1. We are a HIPAA Business Associate
When PRISCO MedCode Solutions Pvt Ltd codes, audits, bills or follows up claims for a US covered entity, we create, receive, maintain or transmit PHI on its behalf. That makes us a Business Associate under HIPAA (45 CFR Parts 160 and 164). We operate as HIPAA Compliant, and we put that in writing through the BAA.
2. Why HIPAA applies to us even though we are offshore
HIPAA attaches to the function a Business Associate performs, not to where its office is. Since the HITECH Act and the 2013 Omnibus Rule, Business Associates and their subcontractors are directly responsible for the HIPAA Security Rule, for permitted uses and disclosures of PHI, and for breach notification. Our location in India does not change those duties, and we do not treat it as a reason to do less.
3. What the BAA commits us to
Our BAA, or your own template if you prefer, covers each element required by 45 CFR 164.504(e):
- Permitted use only. PHI is used only for the services in your contract and as the BAA allows, never for our own purposes.
- Safeguards. Administrative, physical and technical safeguards that meet the Security Rule (see section 5).
- Incident and breach reporting. We report security incidents and breaches of unsecured PHI to you without unreasonable delay, within the timeline set in the BAA and never later than HIPAA allows.
- Subcontractors. Any subcontractor that touches PHI signs a BAA with the same restrictions, before access.
- Access and amendment. We support your obligations to individuals for access, amendment and accounting of disclosures.
- Books and records. We make our practices, books and records available to the US Department of Health and Human Services (HHS) for compliance review.
- Return or destruction. At the end of the agreement PHI is returned or destroyed as the BAA states, with a record.
- Termination. You may terminate if we materially breach the BAA.
4. How the BAA works with a foreign entity
Because we are an Indian company, we agree to the contract terms US providers need in order to hold us to account. On request we will agree in the BAA to:
- the governing law and venue you choose, including a US state;
- audit and inspection rights for you or your compliance team;
- limits on where and how PHI may be accessed, as set by you;
- notice and cooperation obligations if a regulator or court asks about your PHI.
5. How PHI is protected in delivery
- Work happens in your environment. Coders work inside your EHR or billing system over a secure connection, with multi-factor sign-in, so PHI stays on your systems.
- Minimum necessary. Unique logins and role-based access; staff see only what their role needs.
- Controlled facilities. Biometric entry, clear desk, no personal phones or storage at workstations.
- Device and media controls. External printing and removable or recording media are disabled on work systems.
- Encryption and logging. Encrypted transfer, activity logs and audit trails.
- People. HIPAA training and confidentiality agreements for all staff, with consequences for breaches.
- Secure disposal. PHI is returned or destroyed as the BAA states.
6. Security frameworks: SOC 2 Type II and ISO 27001 readiness
Our delivery centers are aligned to the control areas of SOC 2 Type II and ISO 27001. Our readiness work is ongoing. We will share our current status and any attestation on request, and we do not describe ourselves as certified or attested until an independent audit says so.
7. How to start
- Tell us about your needs. Use the provider form on our contact section.
- Review and sign the BAA. We send ours, or sign yours.
- Set up access. Accounts, permissions and secure connection under your policies.
- Pilot batch. Judge our turnaround and accuracy first-hand before you scale.
Contact: info@priscomedcodesolutions.com
Last updated: October 22, 2026. This page describes our practices and is not legal advice. The signed BAA is the controlling document.