TL;DR: Two different things get sold as healthcare outsourcing. A billing or coding vendor sells you a service: you send claims, they work them, and their staff rotate across dozens of practices. Hiring your own healthcare virtual assistant through an employer of record (EOR) gives you one named person inside your practice management system who learns your payer mix, your denial patterns, and your providers. Vendors win for a backlog, a system migration, or a specialty you bill twice a year. Your own hire wins once the work is continuous, because in revenue cycle the value compounds in someone who knows your payers. On HIPAA the structure matters more than the geography: a vendor is a business associate and needs an agreement, while a person under your direct control is a member of your workforce even when they sit abroad and even when an EOR pays them. Through Shor that is $19 a month for a genuine contractor or $299 a month per employee in the Philippines or India, plus statutory employer costs.
Practices complete an average of "39 prior authorization requests per physician, per week" and their physicians and staff "spend an average of 13 hours completing those requests each week", while "40% of physicians have staff who work exclusively on prior authorizations", according to an American Medical Association survey of 1,000 physicians conducted in late 2024. That is most of a full-time job per physician, generated entirely by paperwork.
The people who would do that work are not getting cheaper or more plentiful. The Bureau of Labor Statistics puts the median annual wage for medical records specialists at $51,140 as of May 2025 and projects 8 percent employment growth from 2025 to 2035 (BLS Occupational Outlook Handbook). And the administrative layer itself is not going away: the 2025 CAQH Index found a remaining "$21 billion savings opportunity through full automation of manual and partially manual transactions", which is another way of saying $21 billion of work is still being done by hand (CAQH, 19 February 2026).
So the question this page answers is the one a practice administrator actually faces: the billing, coding, scribing, and prior-auth work has to happen, it has to cost less, and the local hiring market will not supply it. Do you buy it from a vendor, or hire your own person abroad?
What the two models actually are
They get lumped together under "outsourcing" and they are not the same purchase.
A vendor sells you a service. You hand over claims, charts, or a coding queue. Their staff, usually certified coders or billers in their own country, work it to a service level agreement at a percentage of collections, a per-claim rate, or a per-seat rate. The relationship is with the company, and the individuals doing the work are their employees, typically spread across many practices.
Your own healthcare virtual assistant is a member of your team. You recruit a specific person, they work your hours in your practice management system and your electronic health record, and they are employed for you in their country through an employer of record. They learn which of your payers deny for what, which of your providers document loosely, and the twenty percent of your claims that generate eighty percent of your rework.
The comparison that matters is not the rate. It is whether the work is continuous.
| Outsourcing vendor | Your own offshore hire | |
|---|---|---|
| What you buy | A worked queue | A person's time |
| Who employs the worker | The vendor | An EOR, on your behalf |
| HIPAA posture | Business associate, needs an agreement | Workforce member under your control |
| Best for | Backlogs, migrations, occasional specialty | Continuous, repeating revenue-cycle work |
| Institutional memory | Stays with the vendor | Accrues to your practice |
| Ramp-up | Fast, they bring trained staff | Weeks, then it compounds |
| Cost shape | Variable, often a percentage of collections | Fixed monthly |
Vendors deserve credit where it is due. If you have a six-month aged-receivables backlog, a vendor who can put eight trained AR specialists on it next week is doing something you cannot replicate with one hire, and paying a premium for elastic capacity is a rational purchase. The same is true for a specialty you bill rarely, where their coders have seen a thousand cases and yours would see four a year. A percentage-of-collections model also aligns incentives in a way a salary does not, and for a small practice with lumpy volume that can genuinely be the cheaper structure.
Which healthcare roles travel, and which do not
The roles that work offshore are documentation-based, software-based, and asynchronous or schedulable.
- Medical billing and accounts receivable. Claim submission, clearinghouse rejections, denial work queues, appeals packaging, payment posting, patient statement follow-up, credit balance cleanup.
- Medical coding. Chart abstraction and code assignment to a compliance plan your own certified coder or compliance officer owns. Practices commonly ask for a recognized credential here and audit a sample every month.
- Prior authorization and referral coordination. Gathering clinical documentation, submitting through payer portals, tracking status, chasing determinations. This is the job the AMA survey measures, and it is largely portal work.
- Medical scribing and documentation support. Real-time or asynchronous note drafting from encounter audio or clinician dictation, for the provider to review, edit, and sign. The signature and the clinical judgment never leave the provider.
- Front-office and patient access. Scheduling, eligibility and benefits verification, intake forms, records requests, referral tracking, and inbox triage by protocol.
- Credentialing and practice operations. Payer enrollment paperwork, roster maintenance, expirable tracking, CAQH profile upkeep.
What does not travel: anything that is clinical judgment, triage of a patient's symptoms, medication advice, or work requiring a US clinical license. Also, realistically, anything a payer contract or a state Medicaid agreement forbids you to send offshore, and anything your malpractice carrier or your own privacy policy rules out. Read those documents before you scope the role, not after.
The hard limit: HIPAA, and who counts as a business associate
This is the section that decides whether the arrangement is workable, and the part most "offshore healthcare staffing" pitches skip.
Start with the structure, because HIPAA cares about it more than it cares about geography. A business associate is defined as a person who, "On behalf of such covered entity or of an organized health care arrangement ... but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information" (45 CFR 160.103, Cornell Legal Information Institute). Workforce, in the same section, "means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid by the covered entity or business associate."
Read those two definitions together and the practical consequence is specific. A billing vendor is a business associate and you need a business associate agreement with it, and the same regulation extends that status down the chain: the definition also covers "A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate" (45 CFR 160.103(3)(iii)). Your own assistant, working under your direct control in your systems, is a member of your workforce instead, and the definition says so "whether or not they are paid by" you. That last clause is the one that matters when an employer of record is the legal employer and issues the payslip.
Three things follow, and none of them is optional.
- Workforce status is not a loophole, it is a set of duties. Members of your workforce fall under your Security Rule obligations, your training requirements, your sanction policy, and your minimum-necessary access controls. A person abroad with an EHR login is exactly as much your responsibility as the person at your front desk, and more of your controls have to be technical because none of them can be physical.
- HIPAA does not restrict where a workforce member sits, but your contracts might. Payer agreements routinely do. In Medicare Advantage and Part D, offshore subcontracting is reportable: one plan sponsor's published compliance requirements state that "CMS requires Plan Sponsors to provide attestation to CMS for Medicare programs within 30 calendar days after an offshore contract is signed" and that vendors must "conduct annual audits of offshore subcontractors and make audit results available upon request" (Navitus, offshore subcontractor requirements). Commercial payer agreements and state Medicaid contracts carry their own terms, and some restrict offshore access to beneficiary data outright. Read your payer contracts and your state's Medicaid requirements before you scope the role.
- Access control is the whole ball game. Named individual logins, never shared credentials. Role-based access scoped to the minimum necessary. Multi-factor authentication. No local storage or download of protected health information, which usually means working inside a virtual desktop rather than on a personal laptop. Audit logging you actually read. A documented offboarding runbook that kills access the same day.
None of this is legal advice on your situation. HIPAA obligations, payer contract terms, and state requirements all differ and change; confirm the position for your practice with your privacy officer and your own counsel before anyone abroad touches a chart.
Contractor or employee?
This is where practices get exposed, because "healthcare virtual assistant" is almost always sold with the word contractor attached.
The classification test in the worker's own country looks at how the work happens, not what the agreement says. A biller who works your hours, in your practice management system, on the queues you assign each day, reporting to your practice manager, with your practice as effectively their only client, is an employee under Philippine law and under Indian law regardless of the contract's title. Calling that person a contractor saves the statutory contributions right up until a labor authority decides otherwise and bills you for back contributions and severance.
A genuine contractor exists too: the freelance coder who takes discrete audit projects from several practices, on her own schedule, with her own credentials and tools, invoiced per engagement. That is real independent work and can be paid as such, with a proper contract, a W-8BEN on file, and invoices that match payments.
If the person will be full-time and yours, employ them. It is also the cleaner HIPAA posture, for the reason above: direct control is what makes someone a workforce member rather than a business associate, and an arrangement you have deliberately structured as arm's length undercuts the argument that you control them. An employer of record is the legal employer in their country, runs local payroll and statutory contributions, issues a compliant local employment agreement, and handles termination under local law, while you direct the work. If you already have an offshore "contractor" doing employee-shaped revenue-cycle work, converting a contractor to an employee is a defined process rather than an emergency.
Where practices hire them
Two markets cover most healthcare administrative hiring.
The Philippines is the default, and it is the deepest market for scribing and front-office work. English is the working language of business, the country has a large pool of nursing and allied-health graduates who understand clinical vocabulary, and US-hours schedules are an established norm in Philippine offices rather than an imposition, which matters when the job is real-time scribing or answering a phone. Employer statutory contributions run roughly 10 to 15 percent of salary (Social Security System 10%, PhilHealth 2.5%, Pag-IBIG 2%), a mandatory 13th month is paid by 24 December, the standard week is 40 hours over five days, and notice is 30 days. Salary must be paid in Philippine pesos. Security of tenure is strong and termination requires documented cause and due process, so plan probation and performance management properly at the start. Our Philippines guide has the full statutory table.
India is the deeper bench for coding and analytics, and the home of most of the established medical-coding industry, so the talent pool understands credentialing and audit. Employer contributions run roughly 20 to 25 percent (Provident Fund 12%, State Insurance 3.25%, gratuity provision 4.81%), there is no mandatory 13th month, and the statutory week is longer at 48 hours over six days, which is worth aligning to your own schedule in the offer. Salary must be paid in rupees. Night-shift coverage for US hours is normal and usually carries a differential. See the India guide.
The employer cost league table compares every market we publish data for. Statutory rates change and depend on salary bands, so confirm the specifics with your accountant.
What it actually costs
Take a medical biller in Manila at $1,500 a month. Your number depends on experience, credentials, and the market that week; this is the shape of the math, not a quoted rate.
As an employee through an EOR: $1,500 gross, plus roughly 10 to 15 percent statutory employer contributions ($150 to $225), plus one twelfth of a 13th month accrued ($125), plus $299 for the EOR. All in, roughly $2,074 to $2,149 a month, with a legal employer, statutory benefits, and severance exposure handled in the Philippines.
The same hire in India: $1,500 gross, plus roughly 20 to 25 percent employer contributions ($300 to $375), no 13th month, plus $299. All in, roughly $2,099 to $2,174 a month.
The US comparison: the median medical records specialist's $51,140 salary is about $4,262 a month before employer payroll taxes and benefits (BLS). That gap is why the practice spread. It is also why the seniority question matters: the offshore biller works the queue, and a credentialed coder or compliance officer of yours still owns the coding policy and the audit.
As a genuine contractor: $1,500 to them, $19 to us, and a flat disclosed 2 percent only if and when they convert dollars to pesos. That is the right answer only when the relationship is genuinely independent, as described above.
Against a percentage-of-collections vendor, the honest comparison is not the monthly figure. It is your volume. A vendor at, say, a single-digit percentage of collections costs you nothing in a slow month and scales with you in a busy one, and your own employee costs the same in August as in October. Run the calculation on your own last twelve months of collections rather than on a brochure, and include the cost of the work you would still do in house either way: the coding policy, the audits, the payer escalations, and the supervision.
What it costs through Shor
$19 per month per contractor, including the contract, W-8BEN collection, and invoicing. $299 per month per EOR employee in the Philippines and India, plus each country's statutory employer costs and benefits. A flat 2 percent FX margin, disclosed on the receipt, charged only when money actually converts. Month to month, with no setup fee. Where a country requires a deposit for EOR employment, it is country-dependent and quoted up front before you sign. Payouts land same day on local rails in India and the Philippines. The pricing calculator will price your specific country and headcount, and the employer cost calculator will break a Philippine salary into its statutory lines.
Shor is a payroll and employment platform, not a HIPAA compliance product. We employ the person and run their payroll; the access controls, the training, the audit logging, and the payer-contract review stay with you and your privacy officer. Employment, tax, and privacy rules change, and the statutory figures above are approximate ranges. Confirm your specific situation with your accountant and your own counsel.
FAQ
Is it HIPAA compliant to hire a medical biller or scribe overseas?
HIPAA does not prohibit a workforce member from working outside the United States. What matters is structure and controls. Under 45 CFR 160.103 a person whose work is under your direct control is a member of your workforce rather than a business associate, "whether or not they are paid by" you, which covers someone employed for you through an employer of record. Your Security Rule obligations, training, minimum-necessary access, and sanction policy all still apply. Separately, payer contracts can restrict offshore access even where HIPAA does not, so check them first.
Do I need a business associate agreement for my offshore virtual assistant?
If you engage a vendor or staffing company, yes: it is a business associate and so is every subcontractor of theirs that touches protected health information. If you employ the person yourself through an employer of record and direct their work, they are a workforce member rather than a business associate, so the instrument is your own employment agreement, access controls, and training rather than a business associate agreement. Confirm the analysis for your arrangement with your privacy officer.
Should I outsource medical billing or hire my own offshore biller?
Use a vendor for a backlog, a system migration, a specialty you bill rarely, or volume that swings hard month to month, where you are buying trained capacity you can turn off. Hire your own person once the work is continuous, because the value compounds in someone who knows your payer mix and your denial patterns, and a vendor's rotating staff cannot build that for you. Plenty of practices run both, with a vendor on aged receivables and their own hire on daily claims.
How much does a healthcare virtual assistant in the Philippines cost?
It depends on the salary you agree. On a $1,500 a month salary, the all-in employee cost through Shor is roughly $2,070 to $2,150 a month once statutory contributions of 10 to 15 percent, the accrued 13th month, and the $299 EOR fee are included. For comparison, the US median wage for a medical records specialist is $51,140 a year, about $4,262 a month before employer taxes and benefits.