HIPAA does not ask where you are. It asks what you do with the data.

It can, and for many Indian IT, BPO and health-tech vendors it does. HIPAA’s definition of a business associate covers anyone who creates, receives, maintains or transmits protected health information on behalf of a covered entity, and any subcontractor doing the same for a business associate. The definition says nothing about nationality or location. In practice the obligations reach an Indian vendor through its client’s business associate agreement, which is also how the client enforces them — including by terminating the contract. See our HIPAA page for how we approach it.

No. Neither HHS nor its Office for Civil Rights certifies, accredits or approves organisations under HIPAA, and no third party can issue a certificate with legal standing — in India or anywhere else. Courses and assessments sold as “HIPAA certification” produce a training record or a self-assessment. What US clients rely on is evidence: a current risk analysis, operating safeguards, a signed business associate agreement and a tested breach process. Some also accept an independent attestation such as a SOC 2 report as part of that evidence.

The regulation sets minimum terms. Among them, the agreement must limit how you use and disclose the information, commit you to appropriate safeguards and to the Security Rule, require you to report security incidents and breaches to the client, flow the same restrictions down to your subcontractors, require return or destruction of the information at the end where feasible, and let the covered entity terminate if you breach a material term. Clients usually add shorter notice periods, audit rights and indemnities. Read those additions carefully: they are commercial terms, and they bind you more tightly than the rule does.

Under 45 CFR 164.410, a business associate must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovering it, identifying affected individuals where possible. Sixty days is the outer limit, not a target, and most business associate agreements set a shorter period that binds you contractually. Separately, an Indian company must report listed cyber incidents to CERT-In within six hours. Build your process around the shortest of these clocks.

Yes, if they create, receive, maintain or transmit the protected health information for you. A business associate may let a subcontractor handle the information only with satisfactory written assurances, recorded in an agreement that meets the same requirements as yours. That covers cloud hosting, managed-support vendors, offshore partners and freelancers with access. Ask each provider for its business associate agreement before PHI goes onto its service, and do not assume a standard one exists. Keep an inventory of every subcontractor that touches the information and the status of its agreement — clients ask for it.

No. HHS published a proposed rule in January 2025 that would, among other things, end the distinction between required and addressable safeguards, require encryption of electronic PHI at rest and in transit, and require multi-factor authentication. The federal regulatory agenda moved its target for final action from May 2026 to July 2027, and as of our review no final rule has been published. The current rule is the one enforced. Many of the proposed controls are sensible regardless, and US clients already ask for MFA and encryption.

Partly. Section 17(1)(d) of the DPDP Act exempts most of its duties where personal data of people outside India is processed in India under a contract with someone outside India. But the exemption keeps section 8(1) and section 8(5) — and section 8(5) is the duty to take reasonable security safeguards to prevent a personal data breach, which carries the Act’s highest maximum penalty. So the security work you do for HIPAA also has to satisfy Indian law, from the dates in our DPDP deadlines tracker.

With two documents. First, a written list of every client that sends you protected health information, what you do with it, and whether you are a business associate or a subcontractor in each case — with the agreement status next to it. Second, a risk analysis of the systems that hold that information. Those are what a knowledgeable client checks first, and every other safeguard decision follows from them. Then close the agreement gaps with your own subcontractors before building the technical controls the risk analysis prioritises.