Medical billing has quietly become remote work. Revenue cycle management companies, central billing offices, and MSOs run coders and billers from home offices across Texas and from teams in the Philippines, India, and Latin America. Independent practices outsource the same work or hire remote billers directly. A lot of PHI moves through those arrangements, and the way it moves is often not great.
Here is what that looks like in practice. A biller logs into a practice's EMR from a personal laptop over a consumer VPN. Claims data gets exported to a spreadsheet for scrubbing. Screenshots go into a chat thread. Each new client adds another VPN client, more saved passwords, another remote desktop shortcut. Nobody can say with confidence where PHI is stored.
VDI, virtual desktop infrastructure, exists to solve exactly this. It is a mature approach that fits billing work unusually well.
What VDI is, in plain terms
VDI means the Windows desktop the biller uses does not run on the biller's computer. It runs on a server in your data center or in a cloud tenant you control. What travels over the internet is a compressed video stream one way and keyboard and mouse input the other. The applications, the files, and the PHI stay where the desktop runs.
Compare that to the alternatives people reach for first.
VPN connects the biller's device to your network. Files can be copied to it. Malware on it can reach your systems. A VPN secures the tunnel, not the endpoint.
Remote desktop to a physical PC (RDP to an office workstation, or a consumer remote-control tool) is closer to VDI in concept but usually unmanaged. Session logging is thin, clipboard and drive redirection are often left on, and fifty billers means fifty physical PCs somewhere.
Cloud PC products such as Windows 365 are VDI sold as a per-user subscription. Microsoft hosts the desktop and you manage policy. Azure Virtual Desktop is the more configurable version, where you build and pool the desktops in your own Azure tenant. Citrix is the long-standing enterprise platform with its own protocol and management stack, on premises or in the major clouds. All three are legitimate. For most billing teams under a few hundred users the choice is Azure Virtual Desktop or Windows 365, with Citrix in play for larger RCM companies with existing investment or specific protocol needs.
How VDI keeps PHI inside the environment
The security value of VDI comes from what you turn off. A properly configured billing desktop has these controls in place:
- No local storage. Drive redirection is disabled, so files cannot be saved to the personal laptop.
- Clipboard control. Copy and paste between the virtual desktop and the local device is blocked, or limited to text in one direction. This closes the "paste patient list into a personal email" path.
- Printing and USB. Printer redirection is off or scoped to approved printers. USB pass-through is off. Screen capture cannot be fully prevented client-side, which is why the next two controls matter.
- Session recording and logging. Every login, source IP and device, session duration, and application launched is logged centrally. Some platforms record sessions on demand for high-risk roles.
- Watermarking. A faint overlay shows the user's name and timestamp. It does not stop a phone photo, but it makes a leaked image traceable and changes behavior.
- Idle timeout. Sessions lock after a short idle period and terminate after a longer one.
Together, these turn the personal laptop into a thin display. If it is lost, stolen, or infected, the exposure is an expiring session token, not a folder of claim exports.
Performance over limited bandwidth
The most common objection from offshore team leads is that VDI will be slow. When it is, the cause is usually design, not the technology.
Bandwidth is rarely the constraint. A billing desktop showing EMR screens and payer portals is mostly static text and forms. Modern protocols (Citrix HDX, Microsoft RDP with the AVD optimizations, and similar) send only the parts of the screen that change and compress aggressively. A stable connection of a few megabits per second per user is enough.
Latency is the constraint. Round-trip time shows up as lag between typing and characters appearing. Under about 100 milliseconds it feels normal. Between 150 and 250 it feels sluggish but workable. Beyond that, people get frustrated. A team in Manila reaching desktops in Texas will see roughly 200 milliseconds or more.
The fix is placement. Put the virtual desktops in a cloud region close to the biller, and let the desktop reach the EMR and payer systems over the provider's backbone. The biller gets a responsive session, and the desktop-to-application hop runs between data centers rather than across the Pacific on home internet.
Image quality settings matter more than most administrators expect. Turning down visual effects, limiting frame rate, and using text-optimized encoding makes a session feel faster on the same link. Set these per group rather than globally.
Identity: MFA, conditional access, and per-client scoping
MFA and conditional access
A virtual desktop is only as secure as the login in front of it. Two things are non-negotiable.
Multi-factor authentication for every session, with an authenticator app or hardware key rather than SMS where possible. Cyber insurance carriers ask about this specifically, and so does nearly every client security questionnaire.
Conditional access, which means the login is evaluated against context before it is allowed: only from countries where you actually have staff, no legacy authentication protocols, a registered device for privileged roles, and a fresh challenge when the sign-in looks unusual. In Microsoft environments this is built into Entra ID and works with Azure Virtual Desktop and Windows 365. Citrix has equivalent policy layers. Together they close off most credential-based attacks.
Per-client access scoping for RCM companies
An RCM company or CBO connecting into a dozen or more practice systems has a problem a single practice does not: one biller may work three clients, another eight, and each client expects that only assigned staff can see their data.
VDI handles this well when designed for it from the start. The pattern is one environment, many access groups. Each client practice gets its own security group, published applications or desktop pool, stored credentials, and logging view. Billers belong to the groups for their assigned clients and nothing else. Moving a biller between accounts is a group change, not a rebuild. And when a client asks who accessed their EMR last quarter and from where, you can pull that report for their environment alone rather than reconstructing it from a shared VPN log.
Capacity planning and cost
Month-end capacity
Billing volume rises at month end and again around quarter close. Cloud VDI lets you plan for this rather than overbuy for it. Pooled desktops can be scaled on a schedule: more session hosts from the 25th through the 5th, fewer mid-month, with auto-scaling on user count for unplanned spikes. Persistent dedicated desktops lose most of this flexibility, which is one reason pooled non-persistent desktops with roaming profiles are the default recommendation for billing roles.
What it costs, roughly
Costs vary with platform and design, but the components are the same everywhere, per user per month.
| Component | What drives it |
|---|---|
| Platform or subscription | Windows 365 flat fee, or Azure Virtual Desktop compute and storage, or Citrix licensing plus hosting |
| Windows and Microsoft 365 licensing | Often already owned; check entitlement before buying again |
| Security tooling | EDR on the session hosts, MFA, conditional access, logging retention |
| Management | Image maintenance, patching, monitoring, user support, capacity changes |
| Network | Egress and any private connectivity to EMR or client environments |
Pooled desktops that shut down outside working hours cost noticeably less than dedicated ones running all month. Ask any provider for an all-in per-user figure at fifty, one hundred, and two hundred users.
Set against that the cost of the current approach: VPN licenses, unmanaged laptops, questionnaires you cannot answer confidently, and the exposure if a personal device holding claim exports is compromised. Industry breach-cost studies place healthcare at the top, and one RCM breach reaches many practices.
What to put in BAAs and client-facing security summaries
An RCM company is a business associate to every client and probably has subcontractors of its own. A practice hiring remote billers may have a business associate too. Either way, the VDI design should be reflected in the paperwork. Whether a specific clause is required is a legal question, so have counsel review it. What follows is what the technical side should be able to support.
In the BAA and any security addendum, be specific: PHI is stored in the VDI environment only, local storage and clipboard transfer are disabled, MFA is enforced, access logs are retained for a stated period, and access ends when a biller leaves.
For a one- or two-page client-facing security summary, describe the platform, the region where desktops run, the controls above, the conditional access rules, how per-client scoping works, and how you respond to an incident. Written plainly, this shortens sales cycles and makes questionnaires easy. If you are the practice on the receiving end, ask your billing vendor for this document. If they cannot produce it, that is an answer too.
Migration steps and questions to ask
Migration steps
Moving a mid-sized billing team onto VDI takes weeks, not months.
- Inventory the applications each role uses: EMR clients, browser portals, clearinghouse tools, spreadsheets, PDF tools, any legacy software.
- Choose the platform based on scale, existing licensing, and where staff are located.
- Build a golden image with the applications, EDR, and the lockdown policies above. Test it with two or three real billers.
- Configure identity: MFA, conditional access, and per-client access groups.
- Connect the VDI network to each EMR and client environment.
- Pilot one team for two weeks. Measure latency, gather complaints, tune image settings and region placement.
- Cut over in waves, decommissioning VPN accounts and remote-desktop shortcuts as each wave completes.
- Update the BAA language and the security summary to match what you built.
Questions to ask a provider
- Where will the desktops run, and can that change if we add staff in another region?
- Show me the clipboard, drive, print, and USB policies you would apply. Are they on by default?
- How is per-client access scoped, and can I get an access report for one client alone?
- What MFA and conditional access rules will be in place on day one?
- What is the all-in monthly cost per user at our size, and at double our size?
- How is capacity increased at month end, and who does it?
- Will you sign a BAA, and can you help write the client-facing security summary?
Frequently asked questions
No. HIPAA does not name any specific technology. It requires you to assess risk and put reasonable safeguards in place. VDI is one of the most defensible ways to do that for remote billing work because PHI never leaves the environment you control. Whether it is required in your case is a risk analysis question, and sometimes a contract question.
A VPN extends your network to the biller's device, so PHI can land on that device. VDI keeps the desktop, the applications, and the data in your data center or cloud tenant. The biller only receives screen pixels and sends keyboard and mouse input. Nothing is stored locally unless you allow it.
Usually yes. Modern display protocols are efficient, and a billing desktop with EMR and clearinghouse portals needs far less bandwidth than video calls. Latency, not throughput, is the real constraint. Placing the desktops in a region close to your data sources and tuning image quality settings solves most complaints.
For a typical billing desktop, expect a range that includes the platform license, compute and storage, Windows and Microsoft 365 licensing, security tooling, and management. Cloud PC subscriptions bundle much of this into a flat monthly fee. Pooled non-persistent desktops cost less per seat than dedicated persistent ones. Ask any provider for an all-in number.
Yes, and it is the common design. Each client is a separate access group with its own application publishing, credentials, and logging. A biller sees only the practices they are assigned to. That scoping is what lets you answer a client's security questionnaire honestly and specifically.
Galleon builds and manages virtual desktop environments for billing teams as part of our RCM, CBO, and MSO IT and virtualization services, with identity, EDR, and logging covered by our cybersecurity for medical practices work. For the paperwork side, see BAAs and IT vendors and what HIPAA-compliant IT actually means.
Ready for a straight answer about your IT? Call (972) 776-6366 or contact us.