How to Evaluate a Medical Billing Partner’s Team Model: In-House, Outsourced, Offshore and Hybrid

Practices comparing billing options often hear the choice framed as domestic versus offshore. That framing leaves out what actually drives results: leadership, process, security controls, and accountability. This guide explains the four common team models, what HIPAA requires no matter where the work happens, and the questions to put to any billing partner before you sign.

The four team models

Most revenue cycle work, from charge entry and coding to claim follow-up and denial management, can be done under any of these models. Each one has real strengths and real trade-offs.

1. In-house practice staff

Billers and coders are employees of the practice and usually work in or near the office.

• Strengths: direct supervision, close contact with providers and front-desk staff, and institutional knowledge of the practice’s payers and workflows.
• Trade-offs: the practice carries recruiting, training, turnover, and coverage for vacations and absences. Expertise often rests with a small number of people, and the practice is responsible for its own HIPAA safeguards, including access controls and audit review.

2. Outsourced domestic billing company

A third-party billing company whose team works within the United States.

• Strengths: specialization and scale beyond what one practice can staff, working hours aligned with practice and payer business hours, and a business associate agreement with defined service terms.
• Trade-offs: quality varies from vendor to vendor, the practice has less day-to-day visibility unless reporting is strong, and the vendor may use subcontractors of its own, which should be disclosed.

3. Offshore or BPO provider

A business process outsourcing (BPO) firm whose billing and coding staff work mainly outside the United States, either under contract to a domestic company or directly for practices.

• Strengths: capacity to handle large volumes and extended hours, and established production processes at many firms.
• Trade-offs: leadership and client contact may sit in a different organization from the people doing the work, so practices should confirm how subcontractor relationships and BAAs are structured. Time zone differences call for a defined handoff and escalation process.

4. Hybrid or global team with US leadership

One company employs its own team across several locations, including outside the United States, while leadership, client management, and accountability sit in the United States. Data is typically hosted centrally and reached remotely under role-based controls.

• Strengths: extended coverage across time zones within one organization, a single chain of command, and one set of policies, training, and audits, with domestic leadership that answers to the client.
• Trade-offs: the practice should verify where PHI is stored, how remote access is secured, and that access is logged and reviewed. As with any model, results depend on process discipline and leadership.

No model is right for every practice. A well-run team in any of these structures can perform well, and a poorly run one can struggle. The questions later in this guide help you tell the difference.

What HIPAA actually requires

HIPAA does not tell a practice where its billing team must sit. It sets out what any organization that handles protected health information (PHI) on a practice’s behalf must do. For a billing partner, four requirements matter most:

• Business associate agreements (BAAs). HHS lists billing and claims processing among the activities a business associate performs. A practice may share PHI with a billing company only after obtaining satisfactory assurances in a written BAA, and the billing company must have its own BAA with any subcontractor that handles that PHI. See HHS guidance on business associates and sample BAA provisions.
• Minimum necessary access. The Privacy Rule requires reasonable steps to limit uses and disclosures of PHI to the minimum necessary for the purpose. The Security Rule’s information access management standard requires that access to electronic PHI be authorized only when it is appropriate for the user’s role. See the HHS minimum necessary requirement.
• Audit controls. Regulated entities must put mechanisms in place to record and examine activity in systems that contain electronic PHI, and must regularly review records of that activity to detect security incidents.
• Security Rule safeguards. Administrative, physical, and technical safeguards apply to business associates as well as practices, including risk analysis, workforce training, access control, authentication, and transmission security. See the HHS Summary of the HIPAA Security Rule.

HIPAA does not prohibit offshore access to PHI, but it does require safeguards and BAAs. HHS guidance on cloud computing says the HIPAA Rules allow a covered entity or business associate to use a cloud service provider that stores electronic PHI on servers outside the United States, provided a BAA is in place and the other HIPAA requirements are met. The same guidance notes that the Rules have no requirements specific to electronic PHI processed or stored by a business associate outside the United States, and that risks can vary by location and should be weighed in the risk analysis. See HHS Guidance on HIPAA and Cloud Computing.

In practice, the useful question is not only where the team sits. It is what agreements, safeguards, and oversight are in place wherever the team works.

Questions to ask any billing partner

Ask every vendor the same questions and get the answers in writing:

• Where does your team sit? Ask which functions are performed where, including coding, charge entry, payer follow-up, and patient calls.
• Who leads the team, and who is our named contact? Get the name and role of the person accountable for your account and how to reach them.
• Where is our PHI stored? Ask where the systems that hold your data are hosted and who manages them.
• How is access granted, logged, and reviewed? Ask whether access is role-based, how accounts are added and removed, and how often access logs are reviewed.
• What is in the BAA? Confirm it covers permitted uses, safeguards, subcontractors, incident and breach reporting, and the return or destruction of PHI when the contract ends.
• How are coders certified and trained? Ask which credentials coders hold, how they stay current, and how coding quality is checked.
• What reporting do we get, and how often? Ask for sample reports and a set schedule for reviewing them together.
• How are errors escalated? Ask how problems are flagged, who owns them, and when you will hear about them.

How AMS is set up

AMS Solutions, Inc. is a medical billing and revenue cycle management company with AAPC-certified coders and a dedicated account representative. We were physician-founded in 1992 and serve practices in all 50 states. Here is how our answers to the questions above look:

• Team model: The people working on client accounts are part of AMS’s own team.
• PHI handling: AMS Solutions works with client PHI under a signed Business Associate Agreement (BAA).
• Coding: AAPC-certified coders.
• Accountability: ask us for your named contact, our reporting schedule, and our escalation path, the same way you would ask any other vendor.

Learn more about our medical billing services and credentialing services, or contact us with the questions in this guide.

Frequently asked questions

Does HIPAA allow billing work to be done outside the United States?

Yes. HIPAA does not prohibit offshore access to PHI. It requires a business associate agreement, minimum necessary access, audit controls, and Security Rule safeguards wherever the work is done. HHS guidance also notes that location can affect risk and should be considered in the risk analysis.

Where does AMS Solutions operate, and how is PHI handled?

AMS Solutions, Inc. serves practices in all 50 states and works with client PHI under a signed Business Associate Agreement (BAA).

Is one billing team model better than the others?

No single model is right for every practice. In-house staff, domestic billing companies, offshore providers, and hybrid global teams can each perform well or poorly. Leadership, process, security controls, and accountability matter more than location alone.

What should a business associate agreement with a billing company cover?

At a minimum, it should set out permitted and required uses of PHI, require safeguards under the HIPAA Security Rule, extend the same obligations to subcontractors, require reporting of security incidents and breaches, and address return or destruction of PHI when the contract ends. HHS publishes sample BAA provisions.

How can I check how a billing partner controls access to PHI?

Ask where PHI is stored, whether access is role-based, how accounts are added and removed, how access is logged, and how often logs are reviewed. Get the answers in writing.

What reporting should I expect from a billing partner?

Expect regular reports on claims, payments, denials, and accounts receivable, reviewed with a named contact on an agreed schedule, plus a clear process for escalating problems.

How do I switch billing partners?

Review the termination terms in your current contract and BAA, confirm how your data will be returned or destroyed, and plan a transition with the new partner so claim follow-up continues during the handoff.