This question arrives on every healthcare project with a remote team, and it is usually framed as a geography question. It is not.
This is operational guidance from deployments, not legal advice. Requirements vary by organisation and contract, and anything with regulatory exposure belongs with counsel who knows your jurisdiction.
What the rule actually cares about
Agreements and safeguards. Who is accountable, what protections exist, who can see what, and whether you can prove it afterwards.
A team in another country with a signed agreement, encrypted access, role based permissions and full logging is in a stronger position than a team down the hall with shared credentials and no audit trail.
The five things to have in place
1. A business associate agreement, signed before any access. Granting access first and papering it afterwards is the most common and most avoidable error in this area.
2. Documented safeguards. Encryption in transit and at rest, access control, logging, device and network requirements. Written down, not assumed.
3. Minimum necessary access. Each person sees only what their task requires. This is both a requirement and the single most effective practical control.
4. An audit trail. Who accessed what, when. If you cannot reconstruct access six months later, you cannot demonstrate anything.
5. A breach notification path that works across time zones. Who is called, by whom, within what window. Test it rather than document it and hope.
The question to ask before any of that
Does this work need real data?
A large share of integration and automation work can be built against de-identified or synthetic records. The engineer still does the job and the exposure mostly disappears.
Asking this at design time is far cheaper than negotiating access later, and it frequently makes the whole discussion unnecessary.
What to ask a provider
- Will you sign a business associate agreement, and who is the signing entity?
- Where is data accessed from, and on what devices?
- How is access granted and revoked, and how fast?
- Can you show an audit log of access?
- What happens on the day someone leaves your company?
That last one is the most revealing, because offboarding is where access quietly survives.
Organisational policy versus the rule
Some healthcare organisations adopt internal policies restricting where data may be accessed. That is a legitimate policy choice and it is different from a statutory prohibition.
If you are the vendor, ask early which of the two you are dealing with. If you are the buyer, know which one you are applying, because conflating them removes options you may actually want.