Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Privacy The Internet Your Rights Online

Transcriber Threatens Release of Medical Records 377

talboito writes "David Lazarus of the San Francisco Chronicle reports on problems subcontracting sensitive data to outside firms. An unpaid Pakistani transcriber threatened to release medical records of patients at UCSF Medical Center on the internet. The article notes: 'U.S. laws maintain strict standards to protect patients' medical data. But those laws are virtually unenforceable overseas, where much of the labor-intensive transcribing of dictated medical notes to written form is being exported.' Most frightening, UCSF was unaware that its records were being sent overseas. The article traces their path backward through a chain of three different subcontractors."
This discussion has been archived. No new comments can be posted.

Transcriber Threatens Release of Medical Records

Comments Filter:
  • HIPPA? (Score:4, Interesting)

    by i.r.id10t ( 595143 ) on Thursday October 23, 2003 @09:09AM (#7289536)
    Isn't HIPPA supposed to protect us from this type of thing?
    • Re:HIPPA? (Score:2, Interesting)

      by endus ( 698588 )
      Yea you would think so. This is the first in what I ahve been predicting to be a long line of complication with sending work that deals with sensitive materials overseas. Of course no one in a position of power thinks about these issues until they come back to bite them in the ass.

      Not that that means anything will be done of course. I'm sure we'll just have to learn to live with this kind of thing because it's "no big deal".
    • Re:HIPPA? (Score:4, Insightful)

      by Ungrounded Lightning ( 62228 ) on Thursday October 23, 2003 @09:19AM (#7289610) Journal
      Isn't HIPPA supposed to protect us from this type of thing?

      Perhaps the contractor who shipped the data overseas can be prosecuted, because he mishandled the data by moving it to where US laws can't be used to safeguard it.

      But probably not. One of the (usually fortunate) principles of US law is that, if there is any ambiguity, the interpretation most favorable to the defendant must be used.
      • Re:HIPPA? (Score:3, Interesting)

        by arth1 ( 260657 )
        Perhaps the contractor who shipped the data overseas can be prosecuted, because he mishandled the data by moving it to where US laws can't be used to safeguard it.

        But probably not. One of the (usually fortunate) principles of US law is that, if there is any ambiguity, the interpretation most favorable to the defendant must be used.

        You're funny. The US is one of the few western countries where you can (and people often do) get convicted based on circumstantial evidence.

        Furthermore, this would be civil co
        • You're funny. The US is one of the few western countries where you can (and people often do) get convicted based on circumstantial evidence.

          Umm, have you ever heard of the Bill of Rights? [cornell.edu] It is not possible to be convicted of a crime on circumstantial evidence alone. There must be a witness to the crime or there is no conviction. This is why traffic tickets are thrown out if a police officer doesn't show up for trial. No witness, no case.

          Here is the Sixth Amendment:

          "In all criminal prosecutions, the
          • by damiangerous ( 218679 ) <1ndt7174ekq80001@sneakemail.com> on Thursday October 23, 2003 @03:00PM (#7293528)
            It is not possible to be convicted of a crime on circumstantial evidence alone. There must be a witness to the crime or there is no conviction.

            You are completely wrong. There must be witnesses? That's absolutely ludicrous. Do you have any idea how many crimes have no witnesses?

            Brief Google just for a couple examples of statements relating to circumstantial evidence:

            The Supreme Court of Pennsylvania [dpg-law.com]

            "Moreover, this Court has established that circumstantial evidence alone can be sufficient to convict a person of a crime."

            The Supreme Court of New Hampshire [state.nh.us] upholding a conviction based solely on circumstantial evidence.

            "When the evidence presented is circumstantial, it must exclude all rational conclusions except guilt in order to be sufficient to convict."

            The Tennessee Appeals Court [216.239.39.104]

            "However, a conviction may be based entirely on circumstantial evidence where the facts are 'so clearly interwoven and connected that the finger of guilt is pointed unerringly at the Defendant and the Defendant alone.'"

            The Louisana Appeals Court [216.239.39.104]

            "The rule as to circumstantial evidence is that, assuming every fact to be proved that the evidence tends to prove, in order to convict, it must exclude every reasonable hypothesis of innocence."

      • Re:HIPPA? (Score:5, Informative)

        by lonesome phreak ( 142354 ) on Thursday October 23, 2003 @11:17AM (#7290832) Journal
        Yes it is. Someone is getting a huge fine or even jail out of this. There is supposed to be a Business Associate Agreement between all Chain of Trust partners that stipulates both parties are following HIPAA just to be able to pass PHI between each other. Someone didn't follow the law and allowed PHI to be handed off to a non-compliant company. I do HIPAA audits for a living...
    • Re:HIPPA? (Score:4, Informative)

      by JJ22 ( 558624 ) on Thursday October 23, 2003 @09:25AM (#7289654)
      HIPAA would prevent this from happening in most cases. The law requires that agreements are in place with any companies/contractors with whom you share protected health information (I'm not sure if those transcripts would be PHI, but I believe they would).

      The problem here is with the newness of the law and the size of the company. It looks like the subcontractors being used are all "home-office" type deals that don't know the laws, which say that if you've signed a contract to handle PHI (and not disclose it) and you want to subcontract, you need to get the subcontracting firm to sign a similar document. The people mentioned in the article obviously haven't done that. Also, the article made it sound like the Pakistani woman was pretty much working on her own. When dealing with a larger (or real) company, you can have them sign a contract which would be enforceable in their own country (this is why we have lawyers).

      It is not a problem of laws not being enforcable as the article indicates, it is more of understanding the requirements of our laws and getting the right contracts into place that would be enforcable in other countries.

    • Isn't HIPPA supposed to protect us from this type of thing?

      IANAL but actually no, HIPPA does not cover this. HIPPA simply says don't show stuff to people who aren't directly involved in medical treatment, payment or important administration. These folks are doing a service which is paid for by the hospital and thus can legally look at the documents. Granted it might violates the spirit of the law but as written it is legal.

      Plus they are overseas so HIPPA really doesn't apply to them anyway.
      • Re:HIPPA? (Score:2, Informative)

        by mapMonkey ( 207912 )
        Two things:

        1) HIPAA does not simply say "don't show stuff to people who aren't directly involved in medical treatment". HIPAA does not say anything simply actually; but it is more to the effect of "if you are going to show protected information to people outside of your organization, you need to establish contracts with them stating that they will protect that information".

        2) HIPAA may not apply to the people overseas, but it would apply to whoever was the last American company in the subcontract chain.
    • Re:HIPPA? (Score:5, Informative)

      by mericet ( 550554 ) on Thursday October 23, 2003 @09:38AM (#7289740) Homepage
      It is, in fact, see for example "Business Associates" of "Covered Entites" [medlawplus.com], or read the law, as I have (note, IANAL, nor a MD).

      It covers specifically these kinds of cases, and the hospital clearly didn't place the necessary safeguards, as far as I understand the law, '"We'll have to live with this risk on a daily basis," Ryba said' is simply not good enough.

    • Re:HIPPA? (Score:5, Informative)

      by radulovich ( 47127 ) on Thursday October 23, 2003 @09:56AM (#7289876) Homepage
      It already does. Subcontractors are covered under the "Business Associate" definition. The text of the law is located here in PDF format ( http://www.hhs.gov/ocr/combinedregtext.pdf [hhs.gov])

      The law specifically states that any work that a healthcare organizations subcontracts out is to be held to the same standard. If the hospital did not insure that, then they are liable for both civil and criminal damages.

      This is actually one of the great things about the law. If an organization tries to escape any clause by subcontracting out the work, they are still liable. In this case, it seems that they did not even have an agreement with the contractors, which would be even larger penalties.

      As a final note, the hospital is already liable, because the woman sent patient records to the hospital via email. Unless the email was encrypted and only opened by the doctors giving care to the patients in record, then the hospital is liable. I expect the government will begin an investigation shortly, and the hospital will be fined within a year.

      Mark Radulovich, CISSP, NSA/IAM

  • Nice... (Score:5, Insightful)

    by Lumpy ( 12016 ) on Thursday October 23, 2003 @09:11AM (#7289550) Homepage
    I can hear the conversation in the board room now....

    "Who thought that outsourcing this was a good idea?"

    How long until the IT outsourcing start's biting companies in the arse?

    remember our laws are NOT their laws.
    • UCSF Medical Center should be held financially responsible for the actions of its contracted employee. They where the ones that decided to use offshore labor, now they should pay the price.
      • Re:Nice... (Score:3, Insightful)

        Well, they're not taking responsibility.

        They passed the buck down to subcontractor A, who passed it to subcontractor B, who passed it to subcontractor C, who had to pay the cost because subcontractor D had taken the money and ran.

        No one at UCSF thinks they did one damn thing wrong.
    • Blackmailing is a crime everywhere

      No honoring comercial agreements is a crime everywhere

      I don't see the big differences between "US" and "THEM" remember...after all, we are all ordinary men.
      • Re:Nice... (Score:2, Insightful)

        by humpTdance ( 666118 )
        True blackmailing is, but this has nothing to do with blackmailing and everything to do with the disparity between OUR privacy laws and THEIR privacy laws.
    • Re:Nice... (Score:3, Funny)

      by curtisk ( 191737 )
      remember our laws are NOT their laws

      *Evil laugh* Everything in due time, in due time.....patience! *Bwahahahaha*

    • Re:Nice... (Score:5, Insightful)

      by I8TheWorm ( 645702 ) on Thursday October 23, 2003 @09:40AM (#7289753) Journal
      -- What this world needs is some geeks with the backbone to stand up for what they believe in.

      .... Begin long story here ....

      I lost a job for it, and fell like a better man in the long run. I worked for a company that processed medical records, and sent hundreds of reports back to the practices/hospitals. Side benefit was selling generic statistics to insurance companies, etc... All of that was legal and the companies we serviced had knowledge of it.

      While rewriting crappy code there, I noticed one particular batch that was different. It seemed to be sending not-so-generic data (it included names, address, and phone numbers). It also had a different naming convention. I brought it up with my IT Director, who promptly dismissed it as "normal, we deal with many kinds of businesses."

      It seems we were selling personal information to marketing firms. I found that the firms we serviced had no knowledge of that, so I refused to write the code. Of course I got fired ,had a company officer watch me pack my things, and escort me to the door, all the while trying to convince me they were doing nothing wrong, and I shouldn't mention this to anyone, blah blah blah.

      .... End long story here ....

      I think anyone in the know at a company (and most programmers/dba's are in the know) should exercise some responsibility. If it's wrong, it's wrong. Look at the folks who got in trouble at Enron for looking the other way.

      If that same company were shipping data overseas, I would have had the same reaction, and probably the same ensuing unemployment.
      • Congratulations on taking a stance, did you consider informing the authorities and the clients of your company?

        If you're in the US (and many states in Europe) there are "Whistle Blower" laws that protect you from recriminations by the company, and often financial incentives too.
        • In retrospect, I should have, but in reality I just wanted to wash the awful taste out of my mouth. I also got "blacklisted" by the consulting firm I was with, but that was no big deal, as they turned out to be flesh pimps anyway.
      • Did you take it one step further and contact the companies doing business with your ex-employer, to let them know what was happening? Or did you at least get a fat check to ensure your silence?
        • Nah, neither. I mentioned in another response that ideally I should have reported them one way or another, but all I really wanted was away from all of that.
      • Re:Nice... (Score:3, Interesting)

        by Pig Hogger ( 10379 )

        ...
        so I refused to write the code. Of course I got fired
        ...
        I think anyone in the know at a company (and most programmers/dba's are in the know) should exercise some responsibility. If it's wrong, it's wrong. Look at the folks who got in trouble at Enron for looking the other way.

        You did it stupidly. Thou shalt have blown thy whistlee publically and, if you could, wreck their company by destroying data.

        Many moons ago, I did not hesitate to destroy all the accounting data of a company that wanted me t


        • Yeah, I was (much) younger and dumber at the time. I think about it from time to time and how I should have done more. I do know that several of the execs that were there aren't any longer. Maybe (hopefully) they've cleaned up their act.
        • ok, hindsight is 20/20 and it's easy to say that someone should have done something differently without having to be in that person's shoes, but i don't see your answer as better.

          it started off right, with "you should have blown the whistle." i'd agree with that, and i'd suggest anyone in that position right now --and debating what to do-- take that route. there are whistleblower laws, depending on the circumstances, that will protect someone who turns in an employer for illegal activity.

          what you did wa
      • Re:Nice... (Score:3, Informative)

        Report them to CMS, as your manager could go to jail over that. That's the only way to stop this is for some people to get in deep sh*t over it.

        https://htct.hhs.gov/?cms

        Go there and file a complaint right now.
      • by Corpus_Callosum ( 617295 ) on Thursday October 23, 2003 @11:46AM (#7291192) Homepage
        It seems we were selling personal information to marketing firms. I found that the firms we serviced had no knowledge of that, so I refused to write the code. Of course I got fired ,had a company officer watch me pack my things, and escort me to the door, all the while trying to convince me they were doing nothing wrong, and I shouldn't mention this to anyone, blah blah blah.

        They were in the wrong to do this and to fire you for it. You could sue.

        But regardless of whether you sue or not, how about providing us with the name of the Business, the type of violations they were making and the businesses that they were doing business with that were not made aware that their private customer data was being shared for profit.

        This type of personal information peddling is illegal, imoral and can cause very significant damage to innocent people (e.g. Insurance companies dropping people, loss of jobs, etc..).. Whenever anyone discovers this type of thing, it is VERY IMPORTANT to get it out in the open so that it can be dealt with.
      • Re:Nice... (Score:3, Informative)

        by kabocox ( 199019 )
        You should have gone to the police and to as many of the "business" customers that you could contact if any. What your company was doing was information theft. If their customers found out, each could successfully sue for millions. Information is property. Your company did not have resell rights to it plain and simple. Your company only had the rights to run reports on the data. None of the data ever belonged to your company.

        You should sue for "wrongful" dismissal under whistle blower laws although you r
    • No, here is what is going to happen.

      The bigwigs in Pakistan are going to come down on these blackmailers, HARD. If anything, they will overreact. The word "terrorist" might even get thrown in somewhere. There's no way they'll be stupid enough to do nothing and let the outsourcing $$ go to China or Vietnam instead.

  • Simply business (Score:5, Insightful)

    by BWJones ( 18351 ) on Thursday October 23, 2003 @09:12AM (#7289558) Homepage Journal
    This is why certain aspects of business will always cause privacy problems such as this. The goal of many businesses is not to provide the best possible service or the best possible products. Rather it is simply to make money. This is why HMO's never made sense to me and why they were a con foisted upon the American public. They have not made the practice of medicine any cheaper, rather they have simply moved profits from the physicians, nurses and technicians and moved it to a new middle layer of management who makes decisions such as exporting transcription overseas to markets with no concern for privacy.

    • by Phillip2 ( 203612 )
      This is why the US needs a strong data protection act. In Europe there are strong laws to prevent release of personal information without the direct agreement of the person. And to make this law at all useful it would be illegal for a company to release that information, or transfer it to another country which does not have similar strong laws which are enforcible. So this situation would never have happened.

      Indeed, this caused all sorts of hassles with transatlantic companies. They could not transfer data
    • Re:Simply business (Score:3, Insightful)

      by Lumpy ( 12016 )
      yes and no.... mostly no.

      With my HMO, I get my medical needs filled cheaply. My company get's a decent deal on the insurance, my premium is at a low level and $15.00 a visit is dirt cheap with $5.00 perscriptions and $25.00 Emergency room visits...

      counter that with $180.00 office visits and $60.00perscription costs and $590.00 emergency room bill for the same damn thing.. you can easily see why people go for HMO's.

      doctors are gouging the hell out of the patients, hospitals are bending them over and rapin
      • Re:Simply business (Score:3, Insightful)

        by Sgt York ( 591446 )
        This is due to malpractice. I have many MD friends (who talked me out of med school for precisely this reason, BTW) that complain about this all the time. Most of take home substantially less now than they did 10 years ago. Some are as far down as half, even though their salaries have increased quite significantly. The difference is in malpractive insurance (BTW, a large percentage of the salary increases are to compensate for the malpractice insurance increases, so the hospital gets screwed 2x). A signific
    • The goal of *EVERY* business is to make money. Some do it by providing the best services & products possible, and some do it by providing products & services as CHEAP as possible. There's room for both in most markets. If this company (being the hospital/HMO/whatever) is in the "high quality service" niche, then they're going to get hit hard by their customers. If they're offering cheap services to bottom feeders, then nobody will care. That's how business works every day. Your naive assumptio
  • by Valar ( 167606 ) on Thursday October 23, 2003 @09:14AM (#7289570)
    My dad is a hospital administrator, and at the hospital he runs (in rural Louisiana, none the less), they just invested in a voice recognition package specific to medical transcription. They never outsourced their transcription needs overseas, but they were having trouble meeting their needs with the staff on hand. So far he says it works far better than he expected, and has generated any serious errors (it tends to be better at picking out the appropriate medical words than at transcribing normal english. because the doctors tend to use rather obscure words). They still proofread the transcriptions as an error checking, but over all, it has been more accurate than even human transcription and cheaper too.
    • My oncologist tried using a medical-specific transcription program a few years ago. One time he demoed it to me while I was getting my chemo. Let's just say that I was not impressed (of course the nausea I felt may have been from the chemo, not the demo).

      A couple months later I asked him if he was still using it. He had given up on it and gone back to a transcription service. So I guess my records are in Pakistan or someplace...
    • The problem with voice recognition is that almost 70% of the physicians who are dictating are foreign with thick accents. On standard english voices without accents, voice recognition has a 40% success rate without training. With training, it can get as high as 90%. Add a thick foreign accent, and these rates drop bigtime.
    • Interesting. My HMO is one of the Kaisers, and about three years ago they gave up dictated notes and started making the doctors and nurses type the material in directly. Each examination room was equipped with a networked PC and custom software for the notes. The software also included assorted forms/tools so that it was easy to order lab tests, commonly prescribed drugs, etc.

      It was kind of sad to watch my family doctor struggle to put in notes at first, but over time his keyboard skills have improved

  • Everything is then electronic and retrievable from the get-go. Good for the economy, efficiency, morale---everything but the bottom line on healthcare costs in the short run ;)

    William
    (who just finished a nightmarish rush project which became so 'cause the boss tried to outsource it and the overseash shop mangled the nice LaTeX job using Quark XPress)
  • Real Issue (Score:5, Insightful)

    by Rotten ( 8785 ) on Thursday October 23, 2003 @09:15AM (#7289578) Journal
    The problem is not overseas workers. The real issue here is sensitive information being processed by networks of subcontractors without the knowledge of the information owner.

    • Particularly for the health care field, doesn't HIPAA have some relevance here? I'm not familiar with all the details, but HIPAA is supposed to address the secure handling of private information, and it sure sounds like UCSF didn't have a good understanding of what was going on...

      P.S.: Anybody else getting popups while browsing /. this morning?
    • This is thursday, do we think information wants to be free on thursday? ;-)
    • Hopefully this sets a reform in motion. With what I've heard of HIPPA, if enforced, I think a lot of people's collective asses would be hauled into court.
    • No, the issue is that American privacy laws are unenforcable overseas. Subcontractors who threatened this in the U.S. would be fined and/or subject to prosecution.
      • There should still be liability to the medical center for allowing the information to be handled in such a cavalier manner. Subcontractors or not, they are ultimately responsible for the handling of the data.
    • The problem is not overseas workers. The real issue here is sensitive information being processed by networks of subcontractors without the knowledge of the information owner.

      The "overseas" part is highly relevant. This case is frightening specifically because the person threatening to release information on the internet is beyond the reach of the laws by which such behavior is regulated in the United States. If this was some person in Illinois threatening to release info on the internet unless his con

  • A sweat shop worker realises she is being exploited.

    More power to her.
  • Outsourcing.. (Score:5, Insightful)

    by NegativeK ( 547688 ) <`moc.liamtoh' `ta' `neiraket'> on Thursday October 23, 2003 @09:16AM (#7289583) Homepage
    Can anyone else see large software companies having this problem? Company sends the project overseas to be developed, employees return the finished source, and then toss their NDA in the trash by holding the source ransom over the internet.

    We've all seen what source in the wild can do (whether you believe some of the rumors about how HL2 source was released, it's _still_ delayed), and a group trying to profit off of source code could even be worse. Of course, no manager is going to listen to little old me.. Mainly because I'm not crawling down their throats for this quarters profit margin. =T
  • This is predictable (Score:5, Interesting)

    by fudgefactor7 ( 581449 ) on Thursday October 23, 2003 @09:17AM (#7289592)
    Any time you pass on potentially sensitive data onto a third party there is the opening for abuse of this nature. When you outsource you are at the mercy of the contracted party and their security measures (if any) become your security measures. Add to that sub-contractors... Big freakin' mess.

    Certain information should remain in the USA and not be contracted out. Ever. Looks to me that this whole fad of out-sourcing overseas has just come back to bite people in the ass. Maybe now some of the fools will learn that the old addage "Charity begins at home" is a good idea: keep those jobs here; the costs aren't in just dollars saved or wages paid.
    • by wrax ( 570032 )
      Not really, I think most firms in the US and abroad actually do want to do a good job, just that there are just enough Bad Guys (tm) out there that sometimes companies and people get burned. This was an isolated incident that happened cause a woman didn't get paid by the jerk she was working for. If it was the USA she was working in she could sue the bastard, in Pakistan she didn't have a lot of recourse. I'll just note that in the article she says she didn't have any intention of making the records publ
  • by SupahVee ( 146778 ) <superv@@@mischievousgeeks...net> on Thursday October 23, 2003 @09:18AM (#7289599) Journal
    No doubt this is a 'bad thing' since medical record confidentiality is a widely accepted thing in our society. But having known several people who have worked for large hospitals, medical offices, and such, this is simply payback for thos ehospitals who clear millions of dollars in profits AFTER they've already payed everyone in the building.

    Business will always be business, and every manager wants a fatter check for gettings things done cheaply, but they simply got what they paid for. They wanted it cheap, now they got the quality that comes with that.

    Pay your employees, people! Create some value in your business by doing it yourself. I'm not saying that a medical transcriptionist should be making 75K/yr, but the money they saved by offshoring this, they just lost 10 times over in the lawsuits that will be flowing into that hospital now for violating doctor-patient confiditiality.

    A middle manager/upper manager should be fired, publicly, for this.
  • Step 1) Pay offshore company peanuts to transcribe medical records

    Step 2) ....

    Step 3) Profit!

    • Step 1) Pay offshore company peanuts to transcribe medical records

      Ammendment to step 1 ) Do not pay offshore company to transcribe medical records,...

      Ammendment to step 3 ) Bigger profit
  • by Population ( 687281 ) on Thursday October 23, 2003 @09:19AM (#7289605)
    It only took a few hundred dollars to pay her off.

    Even extortion is cheaper when done overseas.
  • by Dairyland.Net ( 547845 ) on Thursday October 23, 2003 @09:19AM (#7289615) Homepage
    Companies are setting themselves up for a big hurt when they outsource overseas. This intance shows just some of the dangers and downfalls. Eventually, it's going to come around and bite them in the arse. What happened to all the forward thinkers? The over-zealous drive for profits and cost savings for today without thinking about tomorrow hurts us all - from the executives, to the workers, to the consumers, and, yes, even the shareholders. For example, America's technological edge is dying all because of overseas outsourcing. Why would any kid want to go to college for CS/IT when the job prospects are so miserable?
  • by mariox19 ( 632969 ) on Thursday October 23, 2003 @09:20AM (#7289618)

    The article describes what amounts to a chain of subcontractors handling the medical transcriptions. The top of the chain is a firm in Sausalito handling medical transcriptions, which hired a subcontractor in Texas, who then farms out work to a network of subcontractors -- which led to the woman in Pakistan.

    I think the guy in Texas should be held liable, no? He's the one playing fast and loose with patient privacy, and I can't imagine he has no legal culpability here.

    Anyone out there have an understanding of the legal framework for something like this?

    • No, the persons that should be held liable are the hospital administrators who were so concerned with profit that they didn't give a damn about confidential patient information. But that won't happen until someone dies, if that.
    • IANAL, but I have worked on contracts long enough to know similar cases, and work in something similar.
      Provided thier is no language forbiding subcontracting this is all legal, don't count on that almost no one does this. The hospital only legal problem is with the original company, it is with who they have the contract and it is they who is responsible for the work done. It does not matter to the hospital who does the work as long as it is done in accordance to the contract.
      Now the top contractor after
  • by sjbe ( 173966 ) on Thursday October 23, 2003 @09:21AM (#7289624)
    Disclosure: I've worked in hospital administration so I've seen this stuff first hand.

    Medical service providers are under a lot of pressure to reduce costs. So outsourcing isn't surprising and can work really well. Outside of medicine, hospitals tend to be pretty technically unsophisticated. But there also is the fact that medical organizations tend to be very rigidly heirarchical. Once data or a patient leaves the department, no one cares what happens to it. It's not right, but it is reality. Once you combine the two we have problems. Stuff gets outsourced and no one follows up to find out where to.

    There has been a big stink about medical privacy (and rightly so) but in real terms it is not as private as it should be. HIPPA? Please. HIPPA just codifies what medical personnel were supposed to be be doing anyway. And if you think your charts don't get discussed and shared you're kidding yourself. Medical people are some of the most gossipy folks I've ever met.
  • "I can't believe this happened," Kaneko said. "We've been working for UC for 20 years, and nothing like this has ever happened before."

    Yeah, because your orginization didn't jump on the cheap-labor-train before.

    Hell, if you send sensitive data overseas to a extremely low paid transcriber, are you really surprised? Especially when you stiff them for their paltry $500 pay. LOL, was the cheap labor worth it now?

  • by sydbarrett74 ( 74307 ) <<sydbarrett74> <at> <gmail.com>> on Thursday October 23, 2003 @09:24AM (#7289647)
    The title says it all.
  • Let's see, I can farm out my company's grunt-work overseas, because there are no US federal regulators there enforcing employment, wage, standard, etc. laws.

    Simultaneously, of course, there are no (enforceable) IP, trademark, copyright, security, reporting, or competition laws.

    Seems distinctly like 2 sides of the same coin to me. Congratulations, you've just saved your company $500,000 in outsourcing your coding jobs to Indian programmers, while simultaneously bankrupting the firm of all future business
  • This is the problem with outsourcing. You have to trust the 3rd party and be aware of what they are doing. Surely some sort of checking would be made before hand and some legal representative should at least look at what is going on..

    Rus
    • You're too kind. It's not just third party -it's fourth party, fifth party, and more. How far down the chain was the woman in the article?

      I agree - people need to think of the issues.
  • how about just paying the guy his due amount.

    There laws may not be our laws but contracts are contracts and the thing to question is who is breaking the contract, nullifying any responsibility of the transcriber has to adhear to the contract?
  • What with medical records being transcribed overseas in countries with no privacy protection...
    HMOs who consider a hangnail as a "pre-existing condition" [healthinsure.com]...
    Employers doing medical database checks as a condition of employment [prairielaw.com]...

    I've decided I'm just not going to get sick.

    Chip H.
  • Even Worse!! (Score:5, Interesting)

    by moehoward ( 668736 ) on Thursday October 23, 2003 @09:35AM (#7289724)
    Even worse! They SELL the info to drug companies!

    I once mentioned a certain problem (side effect of a drug) to a doctor. 7 years ago or so. I was not being treated for it, but he wrote in in his notes. Lo and behold, a month later, I start getting ads in my mail from drug companies for this problem. Not something common. I told the doctor and he was in shock. He agreed that the transcription company must have sold the info. He refused to follow up on it, as did I. In retrospect, I could have caused a stink, but I'm not at all convinced I would have gotten any satisfaction.

    I strongly suggest taking your lawyer with you on all doctor's visits. I now review doctor's notes completely (after transcription) and force them to make corrections. It is amazing what sorts of errors the transcription companies make in the notes. And this is what insurance companies look at when you apply for insurance.

    In all, I'm pretty frightened of the medical system after a couple of incidents. I avoid the system at all costs. The funny thing is that it is this fear of the system, not of disease, that has actually prompted my very healthy lifestyle. I don't ever want to have to depend on that system for anything. Even the "nice good" doctors who are a part of it are to blame for idly sitting by and letting it all happen. They like to pretend that they are just pawns in a bigger game. Not!
  • With tablet PC's and the like, doctors down here in Houston (at least at my wife's 20 doctor clinic) are starting to enter their own records.

    This sort of problem only happens at the huge hospital systems, not your regional health system.

  • It cuts both ways (Score:5, Insightful)

    by Bazzargh ( 39195 ) on Thursday October 23, 2003 @09:45AM (#7289787)
    Remember this [com.com]:

    "A group of American companies is attempting this week to persuade the European Union to relax its rules governing data protection, claiming they are bad for business.
    [...]
    The EU passed the Data Protection Directive in 1998, and this has subsequently been implemented into national law by all but two--Ireland and Luxemburg--of the EU's member states.

    As well as regulating the buying and selling of personal data about European citizens and forcing Web sites to tell users when data about them is collected and allow users to refuse disclosure, the Data Protection Directive also restricts the flow of information about Europeans to companies based in countries with--in the view of the EU--more lax privacy standards.

    The Global Privacy Alliance says that this directive makes it hard for companies to engage in the kind of data flow that they claim is vital for modern e-enabled businesses."

    That would be the kind of data flow where they take your medical data, and farm it out to a country with no effective privacy laws, then?

    Its interesting that the EU law would not only have prevented your medical data going to Pakistan, it would have prevented it going to the US - because far from having "strict standards to protect patients' medical data", the US laws allow moving private data to countries with lower privacy standards!
  • by Jammer@CMH ( 117977 ) on Thursday October 23, 2003 @09:46AM (#7289799)
    Rember how pissed-off these made US businesses, who resented being pressured to comply with EU laws regarding data outsourced from the EU (or otherwise concerning EU citizenry?) Now it seems that this model is not such a bad thing. Interested US parties (some hospitals, at least) now seem to be pushing for a model whereby they can enforce US data-protection laws on data concerning US citizens when it goes overseas.
  • Transcription (Score:2, Informative)

    by scarolan ( 644274 )
    My dad is a doctor and I used to always be amazed how fast he could dictate his notes at the end of the day. He'd fly through a pile of 100 folders in about 45 minutes or less.

    Even more amazing is the girl who comes in to type all this stuff up - she does 120 words a minute with no errors!

    In any case there are certain things which should never be outsourced overseas, one of them being sensitive medical records.

  • This will put a severe crimp in the growth of outsourcing of services such as data entry.

    Apart from subcontractors in the U.S. quaking in their boots because of potential liability they'll face under U.S. law, there will also be many in Pakistan [g77tin.org] unhappy with the consequences of fewer companies wanting to risk something like this happening again in the future.

  • After reading all those (rightfully) outraged comments I can't avoid a thought.

    Usually, when the fairly stiff EU privacy protection laws come up there's a lot of "haha's", "this is bad for business" and "that's what you get for socialist governments" comments.

    This example shows very drastically why we got those laws in place (which among other things generally prohibit data export to countries which don't have adequate privacy protection laws) and why they are generally a good thing.

    This is not to say th


  • Call 1-800-ISUE-BIG

    Wouldn't it be incumbant on the medical centre to make all reasonable efforts to protect patient data? If they choose to outsource operations, then it is their responsibility to ensure that the ousourcing agency takes the necessary steps to preserve confidentiality, or it is their legal A$$ that is on the line.
  • I've worked in the medical transcription industry for some time and the providers KNOW that their work is being sent overseas. They don't know and don't care as long as their line/page rate is cheap.

    I've been involved in several contract negotiations where outsourcing was explicitly brought up and it was made very clear that they don't care how the work gets done as long as they get it cheap. These are large hospitals, too.
  • by christoofar ( 451967 ) on Thursday October 23, 2003 @09:59AM (#7289907)
    I know of a particular BIG insurance company here in Texas that outsources a LOT of their core work overseas. This company happens to cater to members of the US armed forces and civil service employees. When people get deployed or move, they have to call this company to have all their addresses changed.

    To think... now India and Pakistan probably now have a good listing of where a lot of our US service members are located. It's glad that India and Pakistan are our "aliies" or we'd really be in the shit now...
  • Two things to consider.

    One, is this the first time something like this has happened, or just the first time it's made such a public stink?

    Secondly, is this case going to create copycats? How many people out there now in a similar situation will look at this and see dollar signs?

    Food for thought. Junk food, at least.

  • or at least somebody making fun of this one yet:

    "Information wants to be free..."

  • What is the problem, whoever sent this information to an uncontrolled location is in trouble.
    By releasing it to someone who may violate the disclosure policy they have apparently not fufilled their requirements.
    Just trace it back, who gave it to this person, they should not have done that without proper assurances, and they are responsible.

    You MUST not release information except to trusted parties.!!
  • How about the dangers of not paying your employees?

    Well, that's what I wanted to write, at first, but then I actually read the article and realized that contrary to the submitter's disingenuous suggestion, the woman was not unpaid, but wanted more money.

  • Should not the export (for whatever reason) of that data be prohibited, or at least limited to requiring written consent of it by the owner of the data (the person) with the explicit understanding that there are no guarentees of it's safety when it leaves the country....
  • by devnullkac ( 223246 ) on Thursday October 23, 2003 @10:17AM (#7290111) Homepage

    Perhaps medical transcription companies should take the SETI@Home approach: digitize all the data to be transcribed, slice it into overlapping chunks of about 20 seconds each, and distribute the work as widely and randomly as possible. In the process of transcription, workers mark fragments as partially or completely unintelligible/incomprehensible so that new larger fragments can be sent out for only those sections which really need more context or the same fragments can be sent to workers who are more likely to understand a heavily accented speaker. Unlike SETI@Home, however, this is a money-making enterprise, so some sort of micro-payment scheme would need to be established.

    No one person would likely have enough information to be dangerous, as long as the (automated) process of assembling the results is done in a trusted (and prosecutable) environment.

    Of course, this is just an automater's dream... it would in the end be vastly more expensive than simply managing the subcontractor problem as-is.

  • This story hilights one of the biggest fundamental flaws in US privacy laws: personal information can be sent to out of country subcontractors who can do whatever they want with that data. And they can do so with impunity.

    want to slow down US and European job loss?
    I wonder how popular outsourcing IT will be if we restrict the outsourcing of private customer information processing to only countries with recriprocal laws or treaties on the books?
  • Well that cheap ass company got exactly what they deserve. When will companies learn that pretty much anything goes once you leave the aegis of American Law system? Sure you'll save a few bucks but how can you trust private data with a company in the third world?

    Here is an article on Wired which panders the need for 3rd world workers.

    A Case for Coolie Labor [wired.com]
  • by StandardCell ( 589682 ) on Thursday October 23, 2003 @10:46AM (#7290393)
    Just wait until this thing gets a bit wider publicity. You can be sure that holding individuals for ransom from the developing country for a developed product will get more and more common due to the copycat factor. I have a funny feeling that this is only the beginning of a large landslide.

    Even worse, wait until outsourced hardware design starts showing how faulty it can be. Where engineers can be held responsible for products that overheat and kill over here, imagine if someone in a third-world country decides to be lazy and not put overcurrent protection on a device in a certain mode that UL safety guidelines happen to not specifically cover. People could end up having their houses burn down. Now, while the company can be held liable, what about the engineer? He can just disappear into the background noise, never be held responsible, and never become an example to others in his community of what happens when a product is shoddily engineered to meet a raw cost objective.

    I think there is some optimism that comes from this story, however. It may yet prove that outsourcing is an enormous mistake for many companies. Particularly when the spectre of massive lawsuits is involved, I think that insurance companies will get increasingly involved in these situations. The cost advantages of outsourcing never factored in the increased liability risks presented to the company from the antics and poor quality of work of their outsourced workers in the first place. I don't like insurance companies any more than the next person, but neither do I think insurance companies have discovered to what degree their insured could be subjected to precisely these types of scenarios. Maybe what the geek community could do is start a campaign to inform insurance companies and their actuaries of these situations in order to raise the rates of companies who outsource. Maybe - just maybe - they could once again swing the balance of favor towards workers here.
  • by zericm ( 21972 ) on Thursday October 23, 2003 @12:18PM (#7291515) Homepage Journal
    Forest for the trees, kids. Yes, your medical records may be over seas, but that is the small prize. Financial services companies have off-shored a lot of work to India, work that involves financial records. Think about: your name, address, social security number and account information may be sitting in India as I type this.

    Someone in another posting made a joke about extortion being cheaper becaue of reduced labor costs. Not much of a joke, really. Someone based in the US will most likely turn down an offer of US$5,000 for complete information -- including SS# -- for accounts with at least US$1 million in net assets. But that US$5,000 looks very attractive to a person based in India, a country where the average annual income is US$4,000, and US$30,000 is salary for a top notch programer.

    It is only a matter of time.

    thx,
    Eric
  • by YrWrstNtmr ( 564987 ) on Thursday October 23, 2003 @02:53PM (#7293446)
    Buying a car last year, the saleswoman had a question on some of the forms.

    She asked a more senior salesperson...
    I overheard:
    "Yes, we have to fill that in very carefully, so the transcribers in Mexico can enter it in the computer properly."

    This, with a technically US-based bank loaning the money.

    Now...nothing against Mexico, per se, but shipping *my* info over the border for processing just to save a buck or two is ridiculous.

1 + 1 = 3, for large values of 1.

Working...