Healthcare practice bookkeeping carries an obligation most other client industries never trigger: HIPAA. A CPA firm doing the books for a medical practice is, in nearly every real scenario, a business associate under HIPAA the moment that bookkeeping work touches anything identifying a patient. At BusAcTa Advisors, we run offshore bookkeeping workflows for CPA firms serving healthcare clients, and the firms that get this right treat HIPAA as a structural requirement built into the workflow from day one, not a checkbox added after the engagement starts.
This is general information, not legal advice. HIPAA compliance determinations depend on the specific facts of an engagement. Consult qualified legal counsel to confirm your firm's HIPAA obligations and to draft or review any business associate agreement before handling protected health information.
Why Healthcare Practice Bookkeeping Triggers HIPAA in the First Place
Answer first: a CPA firm becomes a HIPAA business associate the moment its accounting work for a healthcare provider involves access to protected health information, and routine bookkeeping for a medical practice crosses that line far more often than most firms expect.
The Department of Health and Human Services specifically names a CPA firm whose accounting services to a healthcare provider involve access to protected health information as an example of a HIPAA business associate. Bookkeeping for a medical practice frequently involves exactly this kind of access, since billing records, accounts receivable aging by patient, insurance reimbursement detail, and even general ledger entries tied to specific patient encounters can all qualify as protected health information once they identify a patient and connect that patient to treatment or payment.
A general tax return for a retail business does not trigger HIPAA, since there is no protected health information involved. A healthcare practice's books, by contrast, are built almost entirely around patient-linked billing and payment data, which is exactly the kind of information the rule is designed to protect.
The Business Associate Agreement Is Not Optional
Once a CPA firm is functioning as a business associate, a signed business associate agreement with the healthcare provider is a legal requirement before any protected health information changes hands, not a best practice or an optional layer of protection. The agreement has to specify the permitted uses and disclosures of the information, require the business associate to implement appropriate safeguards, including the safeguards required under the HIPAA Security Rule, and set out breach notification responsibilities if something goes wrong.
A vendor holding a security certification is not the same thing as having a business associate agreement in place. The certification can support your safeguards. It does not replace the legal requirement for the agreement itself.
This requirement does not stop at the CPA firm. Under HIPAA, a subcontractor of a business associate is itself treated as a business associate. If your firm uses a dedicated offshore bookkeeper to handle a healthcare client's books, that offshore bookkeeper is a subcontractor business associate, and your firm needs its own business associate agreement in place with that bookkeeper before any protected health information is shared with them.
Offshore Business Associates Are Permitted, With One Practical Safeguard
Why does offshore bookkeeping for a healthcare client raise more questions than domestic outsourcing? Mostly because firms assume, incorrectly, that HIPAA simply does not allow it. It does.
Offshore business associates are permitted under HIPAA, and the law applies to them the same way it applies to a business associate located inside the United States. The practical safeguard worth building into the agreement is having the offshore party agree to the jurisdiction of U.S. courts as part of the business associate agreement, since that gives the covered entity and the CPA firm a real legal mechanism if something goes wrong, rather than relying solely on protections in a country whose courts may not enforce a U.S. agreement the same way.
Offshore bookkeeping for healthcare clients is workable. It just requires the same legal groundwork, plus this one additional jurisdiction provision, that any business associate relationship requires.
Building the Workflow Around the Required Safeguards
Beyond the agreement itself, a few specific practices come up consistently in how accountants are expected to handle protected health information day to day.
Minimum necessary access. Staff should access only the protected health information actually needed for the specific bookkeeping task at hand, not broader patient records than the work requires.
Role-based access controls. Different team members should have access scoped to their actual role, rather than every preparer having open access to the full client file.
Segregation of duties. Separating tasks so no single person has unchecked control over a process involving protected health information reduces risk and supports good internal control generally.
Encryption in transit and at rest. Any system handling protected health information needs to encrypt that data both while it moves and while it sits in storage.
Defined retention and secure disposal. Protected health information should not be kept longer than the engagement requires, and disposal needs to be secure, not simply deleted from a visible folder.
Scoping What Actually Counts as Protected Health Information in the Books
A practical first step for any firm taking on a healthcare bookkeeping client is scoping exactly which parts of the engagement actually touch protected health information, since not every task does to the same degree.
Bookkeeping task | Typically involves PHI? |
|---|---|
Accounts receivable aging by patient name | Yes |
Insurance reimbursement reconciliation tied to specific claims | Yes |
General payroll and vendor accounts payable for the practice | Generally no, unless tied to a specific patient encounter |
High-level financial statements with no patient-level detail | Generally no |
Bank reconciliation where deposits reference patient names or claim numbers | Yes |
Scoping this clearly at the start of the engagement lets a firm design the workflow so that protected health information flows through a controlled, agreement-covered process, while the parts of the engagement that do not touch patient-level detail can move through a simpler workflow.
Conclusion and Next Steps
Healthcare practice bookkeeping puts a CPA firm in the position of a HIPAA business associate far more often than firms expect, and that status carries a real legal requirement for a signed business associate agreement before any protected health information changes hands. Offshore bookkeeping support is genuinely permitted under HIPAA, but it requires the same agreement, extended down to the offshore party as a subcontractor business associate, with U.S. court jurisdiction built into the agreement as a practical safeguard. Firms that scope which parts of a healthcare engagement actually touch protected health information, and build minimum necessary access and role-based controls around that scope, are the ones that keep this manageable rather than treating every healthcare client file as an undifferentiated compliance risk.
If your firm serves healthcare practice clients and needs support structuring a compliant offshore bookkeeping workflow, talk to BusAcTa Advisors about how a dedicated team can support your healthcare client engagements, we can show you how this typically works alongside the business associate agreements your firm already has in place. You can also learn more on our healthcare industry page or our bookkeeping services page.
FAQ
Frequently Asked Questions
Verified
Sources
- The Department of Health and Human Services lists a CPA firm whose accounting services to a healthcare provider involve access to protected health information as an example of a HIPAA business associate. Business Associates (U.S. Department of Health and Human Services · 2026)
- A written business associate contract is legally required between a covered entity and a business associate, must establish permitted uses and disclosures of protected health information, require appropriate safeguards including HIPAA Security Rule requirements, and address breach notification. Business Associate Contracts (U.S. Department of Health and Human Services · 2017)
- Offshore business associates are permitted under HIPAA and the law applies to them the same way it applies to business associates located in the United States, with covered entities advised to require the offshore business associate to agree to the jurisdiction of U.S. courts in the business associate agreement. Business Associates 101 (The HIPAA E-Tool · 2024)
Put these insights to work in your firm.
Book a 30-minute consultation. A CPA, not a salesperson, will walk through your workflow.
Written by
Ricky Patel, CPACo-Founder, Growth & Quality Assurance
Ricky Patel, CPA, CA, leads client growth and quality assurance at BusAcTa. With 10+ years in U.S. auditing and accounting, he structures offshore engagements that fit the client firm's actual workflow and holds delivery to the same senior-reviewer standard throughout. His dual CPA (U.S.) and CA (India) credentials give him technical fluency on both sides of every engagement.
