Protect our private health and financial information sent to foreign countries

In order to cut costs, more and more hospitals, physicians, and insurance companies are outsourcing medical transcription, billing, and coding functions to foreign countries.  Most of the time, this is done without their patients' knowledge or consent. 

Current laws do not sufficiently protect our private health and financial information that is in the hands of businesses offshore. 

Please urge congress to pass stricter laws to protect this information and force organizations who offshore to notify their patients. 

In order to cut costs, more and more hospitals, physicians, and insurance companies are outsourcing medical transcription, billing, and coding functions to foreign countries.  Most of the time, this is done without their patients' knowledge or consent. 

Current laws do not sufficiently protect our private health and financial information that is in the hands of businesses offshore. 

Please urge congress to pass stricter laws to protect this information and force organizations who offshore to notify their patients. 

We, the undersigned, are writing to express our concern regarding Protected Health Information (PHI) and related financial information being transmitted to offshore medical billing, coding, and transcription companies. 

We feel that this poses a serious security risk for individuals in the United States and that it is happening without their knowledge or consent. 

The Privacy regulations that went into effect April 14, 2003 as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandate that covered entities (e.g. doctors and hospitals) obtain written authorizations from patients before any information is shared with outside businesses for purposes not related to their health care.  Yet, authorization is not required to send this highly sensitive information to Pakistan, India, China, Russia, or any other country because it is related to treatment, payment or business operations (TPO). 

If a security breach were to occur overseas, we are concerned that this would be beyond the reach of U.S. laws. 

Additionally, under the current HIPAA law, individuals are not afforded the right to take any legal action to recover any damages he or she may sustain as a result of security breaches.  The HHS holds the only authority to enforce the HIPAA law.

The threat to personal privacy and security is not just a hypothetical scenario.  In April 1, 2004, a story was published in the Asheville Tribune. Susan Purdue, a former employee of the MedQuist medical transcription company, alleged that MedQuist[1][2], who contracted with the Veterans Administration to transcribe medical records, was sending files of active duty military personal to Pakistan and India.  She stated that she saw a file that contained a report from an American soldier who had been shot in leg in Kandahar, Afghanistan. He was telling his doctors where he had been, what unit he was with, what weapons he had been firing and said he wanted to get back because his unit was being redeployed to the Korean DMZ." She also stated that, "These files contained vital information such as name, rank, home address, names of relatives, current duty station and locations to which records should be sent including upcoming overseas assignments."

On October 7, 2003, a Pakistani woman sent an email message to the University of California San Francisco Medical Center demanding payment for her medical transcription work with patient files attached. (2)

Just a few weeks later, Heartland Information Services, an Ohio-based transcription company, was the victim of an extortion attempt by its own workers in Bangalore, India. The Heartland employees threatened to reveal confidential information unless they received a cash payoff. (3)

These incidents prove that there is a real threat to Americans' private and personal information.  Our fear is this threat will only become more serious as more and more businesses send PHI offshore for processing. 

We suggest, rather than waiting for the worse-case scenario to occur, we do something about it now. 

Legislative action is the only remedy to these future threats. 

Senators Hillary Clinton and Mark Dayton were on the right track with the 2004 proposed bill, S. 2471, Safeguarding Americans From Exporting Identification Data Act (SAFE-ID Act).  (4)

We urge you to propose a similar bill that would at least:

• Require health care businesses to inform their patients where their personally identifiable medical and financial information is being sent;
• Give patients the opportunity to object prior to any disclosures;
• Prohibit American health care businesses from disclosing PHI to a foreign company unless that company has sufficient privacy rules in place and agrees, in writing, to abide by the United States%u2019 federal privacy laws;
• Require American health care businesses who knowingly do business with and transfer PHI to foreign countries to be held liable to persons suffering damages due to the misuse of that information; 
• Allow any individual the right to file a civil suit to recover any damages he or she may sustain as a result of misuse of their PHI or financial information. 

We thank you in advance for your attention to this matter.

_______________________________________________
[1]

1. http://www.privacyforvets.com/tribune0401a.html

2. David Lazarus, A tough lesson on medical privacy Pakistani transcriber threatens UCSF over back pay, San Francisco Chronicle, October 22, 2003, Page A1.

3.  David Lazarus, Extortion threat to patients' records Clients not informed of India staff's breach, San Francisco Chronicle April 2, 2004, Page A1

4.  GovTrack.us. S. 2471--108th Congress (2004): SAFE-ID Act, GovTrack.us (database of federal legislation) <http://www.govtrack.us/congress/bill.xpd?bill=s108-2471&tab=summary> (accessed Jun 15, 2008)