Medicaid offshore restrictions by state: the federal payment ban, state contract rules, and Medicare Advantage
Overview
Federal law bars Medicaid from paying any bank or entity outside the United States for covered services (Social Security Act 1902(a)(80)), but it does not ban offshore administrative work. Where work and data may sit is set by state contracts and statutes, such as Texas, Arizona, Tennessee, Mississippi and New Jersey, and by the offshore attestation Medicare Advantage plans collect.
On this page
What does the federal Medicaid offshore rule bar?
It bars payments to anyone outside the United States for covered services. Section 6505 of the Affordable Care Act added paragraph (a)(80) to Social Security Act section 1902(a), which requires a state Medicaid plan to provide that the state will not pay for items or services under the plan or a waiver “to any financial institution or entity located outside of the United States.” The rule took effect January 1, 2011, and CMS said its audits would cover claims submitted on or after June 1, 2011.
CMS spelled out what that means in State Medicaid Director letter SMD #10-026 on December 30, 2010. Provider bank accounts and business agents outside the country are examples of prohibited payees, along with telemedicine providers and pharmacies. A state has to deny claims that direct payment to such an entity, and recover anything it already paid, returning the federal share to CMS. For this rule the United States includes Puerto Rico, the Virgin Islands, Guam, the Northern Mariana Islands and American Samoa.
For a NEMT company the practical points are short. The account that Medicaid pays into must be at a bank located in the United States or one of those territories. A billing agent or other business agent that receives payments for you must be inside the country too. Plan and broker agreements can repeat the rule, as the Tennessee language below does. A related paragraph, 1902(a)(79), requires any agent, clearinghouse or other alternate payee that submits claims for a provider to register with the state and the Secretary. How to bill Medicaid for NEMT covers the billing side.
Health plans get a second rule. Under 42 CFR 438.602(i) a state must make sure the plan it contracts with is not located outside the United States, and claims the plan pays to an outside provider, subcontractor or bank cannot count when the state sets its capitation rates. That paragraph is not on the list of provisions that apply to a stand-alone NEMT plan (42 CFR 438.9), so for a stand-alone NEMT broker the state’s own contract is where an offshore rule would appear.
Is offshore work banned?
Not by federal law. CMS’s letter says that tasks supporting the administration of the state plan are not covered by the payment statute, and it names outsourced information processing and outsourced call centers for enrollment or claims as examples. The HHS Inspector General’s 2014 report agreed that no federal regulation prohibits offshore outsourcing of Medicaid administrative functions. HIPAA does not fill the gap either: neither part 160 nor part 164 of the HIPAA regulations contains a rule about the country where information may be handled.
The Inspector General looked at what states did instead. It surveyed all 56 Medicaid agencies, with data through June 2013, and found that 15 had any state-specific requirement on offshore outsourcing. Four of them prohibited it, three through executive orders and one through contract provisions. Eleven allowed it, nine with few limits and two only in limited circumstances. The other 41 had no requirement and reported no offshore outsourcing. The report did not say which four states prohibit it, and it is a 2013 snapshot. It also warned that sending protected health information abroad may leave a state or contractor with limited means of enforcing a business associate agreement.
Which states restrict offshore work?
Six states below have rules in documents that are public today, and the layer each one reaches differs. The grid names the document each rule sits in and what it bars. It is a set of examples, not a complete list of states.
| State | Where the rule sits | What it bars |
|---|---|---|
| Texas | HHSC Managed Care Uniform Terms, v1.5, section 4.10 | Work, stored data and remote access from outside the US, for plans and their subcontractors and vendors |
| Arizona | AHCCCS Minimum Subcontract Provisions, section 27, effective October 1, 2024 | Work involving secure, sensitive or client data outside US borders; provider agreements count as subcontracts |
| Tennessee | TennCare required provider agreement language, clause 3.41, form 10.25 | Covered services outside the US, payments abroad, and sending member data abroad without the plan’s written consent |
| Mississippi | Division of Medicaid business associate agreement, Attachment H, section III(n) | Handling health information with any third party or subcontractor beyond US boundaries without the Division’s written approval |
| New Jersey | N.J.S.A. 52:34-13.2 (P.L. 2005, c. 92) | Services under state contracts and subcontracts performed outside the US, unless a certified exception applies |
| Oklahoma | OAC 317:55-1-5(b)(2), issued September 1, 2024 | Managed care entities subcontracting duties to be transmitted or performed outside the US |
How each rule reaches a transportation company depends on where it sits.
- Texas and Oklahoma. Texas binds health plans and the subcontractors, vendors, agents and service providers beneath them. Oklahoma bars plans from signing subcontracts that move work abroad. Texas health plans arrange members’ rides through brokers, as how Texas runs Medicaid NEMT explains, so expect a broker to pass the clause down in its provider agreement. Texas also bars remote access from abroad, and a violation is a material breach that can end the plan’s contract.
- Arizona and Tennessee. These reach providers directly. Arizona defines a subcontract to include any provider participation agreement with AHCCCS. TennCare’s required language is written into provider agreements themselves.
- Mississippi. The agreement binds the contractor that handles the Division of Medicaid’s health information and extends to the contractor’s subcontractors.
- New Jersey. The statute governs the state’s own service contracts and the subcontracts under them.
Because the sources differ in kind and date, treat a row as a pointer to the clause to look for. The binding text is in your own broker, plan or state agreement, in its current version.
Can an overseas dispatcher or biller handle rider data?
Only if every agreement above you allows it, and the answer sits in your contracts, not in HIPAA. HIPAA has no country rule and asks for a business associate agreement with an outside vendor, but every clause above can shut that door, and some brokers collect a written promise. Modivcare’s transportation provider attestation has the company certify that it does no offshore operations involving protected health information, and it lets Modivcare produce the form to state agency and managed care clients to show compliance with laws and contract terms. Outsourcing NEMT dispatch and remote NEMT dispatch cover that attestation and the home-office rules.
What is the Medicare Advantage offshore attestation?
It is the form a Medicare Advantage plan collects when a vendor uses workers outside the United States who handle members’ health information. CMS’s readiness checklists for Medicare Advantage organizations and Part D sponsors tell them to submit the offshore subcontractor’s information and an attestation through CMS’s plan management system within 30 calendar days of signing an offshore contract (2012 checklist) and to keep that record current (2018 checklist). The 2018 checklist defines an offshore subcontractor as a first tier, downstream or related entity located outside the 50 states, the District of Columbia and the territories.
Plans publish their own forms. Fallon Health’s October 2025 version is an example. It says CMS counts services done by workers located in offshore countries, whether they work for American-owned or foreign-owned companies, and its examples of offshore countries include Canada and Mexico. It asks for the subcontractor’s name, country and functions, a description of the health information it will receive and why it is necessary, the alternatives considered, four attestations about safeguards, and three about an annual audit whose results can be shared with CMS. The duty to report belongs to the plan. It can reach a ride company through the plan’s or broker’s contract, as a request to confirm whether it uses offshore workers. Medicare Advantage and NEMT explains how those rides work.
What should a company check before giving anyone outside the country a login?
Check four things before the first login, and keep the answers in writing.
- Search your agreements. Look in the broker or plan agreement, its manual and any attestation for “offshore,” “outside the United States,” “beyond the boundaries” and “remote access.”
- Ask the broker. Put the question in an email: may a named person, in a named country, open trips and rider details? Keep the reply with the contract.
- Check where payments land. The bank and any billing agent that receive Medicaid payments must be in the United States or its territories, and a broker agreement may say the same.
- Cover travel. A dispatcher who logs in from a hotel abroad is doing remote work from outside the country, which Texas’s clause names specifically.
A written approval from the party whose clause applies is the only safe permission. HIPAA’s business associate agreement is not a substitute for it.
Controlling who can open rider details in HealthRide
In the provider portal, what each person can open follows their role. That keeps the question of who may see trips and rider details in your hands, and gives you a ready answer when a broker asks.
Frequently asked questions
- What does the federal Medicaid offshore rule actually ban?
- It bans payments, not work. Section 1902(a)(80) of the Social Security Act says a state may not pay for items or services under its plan or a waiver to any financial institution or entity located outside the United States. CMS's 2010 letter to state Medicaid directors lists provider bank accounts and business agents as examples, and says a state must recover payments made to such entities.
- Is offshore administrative work banned under federal Medicaid law?
- No. CMS's December 30, 2010 letter says tasks that support running the state plan, such as outsourcing information processing or call centers for enrollment or claims, are not prohibited by the payment statute. HHS's Inspector General wrote in 2014 that no federal regulation prohibits offshore outsourcing of Medicaid administrative functions. State contracts and statutes fill the gap.
- Which states ban offshore work on Medicaid contracts?
- No complete list is published. In a 2014 report on a survey with data through June 2013, the Inspector General found that only 15 of 56 Medicaid agencies had any rule on the subject, and four prohibited offshore outsourcing of administrative functions. It did not name the four. Texas, Arizona, Tennessee, Mississippi, New Jersey and Oklahoma are current, documented examples, and the clause that binds your company is the one in your own agreement.
- Do Puerto Rico, Guam and the other territories count as outside the United States?
- Not for the federal payment rule. CMS's letter defines the United States to include the states, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, the Northern Mariana Islands and American Samoa for this purpose. A state or plan contract can define the term more narrowly, and Texas's, for example, lists the 48 contiguous states, Alaska, Hawaii and the District of Columbia.
- Can a billing company or dispatcher outside the United States handle my broker trips?
- Only if every agreement above you allows it, and many do not. HIPAA has no country rule and allows a business associate agreement to cover it, but state contract terms and broker attestations often forbid handling rider data abroad. Payments are a separate issue: a business agent or bank account outside the United States is exactly what the federal payment ban names. Get the answer in writing before anyone logs in.
- What is the Medicare Advantage offshore subcontractor attestation?
- It is a form that a Medicare Advantage plan collects from a vendor that uses workers outside the United States who handle members' health information. CMS directs the plan to report each offshore subcontractor and file an attestation within 30 days of signing the contract. Plans publish their own versions, which ask for the country, the information involved, why it is needed, and the safeguards and audits in place.
