|
Article Excerpt
I. INTRODUCTION
Using personal medical and financial information to blackmail unsuspecting individuals may sound like the plotline to a conspiracy theory movie. In reality, it may also be a consequence of the practice of outsourcing electronic data to foreign countries for business processing. Since the fall of 2003, major newspapers have reported at least two instances of threats by foreign medical record transcriptionists to release patients' medical information via the Internet. (1) On October 7, 2003, a medical transcriptionist in Karachi, Pakistan, sent an email message to the University of California San Francisco Medical Center ("UCSF"), demanding payment for her work, with patient files attached. (2) In a similar incident only a few weeks later, Heartland Information Services ("Heartland"), an Ohio-based company, received an email message from its own employees in Bangalore, India, who attempted to extort money by threatening to reveal confidential material. (3)
The average patient would not normally know if her medical information was transmitted abroad following a hospital visit. Transcription of medical records generally is classified as one of the operations for which health care providers can disclose individuals' information without meeting the statutory requirement of obtaining consent. (4) Sometimes medical records awaiting transcription are forwarded, without the knowledge of the health care provider, to several different individuals through subcontracted relationships. For example, in the UCSF incident, the medical center had outsourced its medical record transcription to a California-based company, which in turn had subcontracted with an individual in Florida. (5) Against the terms of her original contract with the California-based firm, the subcontractor in Florida had subcontracted work to an individual in Texas, who, unbeknownst to her, had solicited work from the freelance transcriptionist in Karachi. (6)
On the other hand, some health care providers knowingly outsource their records transcription to companies that use overseas employees to complete the work. (7) Heartland's extortion threat is perhaps more alarming than the UCSF incident because, while its clients knew their work was being sent overseas, the company never informed them of this incident. (8) Moreover, the company's representative failed to mention the incident during his appearance at a hearing before state legislators in California on the subject of industry safeguards to protect outsourced information. (9)
Although the Supreme Court has implied that it might recognize a right to privacy of personal information, (10) the current legal environment provides limited remedies to those whose privacy rights are transgressed. (11) In the face of a technological world advancing at a rapid rate, legislative action is the only way to guarantee individuals protection of their private information. However, legislators fear that adequate privacy protections will only be implemented as a result of some future scandal. (12) Privacy rights experts warn that just such a scandal is on the horizon. (13)
This article addresses the threat of disclosure to consumers' private, personal information due to the increasing practice of outsourcing business processes to foreign companies. By way of introduction, it examines the trend of outsourcing: what jobs are commonly outsourced, in which industries, and the reasons why the practice has become increasingly common in the global economy. The article continues by describing the kinds of personal information that are commonly shared in outsourcing practices and examines two industries in depth: Internet-based loan processing and medical record transcription.
To analyze consumer rights and remedies in this context, the article considers the notion of a right to privacy in one's personal information, and then discusses federal statutes and case law which may enable such a right, in particular, the Health Insurance Portability and Accountability Act of 1996 (14) and the Gramm Leach-Bliley Act. (15) The discussion then focuses on the remedies provisions of each of these statutes, as well as possible common law tort remedies for disclosure of personal information. Next, the article turns to the special problem created by outsourcing to foreign-based companies and what effects this situation has on the availability of remedies to individual consumers; it addresses some international legislation on the subject and discusses the possible approaches to resolution of Internet-based disputes. Finally, the article analyzes proposed legislation on this subject in the U.S. This article concludes that individual consumers currently have no realistic remedial option for any injury incurred due to unwanted disclosure of their outsourced private, electronic information. To remedy this situation, consumers must demand legislation, specifically conferring liability for U.S. businesses that choose to outsource consumer data and an individual right to civil action against those companies.
II. BACKGROUND
A. What is Outsourcing?
The business practice of using other companies, either domestically or internationally, to fill jobs formerly performed in house, or more succinctly, "the transfer of jobs to low-cost labour markets" is known as outsourcing. (16) In the international context, the practice is sometimes referred to as offshoring or global outsourcing. (17) While Americans may view outsourcing as an economic problem unique to their country, the same concerns exist among European Union Member States and other countries. (18)
Although the United States saw a similar job market shift in the 1970s, when manufacturing jobs began moving overseas, the current outsourcing trend dates from the 1990s. (19) At that time, companies, which had formerly supplied all of their own business service needs, began looking for foreign labor sources "to remain competitive by reducing costs and increasing shareholder value." (20) The trend accelerated in the late 1990s with Y2K fears causing an increase in demand for computer software work. (21) At present, the outsourcing trend commands major attention from both the news media and politicians. Lou Dobbs, of CNN television, has devoted part of his show to an on-going segment entitled "Exporting America." (22) Outsourcing was also among the topics of discussion during the televised debates for the last U.S. presidential election. (23)
Outsourced service jobs originally consisted primarily of customer service and call center positions. (24) However, companies now also outsource technical support positions and even more professional, "white-collar" jobs. (25) The outsourcing of service-based jobs is even more cost effective than that of manufacturing jobs, as:
[I]nformation-based analytical services (for example, information technology, Internet, accounting, medicine, legal services, financial consulting, banking, and silicon-based business) and more mundane information services (for example, data processing) can fly through cyberspace at virtually no cost. More concretely, the auditing of electronic-based financial records, meeting transcriptions, or hearing records, now can be performed conveniently anywhere in the world for instantaneous use anywhere else in the world. We have only just begun. (26)
The use of outsourcing spans across all industries. (27) However, the prevalence of outsourcing varies by industry. By 2005, estimates of outsourced legal services predict displacement of only 15,000 U.S. lawyers. (28) On the other hand, experts anticipated higher growth rates in the outsourcing of IT services in 2004. (29) By some estimates, "at least one-third of new IT development work for big U.S. companies is [now] done overseas." (30) Overall, economists predict that a minimum of fourteen million service-based jobs could be outsourced in the next ten years. (31)
B. Types of Private Information Shared through Outsourcing
As a result of outsourcing on the part of U.S.-based companies, personal information is transferred electronically to contracted vendor companies in foreign countries. The list of countries with outsourced labor is growing and currently includes: China, Ghana, Guatemala, India, Ireland, Jamaica, Mexico, Pakistan, and the Philippines. (32) Personal information being shared electronically includes: social security numbers, credit card numbers and balances, credit histories, mortgage information, tax documents, investment and brokerage information, insurance records, billing records, employee records, and medical records. (33)
Shared financial information is utilized in outsourced credit-reporting services, (34) income tax preparation, (35) debt collection services, (36) and loan processing services. (37) Medical and health information about patients is transferred to foreign companies for medical record transcription, billing, and data entry for insurance firms. (38) Most of this information is transferred for "business-process outsourcing," or BPO, outsourced back-office operations and call center work. (39) Although BPO is a nascent industry, it is quickly growing. In India, the BPO industry is only five years old; yet, according to the Indian trade association, NASSCOM (National Association of Software and Services Companies), the past year showed more than a fifty percent increase in industry revenues. (40)
C. Internet-based Loan Processing
Loan applications submitted to American Internet-based lending companies are often processed by foreign BPO companies, such as India's Wipro Spectramind. (41) Wipro employees in India view the loan application and documentation via a private data link on the Internet, analyze the information, and process the application. (42) These Indian employees have college degrees, but work for significantly less than loan processors in the U.S. (43)
The time difference between India and the U.S. makes BPO loan processing even more efficient. Because India-based employees work while U.S.-based employees sleep, lenders can reduce normal loan-processing time from twelve days to only ten. (44) At least one U.S. Internet-based lender allows its applicants to choose whether their loans are processed in the U.S. or India. (45) In doing so, the company assures these applicants of a shorter process time and avoids criticism from consumers about its choice to utilize BPO. (46)
D. The Medical Transcription Industry
Physicians and other health care providers often use dictation to record their notes during intake, medical history, and treatment of patients. (47) Medical transcriptionists are employed to convert these dictated notes into a written medical record, either in paper or electronic form. (48) Ideally, physicians should follow up by reviewing the finished record, although they often do not. (49) Medical transcriptionists are more than mere typists; their work requires knowledge of human anatomy and medical terminology, as well as the ability to find inconsistencies in highly technical dictated information, in order to avoid mistakes in the final medical record. (50) The professional organization, the American Association for Medical Transcription (AAMT), (51) now provides for credentialing of Medical transcriptionists through its certification program. (52)
The average consumer is unaware of the role that medical transcriptionists play in the health care system. (53) The profession remains largely unknown, especially as most medical transcriptionists work in places far removed from the clinics and hospital examining rooms in which medical care is provided. (54) Because of the off-site nature of the profession, the means of transferring dictation records and completed patient records to and from transcriptionists becomes an important issue. Medical transcription is essentially the process of turning oral material into written material. (55) However, due to the increasing use of technology in methods of dictation and transfer of files, medical transcriptionists must be comfortable utilizing these technologies and protecting the confidentiality of patient information in the process. (56)
Traditionally, dictated data is recorded and transferred from a health care provider to a transcriptionist in one of three ways: dictation into a machine with removable tapes that are provided to the transcriptionist; dictation into a phone-based recording system permitting the transcriptionist to call in to access files; or dictation into a phone-based or hand-held recording system that directly transfers digital audio files to the transcriptionist's computer. (57) Several methods of returning the transcribed medical records to the health care provider are also available:
Text files can be encrypted and e-mailed to the provider, printed by the transcriptionist and delivered after printing, printed remotely by the transcriptionist on the provider's printer, or transferred to the provider's location by direct PC-to-PC connection over the internet. (58)
However, the rise of Internet-based transcription services is rapidly expanding the gamut of technologies utilized in medical record transcription.
Avicis, a Virginia-based company, is one of the largest Internet-based transcription service providers. (59) Avicis employs dictation technology developed by partner companies, such as Dictaphone (60) and IQMax, (61) to allow health care providers to dictate digital voice files into a dictation system or handheld device. (62) The voice files are transmitted within seconds to Avicis via secure data lines, accessed through the provider's phone system with a modem. (63) Avicis utilizes dictation technology to automatically transcribe dictation files into computer-generated printouts. (64) Medical transcriptionists then review and correct these printouts. (65) Completed, transcribed records are then electronically returned to the provider. (66) Avicis uses encryption to transmit the transcribed records and virtual private networks (VPNs) to send and receive digital files from its offsite transcriptionists. (67) Avicis employs transcriptionists both in the U.S. and India; most of its American employees work from their homes, while the Indian employees work in a secure, limited-access facility. (68)
By some estimates, only thirty percent of American medical record transcription is done outside of the U.S. (69) Many U.S.-based companies operate transcription and transcription management systems for health care providers who maintain their own transcription staff. (70) However, providers are increasingly looking to Internet-based and international transcription services to lower costs. (71) One major risk of Internet-based transcription services is that health care providers may never know exactly where the work is done, or to whom their patients' records are being sent. (72)
III. ANALYSIS
A. Federal Statutes & Case Law Conferring Privacy Right to Personal Information
As a preliminary matter, it is important to note that there is no comprehensive privacy law in the U.S., (73) nor is there a recognized...
|
