fast.
A contract clause requiring the vendor to disclose subcontractor or tool changes before go-live closes one of the easiest gaps to miss.
What evidence proves ongoing compliance?
If OCR reviews your organization, the signed BAA shows the relationship started correctly. It doesn’t show how it was maintained. Keep a record that does:
- Dated reviews, each tied to the change that triggered it
- A current access list for the offshore team, with approval dates
- Training records tied to current team members
- A scope log showing new tasks and any matching updates to the statement of work or BAA
- Subcontractor agreements and vendor change disclosures
HIPAA requires this kind of documentation to be retained for six years from creation or last effective date. A reviewer should be able to trace any access decision back to a dated approval.
Keeping offshore billing BAA compliance current
A CFO’s real exposure isn’t just the vendor they chose. It’s assuming January’s paperwork still reflects December’s operation. A compliant relationship can drift out of scope, and signing a BAA won’t protect against gaps no one is monitoring.
The answer is treating the relationship as a team you manage together, with ongoing oversight built into the operating model. Compliance becomes part of the relationship, not a one-time administrative step.
The framework: Recruit right, retain right, manage right
Connext’s co-management model rests on three commitments that also make ongoing compliance easier to maintain.
Recruit right
Every engagement starts with the client’s actual needs, not a generic job post. Connext aligns on role, skills, and fit before sourcing, and the client has a real say in who joins their team.
Retain right
Retention is part of the product, not an HR afterthought. Comfortable workstations, real pantries, weekend events, and company-wide celebrations keep people engaged past onboarding. Every departure means removed access and a new training record, so lower turnover also means fewer reverification events for the client.
Manage right
Every account gets real oversight, not just a seat count. Connext’s co-management model pairs client teams with ops directors and managers who own performance day to day, not just at renewal. For healthcare teams, Connext managers raise staffing, tool, and scope changes with the client, whose security official makes the compliance call.
Learn more at connextglobal.com.
Key takeaways
- HIPAA compliance for an offshore billing relationship isn’t a one-time decision made at signing. It’s a state that has to be actively maintained.
- The biggest compliance risk in an established relationship isn’t a bad vendor. It’s a compliant relationship that has quietly drifted out of scope.
- A BAA can stay valid while the access records, training logs, and risk analysis behind it go out of date.
- Ongoing compliance requires clear ownership from both the client and vendor, with documented reviews whenever access, staffing, systems, or workflows change.
Independent
