Handling PHI offshore: what actually matters

Every offshore conversation involving healthcare data eventually arrives at compliance. It usually starts with a request for certifications, and it usually should not stop there.

Certificates describe a moment, not a practice

An audit certificate tells you an organisation met a standard on the day it was assessed. That is worth knowing. It is not the same as knowing how protected health information is handled on an ordinary Tuesday, which is what determines whether you have an incident.

The useful questions are more specific, and any competent provider should be able to answer them without preparation.

Five questions worth asking

Who can see what, and why? Access should be role-based and minimal. If everyone on the floor can query every record, the control is decorative.

What is logged? You want to know that access is recorded, that the logs are retained, and that somebody actually reviews them rather than filing them.

What does the physical environment look like? For most PHI work this means access-controlled floors, clean-desk enforcement, and restrictions on phones and removable storage.

What happens before someone starts? Background verification, signed confidentiality terms and completed training should all precede system access — not follow it.

What happens on their last day? This is the one people forget. Deprovisioning should be immediate and verifiable. Ask how it is triggered and who confirms it.

Your right to look

The strongest signal is willingness to be inspected. A provider confident in its controls will let you audit the environment, review the training records and walk the floor. Reluctance is informative.

A note on shared responsibility

Offshore handling of PHI does not transfer your obligations. You remain accountable, which means the contractual terms, the business associate agreement and your own oversight cadence matter as much as anything your provider does. Build the review rhythm into the engagement from the start rather than adding it after an incident.