# State Rules That Restrict Healthcare Offshoring: Florida SB 264, Texas Medicaid and Others

> While federal HIPAA rules allow offshore business associates under a BAA, a growing number of state laws and Medicaid managed care contracts limit storing or moving patient health information outside the United States. We look at Florida's SB 264, Texas Medicaid contract terms, the browser-caching problem, and how stateside virtual desktops help practices keep data in the US.

**Category:** State Regulatory Compliance & Healthcare Law | **Published:** October 10, 2026 | **Author:** Call Center Options Regulatory Advisory

## The Dangerous Illusion: "If HIPAA Permits It, We Are Safe"

For decades, healthcare administrative executives operated under a simple assumption: as long as an offshore staffing agency signed a standard HIPAA Business Associate Agreement (BAA), overseas operations were fully legal. Under federal law, the Health Insurance Portability and Accountability Act (HIPAA) does not expressly mandate data localization or forbid offshore subcontractors.

However, HIPAA is not the only rule that matters. A growing patchwork of state statutes, executive orders, and Medicaid managed care contracts adds data-location requirements on top of HIPAA. Breaking them can affect Medicaid contracts and, in Florida, a facility's license.

## Florida: One of the Strictest EHR Data-Location Laws (SB 264 / § 408.051)

The best-known state rule is the Florida Electronic Health Records Exchange Act (Fla. Stat. § 408.051, as amended by Senate Bill 264). Since July 1, 2023, it has required health care providers that use certified electronic health record technology to keep offsite patient data in the United States, its territories, or Canada.

Under Section 408.051(3), a health care provider that uses certified electronic health record technology must ensure that patient information stored in an offsite physical or virtual environment, including through a third party, a subcontracted computing facility, or a cloud service, is physically maintained in the continental United States, its territories, or Canada.

Crucially, Florida backed this requirement with strict licensure enforcement: affected hospitals, ambulatory surgery centers, clinics, diagnostic centers, and licensed practitioners must formally attest to compliance under penalty of perjury upon initial licensing and at every subsequent license renewal. Submitting a false attestation or utilizing an offshore vendor that violates the localization standard places the clinical facility’s operating license in direct jeopardy.

## The Overlooked States: Texas, Arizona, Ohio, and Beyond

Florida's statute applies to providers using certified EHR technology. Other states limit offshoring mainly through Medicaid contracts and executive orders that apply to state contractors:

• Texas (HHSC Uniform Managed Care Terms and Conditions): Medicaid managed care organizations and their subcontractors may not perform contract work or move confidential information outside the United States, or allow access to it from abroad. If your clinic contracts with Texas Medicaid plans, check what your agreements pass down to you.

• Arizona (AHCCCS minimum subcontract provisions): contracted work involving secure or sensitive data or member data must be performed within the United States, with limited exceptions, and the rule reaches subcontractors at every tier.

• Ohio (Executive Order 2019-12D): state contracts, including Ohio Department of Medicaid contracts, bar contractors from performing services outside the United States or keeping state data abroad without a signed waiver.

• Other states: several state Medicaid programs and agencies include similar offshore limits in their contracts. Ask your plans and state agencies what applies to you.

• Missouri (Executive Order 04-09, 2004): requires vendors bidding on state contracts to certify where the work will be performed, and treats an unapproved move offshore as a breach. Check whether it applies to your contract.

## The Hidden Compliance Pitfall: The "Viewing vs. Storing" Browser Caching Trap

When healthcare administrators evaluate offshore staffing agencies, sales representatives frequently claim: "We do not store your data offshore; our remote staff simply log into your web-based EHR (Epic, AthenaHealth, eClinicalWorks, or Cerner) via a standard web browser."

That claim leaves out how browsers work. Modern web browsers cache data locally. When an offshore worker opens an EHR on a laptop overseas, patient demographics, PDF lab reports, scans, session tokens, and page data can be written to that machine's hard drive (in temporary download folders and browser storage).

If an offshore agency gives workers local PCs or a plain VPN connection, copies of patient health information can end up stored on computers abroad, which can conflict with Florida § 408.051 for providers using certified EHR technology and with Medicaid contracts that bar offshore storage.

## The Architectural Remedy: How Redundant Stateside Virtual Desktops Solve State Localization

To help practices in Florida, Texas, and Medicaid programs, Call Center Options keeps patient data on US servers.

Our dedicated clinical front desk specialists operate exclusively through redundant stateside virtual desktops provisioned in domestic US data centers. Client EHR systems, payer portals, and VoIP dialers execute solely within the US cloud perimeter.

Using encrypted pixel streaming (AES-256), only the screen image is sent to staff monitors at our Pristina branch. Local storage, USB drives, and clipboard transfers are disabled through group policy, so patient Protected Health Information (PHI) is not stored on, downloaded to, or cached on computers outside the United States. That supports practices' obligations under Florida SB 264 and similar state and Medicaid rules.

## Sources & Citations

- **Florida Legislature / Fla. Stat. § 408.051** (Florida Electronic Health Records Exchange Act (Senate Bill 264)): "Providers using certified EHR technology must keep offsite patient data in the continental United States, its territories, or Canada; AHCA licensees attest to this under penalty of perjury (§ 408.810(14))."
- **Texas Health and Human Services Commission (HHSC)** (Uniform Managed Care Terms and Conditions (Attachment A)): "Medicaid MCOs and their subcontractors may not perform contract work or move confidential information outside the United States, or allow access to it from abroad (section numbers vary by contract version)."
- **Arizona Health Care Cost Containment System (AHCCCS)** (Minimum Subcontract Provisions): "Contracted work involving secure or sensitive data or member data must be performed within the United States, with limited exceptions; applies to subcontractors at every tier."
- **State of Ohio Executive Order 2019-12D** (Banning the Expenditure of Public Funds for Offshore Services): "State contractors, including Ohio Department of Medicaid contractors, may not perform services outside the United States or keep state data abroad without a signed waiver."