Slashdot Mirror
Transcriber Threatens Release of Medical Records
talboito writes "David Lazarus of the San Francisco Chronicle reports on problems subcontracting sensitive data to outside firms. An unpaid Pakistani transcriber threatened to release medical records of patients at UCSF Medical Center on the internet. The article notes: 'U.S. laws maintain strict standards to protect patients' medical data. But those laws are virtually unenforceable overseas, where much of the labor-intensive transcribing of dictated medical notes to written form is being exported.' Most frightening, UCSF was unaware that its records were being sent overseas. The article traces their path backward through a chain of three different subcontractors."
I can hear the conversation in the board room now....
"Who thought that outsourcing this was a good idea?"
How long until the IT outsourcing start's biting companies in the arse?
remember our laws are NOT their laws.
Do not look at laser with remaining good eye.
This is why certain aspects of business will always cause privacy problems such as this. The goal of many businesses is not to provide the best possible service or the best possible products. Rather it is simply to make money. This is why HMO's never made sense to me and why they were a con foisted upon the American public. They have not made the practice of medicine any cheaper, rather they have simply moved profits from the physicians, nurses and technicians and moved it to a new middle layer of management who makes decisions such as exporting transcription overseas to markets with no concern for privacy.
Visit Jonesblog and say hello.
The problem is not overseas workers. The real issue here is sensitive information being processed by networks of subcontractors without the knowledge of the information owner.
Can anyone else see large software companies having this problem? Company sends the project overseas to be developed, employees return the finished source, and then toss their NDA in the trash by holding the source ransom over the internet.
We've all seen what source in the wild can do (whether you believe some of the rumors about how HL2 source was released, it's _still_ delayed), and a group trying to profit off of source code could even be worse. Of course, no manager is going to listen to little old me.. Mainly because I'm not crawling down their throats for this quarters profit margin. =T
This statement is false.
No doubt this is a 'bad thing' since medical record confidentiality is a widely accepted thing in our society. But having known several people who have worked for large hospitals, medical offices, and such, this is simply payback for thos ehospitals who clear millions of dollars in profits AFTER they've already payed everyone in the building.
Business will always be business, and every manager wants a fatter check for gettings things done cheaply, but they simply got what they paid for. They wanted it cheap, now they got the quality that comes with that.
Pay your employees, people! Create some value in your business by doing it yourself. I'm not saying that a medical transcriptionist should be making 75K/yr, but the money they saved by offshoring this, they just lost 10 times over in the lawsuits that will be flowing into that hospital now for violating doctor-patient confiditiality.
A middle manager/upper manager should be fired, publicly, for this.
"See, we plan ahead! That way, we never have to do anything now."
Isn't HIPPA supposed to protect us from this type of thing?
Perhaps the contractor who shipped the data overseas can be prosecuted, because he mishandled the data by moving it to where US laws can't be used to safeguard it.
But probably not. One of the (usually fortunate) principles of US law is that, if there is any ambiguity, the interpretation most favorable to the defendant must be used.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Companies are setting themselves up for a big hurt when they outsource overseas. This intance shows just some of the dangers and downfalls. Eventually, it's going to come around and bite them in the arse. What happened to all the forward thinkers? The over-zealous drive for profits and cost savings for today without thinking about tomorrow hurts us all - from the executives, to the workers, to the consumers, and, yes, even the shareholders. For example, America's technological edge is dying all because of overseas outsourcing. Why would any kid want to go to college for CS/IT when the job prospects are so miserable?
This is why the US needs a strong data protection act. In Europe there are strong laws to prevent release of personal information without the direct agreement of the person. And to make this law at all useful it would be illegal for a company to release that information, or transfer it to another country which does not have similar strong laws which are enforcible. So this situation would never have happened.
Indeed, this caused all sorts of hassles with transatlantic companies. They could not transfer data to the US because it didn't have an equivalent law. In the end the "Safe Harbour" agreement came up, which means that personal data about me, gather in Europe, but exported to the US
has stronger data protection, than personal data gathered about US citizens and kept in the US.
It's a strange world.
Phil
With tablet PC's and the like, doctors down here in Houston (at least at my wife's 20 doctor clinic) are starting to enter their own records.
This sort of problem only happens at the huge hospital systems, not your regional health system.
Remember this:
"A group of American companies is attempting this week to persuade the European Union to relax its rules governing data protection, claiming they are bad for business.
[...]
The EU passed the Data Protection Directive in 1998, and this has subsequently been implemented into national law by all but two--Ireland and Luxemburg--of the EU's member states.
As well as regulating the buying and selling of personal data about European citizens and forcing Web sites to tell users when data about them is collected and allow users to refuse disclosure, the Data Protection Directive also restricts the flow of information about Europeans to companies based in countries with--in the view of the EU--more lax privacy standards.
The Global Privacy Alliance says that this directive makes it hard for companies to engage in the kind of data flow that they claim is vital for modern e-enabled businesses."
That would be the kind of data flow where they take your medical data, and farm it out to a country with no effective privacy laws, then?
Its interesting that the EU law would not only have prevented your medical data going to Pakistan, it would have prevented it going to the US - because far from having "strict standards to protect patients' medical data", the US laws allow moving private data to countries with lower privacy standards!
But man, all this talk about "homeland security" goes right out the window when it interferes with turning a profit, right? This isn't an anti-Bush rant, moreso a gripe with business ethics in general. John Ashcroft et. al. have seen fit to rape the Bill of Rights to "protect" us from terrorism, then turns around and screws a whistleblower for pointing out our nuke plants are vulnerable.
Way to have your priorities straight guys.
This is a *HUGE* issue. Even joe consumer can get concerned when his personal info is bouncing around third-world countries.
What does it tell you that this is not being reported in the mainstream press? Is the issue too complicated? Are people not interested?
I think that there would be a strong reaction from the populace if this was reported in the national media. This might cause the goverment to step in on the off-shore outsourcing issue.
Congress, the White House, and many state legislatures are far more serious about privacy and security than ever before. Expect more privacy laws to be passed by state legislatures.
Every CIO should be concerned about willful violations (willful intent to skirt the privacy regulations) as well as negligent violations when considering moving data offshore, even if only for software development.
Tell your CIO: Regulated data should stay local.
vb
It seems we were selling personal information to marketing firms. I found that the firms we serviced had no knowledge of that, so I refused to write the code. Of course I got fired ,had a company officer watch me pack my things, and escort me to the door, all the while trying to convince me they were doing nothing wrong, and I shouldn't mention this to anyone, blah blah blah.
They were in the wrong to do this and to fire you for it. You could sue.
But regardless of whether you sue or not, how about providing us with the name of the Business, the type of violations they were making and the businesses that they were doing business with that were not made aware that their private customer data was being shared for profit.
This type of personal information peddling is illegal, imoral and can cause very significant damage to innocent people (e.g. Insurance companies dropping people, loss of jobs, etc..).. Whenever anyone discovers this type of thing, it is VERY IMPORTANT to get it out in the open so that it can be dealt with.
The reason that it can be true that 1+1 > 2 is that very peculiar nonzero value of the + operator
Forest for the trees, kids. Yes, your medical records may be over seas, but that is the small prize. Financial services companies have off-shored a lot of work to India, work that involves financial records. Think about: your name, address, social security number and account information may be sitting in India as I type this.
Someone in another posting made a joke about extortion being cheaper becaue of reduced labor costs. Not much of a joke, really. Someone based in the US will most likely turn down an offer of US$5,000 for complete information -- including SS# -- for accounts with at least US$1 million in net assets. But that US$5,000 looks very attractive to a person based in India, a country where the average annual income is US$4,000, and US$30,000 is salary for a top notch programer.
It is only a matter of time.
thx,
Eric
The welfare of the people has always been the alibi of tyrants. - Albert Camus
You're funny. The US is one of the few western countries where you can (and people often do) get convicted based on circumstantial evidence.
Umm, have you ever heard of the Bill of Rights? It is not possible to be convicted of a crime on circumstantial evidence alone. There must be a witness to the crime or there is no conviction. This is why traffic tickets are thrown out if a police officer doesn't show up for trial. No witness, no case.
Here is the Sixth Amendment:
"In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial, by an impartial jury of the state and district wherein the crime shall have been committed, which district shall have been previously ascertained by law, and to be informed of the nature and cause of the accusation; to be confronted with the witnesses against him; to have compulsory process for obtaining witnesses in his favor, and to have the assistance of counsel for his defense."
Furthermore, this would be civil court, where the requirements for a conviction is much lower -- to the point where you can get a judgment against you because of a belief of likelihood.
It is not "much lower". There is also no such thing as "conviction" in civil court. You pay money, nothing more. The reason the standard of proof is lower is that you are not losing life or freedom in civil court, you are resolving a dispute.
Its nothing more than "beyond a resonable doubt" versus "clear and convincing". It is a matter of degree nothing more.
Yes, justice is blind, especially after she got a blanket thrown over her head by Mr. Ashcroft...
How does a cabinet member have the power to alter common law practices again? Is he personally bribing all the jury members?
This isn't a dictatorship... one man has far less influence than you think.
I don't read or respond to AC posts
I've noticed a lot of posts wailing that is a problem inherent in Outsourcing.
I think that quite clearly isn't the case, the problem is that US Data Protection laws allow companies to pass personal data to other countries which do not have any requirement to protect that data.
There's no reason why India or Pakistan or wherever that lady lived would have any laws governing the protection of data belonging to US Citizens but US Law should realise that and make it illegal to pass data which is protected in the US to these countries.
I totally agree that disclosure of medical data is a bad thing but it's important to realise how the law has failed to guard against this happening rather than whinge about something totally unrelated to the problem in hand