That is a very interesting point that I never thought of.
Thank you
-Original Message-
From: Hazelrigs, Jim [mailto:[EMAIL PROTECTED]
Sent: Thursday, March 20, 2003 4:02 PM
To: '[EMAIL PROTECTED]'
Subject: FW: Can someone assist me in this topic?
Since one can not enforce US laws in a foreign county, there is no legal recourse if the Indian firm violates the HIPAA law; therefore there is no full protection to the patient under the law. I would if I was an attorney, use that to the fullest in any court action and I would argue that it was the intent of any firm doing business with a foreign form not to provide for HIPAA mandated protections.
For that reason and the fact that there have been cases where employees of Indian data entry companies have sold social security numbers to the Russian mafia (identify thief), we will not work with any firm located overseas in the processing of medical claims. There also remain economic strategic and political issues involved with any decision to of this type.
-Original Message-
From: William J. Kammerer [mailto:[EMAIL PROTECTED]
Sent: Thursday, March 20, 2003 2:39
To: WEDI SNIP Privacy Workgroup List
Subject: Re: Can someone assist me in this topic?
The WEDI SNIP Privacy Workgroup List would be the appropriate place to ask questions regarding the HIPAA Privacy Rule.
A covered entity provider is required to have a business associate agreement with Fast Medical Reports. The provider is not to continue using a business associate if it has any reason to believe the BA is not abiding by the BAA to take as good care of the patients' PHI (as the provider is, compelled by law). Likewise, business associates should themselves have appropriate safeguards and contracts in place with their own contractors. This ensures your own contractors don't put you in danger of indirectly violating the BA agreement with the provider. Neither you nor your overseas contractors are bound by HIPAA - only by BA agreements, contracts and other applicable law - since you are not HIPAA covered entities.
Neither Fast Medical Reports nor the provider are obligated to inform patients that their records are being manipulated offshore. But the provider has every right to know who your subcontractors are, though, since he is directly accountable to HIPAA regulators for any misuse of PHI.
India is not Indiana. Is there any reason to believe Fast Medical Reports would be able to enforce its own contracts with Indian offshore subcontractors? If India had a reliable legal system with an infrastructure of trust comparable to those of the U.S. or Canada, it would have long ceased to be a Third World country - and probably would not have large labor cost differentials to export. If for some reason there were a problem, Fast Medical Reports would probably be left holding the bag (financially) for the actions of its Indian subcontractor.
Your rationale for outsourcing is much the same any American company chooses that course: the savings may not be that much for each transcription (or shoe or dress or piece of computer software code), but when all lumped together, provide handsome bonuses for executive management.
William J. Kammerer
Novannet, LLC.
Columbus, US-OH 43221-3859
+1 (614) 487-0320
- Original Message -
From: [EMAIL PROTECTED]
To: "WEDI SNIP Privacy Workgroup List" [EMAIL PROTECTED]
Sent: Thursday, 20 March, 2003 12:50 PM
Subject: Can someone assist me in this topic?
I was told that this group might be able to help me with some interpretation of an issue I'm facing. I have just subscribed so pardon me if this is the wrong forum
We provide medical transcription and coding services to physician practices. To give our clients a little better price, our transcription and coding is provided by a company that produces does the work in India.
Our dilemma is that we are in a debate with a couple of the practices over disclosure of the organizations that are involved in the business functions. The practices say that they are obligated by law to disclose to the patients that their records are across seas with companies who are not governed by US laws and regulations. I suggest that it may be an ethical question but not a legal requirement.
My concern is possible public backlash that would force us to produce the transcription here in the US. Although the savings are not significant on individual accounts for us to send it over seas, they do add up when all put together. I'd have to raise my prices to produce it here.
Is a physician or practice legally required to notify the patients that their records are being processed outside of the US by companies or individuals who aren't necessarily bound by HIPAA?
Thank you kindly for your assistance.
Melissa
Fast Medical Reports
California
---
The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not
