With expertise quickly evolving and jurisdictions showing blurred, it’s more and more essential to be aware of knowledge circulate and use. That is significantly true the place affected person knowledge is being accessed by offshore subcontractors.
Merely put, offshoring happens the place a celebration contracts for providers to be rendered, in complete or partly, by one other social gathering positioned outdoors of the USA and its territories. Inside the healthcare business, offshore contractors are generally used for claims processing, name middle staffing, and technical help, as offshoring contractors typically present price financial savings. These actions inherently contain mass quantities of affected person knowledge.
As healthcare companies contract with third events to offer help providers, software program, and different choices, significantly the place offshore assets can be utilized, it’s critical that the events fastidiously navigate the interaction of legal guidelines, laws, and steerage, that are complicated and infrequently inconsistent, to make sure compliance. This Weblog gives a excessive degree abstract of some materials issues relevant to offshoring actions.
HIPAA
The Well being Insurance coverage Portability and Accountability Act of 1996 (“HIPAA”) and its implementing laws are ordinarily on the forefront of most conversations in regards to the privateness and safety of affected person knowledge. Apparently, nonetheless, HIPAA doesn’t explicitly prohibit offshoring of affected person knowledge. HIPAA does, nonetheless, require that regulated entities implement affordable and acceptable administrative, bodily, and technical safeguards to make sure the privateness and safety of protected well being info,[1] that enterprise affiliate agreements are executed the place acceptable,[2] amongst plenty of different compliance measures. Consequently, regulated events should take steps to make sure compliance with HIPAA, significantly when utilizing offshore assets which can current distinctive privateness and safety issues. Additional, offshore corporations will not be versed in HIPAA or have a HIPAA compliant infrastructure in place. HIPAA particularly prohibits a coated entity from participating with a enterprise affiliate or subcontractor that it is aware of will not be in compliance with HIPAA.[3]
Medicare Authorities
On July 23, 2007, the Facilities for Medicare and Medicaid Providers (“CMS”) issued steerage (the “Medicare Steerage”) to Medicare Benefit Organizations and Prescription Drug Plan Sponsors particularly addressing actions carried out offshore. Specifically, the Medicare Steerage famous that offshoring presents “distinctive dangers” and inspired Medicare Benefit Organizations and Prescription Drug Plan Sponsors to take “extraordinary measures” to make sure that offshore relationships appropriately safeguard affected person knowledge. Specifically, the Medicare Steerage gives that:
CMS is asking all organizations utilizing offshore subcontractors to submit particular subcontract info and an attestation that they’ve taken acceptable steps to handle the dangers related to the usage of subcontractors working outdoors the U.S. Organizations should submit one attestation for every offshore subcontractor they’ve engaged to carry out Medicare-related work.
The attestation typically should handle: (1) the id and performance of the offshore subcontractor; (2) an outline of any protected well being info that can be accessible by the offshore subcontractor; and (3) the safeguards adopted by the offshore subcontractor to safeguard protected well being info. Along with the attestation, the regulated events should take steps to audit the offshore subcontractor.[4]
You will need to word that the foregoing Medicare Steerage doesn’t prohibit offshoring of affected person knowledge, however reasonably imposes plenty of hurdles that are supposed to make sure that acceptable measures are in place to safeguard the privateness and safety of protected well being info.
Medicaid Authorities
From a federal perspective, Part 6505 of the Reasonably priced Care Act (the “ACA”) amended Part 1902(a) of the Social Safety Act to ban states from making funds for gadgets or providers offered underneath a State Plan (or a corresponding waiver) to a monetary establishment or entity positioned outdoors of the USA. CMS issued steerage (the “Medicaid Steerage”) in December of 2010 which clarified that “[t]asks that help the administration of the Medicaid State plan that will require funds to monetary establishments or entities positioned outdoors of the USA usually are not prohibited underneath this statute.” As well as, the Medicaid Steerage additional clarifies that “funds for outsourcing info processing associated to plan administration or outsourcing name facilities associated to enrollment or claims adjudication usually are not prohibited underneath this statute.”
In gentle of the foregoing, though Medicaid businesses can’t pay for healthcare advantages or providers to any entity positioned outdoors of the USA or furnished by offshore suppliers, funds for administrative capabilities carried out by offshore subcontractors are permitted. The latter would come with providers which contain entry to and use of affected person knowledge.
Constructing on the inspiration established by federal legislation, it is very important take into account state legal guidelines and laws particular to Medicaid, as offshoring limitations range throughout jurisdictions and are sometimes addressed in frequently-revised manuals. For instance, Texas authorities prohibit Managed Care Organizations (“MCOs”) and their subcontractors from permitting Confidential Info they “obtain from or on behalf of HHSC to be moved outdoors of the USA by any means (bodily or digital) at any time, for any time frame, for any cause.”[5] As well as, MCOs and their subcontractors are prohibited from allowing “any particular person to have distant entry to HHSC info, methods, or Deliverables from a location outdoors of the USA.”[6]
You will need to study Medicaid-specific authorities adopted by the pertinent states to find out whether or not they impose impartial limitations or necessities on use of offshore assets.
State Authorities
Past Medicaid-specific legal guidelines, laws, and steerage, plenty of states have taken steps to restrict or in any other case outright prohibit offshoring of affected person knowledge. For instance, the Florida Legislature amended the Florida Digital Well being Information Change Act (the “Act”) in Could of 2023 to ban sure well being care suppliers using licensed digital well being file applied sciences from storing certified digital well being information[7] outdoors of the USA, its territories, or Canada.[8] Considerably, the prohibition additionally extends to certified digital well being information which can be saved by way of a third-party or subcontracted computing facility or cloud service supplier.[9] In impact, qualifying well being care suppliers could not themselves retailer certified digital well being information offshore, nor can they depend on third-party distributors who function offshore to retailer such information. This idea turns into a priority the place a 3rd social gathering contractor outdoors of the USA, its territories, or Canada, corresponding to an IT help vendor, digital well being information platform, or knowledge entry subcontractor, is ready to entry certified digital well being information which can be in any other case saved on servers inside the USA and makes use of that entry to create or retailer copies in violation of the Act.
Equally, some Governors have issued government orders prohibiting offshoring of sure actions that are paid for by state businesses. For instance, Government Order 2011-12 and Government Order 2019-12D in Ohio prohibits state businesses from getting into into any contract which use any funds inside such company’s management to buy providers outdoors of the USA. The Government Order particularly gives that it applies “to all purchases of providers made instantly by an Government Company and providers offered by subcontractors of these offering providers bought by an Government Company.” The foregoing are significantly noteworthy as they’re don’t particularly goal the healthcare business or affected person knowledge.
It’s important to look at state authorities to find out whether or not they impose impartial limitations or necessities on use of offshore assets.
Contractual Authorities
Contracts with payors, Medicare Benefit Organizations, state Medicaid businesses, and a broad array of different events might also incorporate restrictions or necessities related to offshoring. That is vital as contracts could restrict or prohibit offshoring even the place federal or state legal guidelines and laws wouldn’t prohibit it. Consequently, it’s a greatest apply that healthcare organizations overview their agreements to evaluate whether or not there are any particular contractual necessities or limitations related to offshoring. These points typically come up in due diligence as properly. Subsequently, potential consumers and sellers needs to be aware of those issues. Lastly, it is very important preserve offshoring prime of thoughts when negotiating a contract, as the difficulty is extra generally addressed in contracts as offshoring actions proceed to rise.
In case you have any questions in regards to the interaction of those legal guidelines or their influence in your group, please contact a member of the Sheppard Mullin Healthcare Crew.
FOOTNOTES
[3] 45 C.F.R. § 164.504(e)(1)(ii).
[4] Steerage subsequently issued by CMS on September 20, 2007, clarifies that the attestation requirement solely applies the place the offshore subcontractors “obtain, course of, switch, deal with, retailer, or entry beneficiary protected well being info (PHI) in oral, written, or digital type.” Sponsor Actions Carried out Exterior of the USA (Offshore Subcontracting) Questions & Solutions, September 20, 2007.
[5] Uniform Managed Care Phrases & Situations, Texas Well being & Human Providers Fee, Attachment A, Part 4.11(c)(1).
[7] Fla. Stat. § 408.051(3). For functions of the Act, a “certified digital well being file” contains “an digital file of health-related info regarding a person which incorporates affected person demographic and medical well being info, corresponding to medical historical past and drawback lists, and which has the capability to offer medical choice help, to help doctor order entry, to seize and question info related to well being care high quality, and to trade digital well being info with, and combine such info from, different sources.” Fla. Stat. § 408.051(2)(i).