[Med-privacy] SFChronicle: A tough lesson on medical privacy: overseas transcription threat
DPeelMD@aol.com
DPeelMD@aol.com
Wed, 22 Oct 2003 22:57:57 EDT
-------------------------------1066877877
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Without a federal right of consent, US patients cannot stop and personal=20
health information from going into their medical records; and on to Pakistan=
!
=20
The Amended HIPAA Privacy Rule eliminates US patients' rights to consent to=20
ROUTINE uses of their medical records--like for transcription overseas. Unde=
r=20
the amended Rule transcription is a ROUTINE and legally permitted use of eve=
ry=20
American's medical records. The ROUTINE uses of medical records now permitt=
ed=20
clearly expose everyone's sensitive personal health information to people in=
=20
foreign lands who will use it as they see fit.
=20
Overseas, nothing can stop Pakistani transcriptionists and businesses from=20
selling or using Americans' medical records for any purpose, including extor=
tion.
Deborah Peel MD
A tough lesson on medical privacy=20
Pakistani transcriber threatens UCSF over back pay=20
David Lazarus
Wednesday, October 22, 2003=20
=A92003 San Francisco Chronicle | Feedback=20
URL: sfgate.com/article.cgi?file=3D/c/a/2003/10/22/MNGCO2FN8G1.DTL=20
"Your patient records are out in the open... so you better track that person=
=20
and make him pay my dues."=20
A woman in Pakistan doing cut-rate clerical work for UCSF Medical Center=20
threatened to post patients' confidential files on the Internet unless she w=
as=20
paid more money.To show she was serious, the woman sent UCSF an e-mail earli=
er=20
this month with actual patients' records attached.=20
The violation of medical privacy - apparently the first of its kind -=20
highlights the danger of "offshoring" work that involves sensitive materials=
, an=20
increasing trend among budget-conscious U.S. companies and institutions.=20
U.S. laws maintain strict standards to protect patients' medical data. But=20
those laws are virtually unenforceable overseas, where much of the labor-=20
intensive transcribing of dictated medical notes to written form is being ex=
ported.=20
"This was an egregious breach," said Tomi Ryba, chief operating officer of=20
UCSF Medical Center. "We took this very, very seriously."=20
She stressed that the renowned San Francisco facility is not alone in facing=
=20
the risk of patients' confidential information being used as leverage by=20
unscrupulous members of the increasingly global health-care industry.=20
"This is an issue that affects the entire industry and the entire nation,"=20
Ryba said.=20
Nearly all Bay Area hospitals contract with outside firms to handle at least=
=20
a portion of their voluminous medical-transcription workload. Those firms in=
=20
turn frequently subcontract with other companies.=20
In the case of the threat to release UCSF patient records online, a chain of=
=20
three different subcontractors was used. UCSF and its original contractor,=20
Sausalito's Transcription Stat, say they had no knowledge that the work=20
eventually would find its way abroad.=20
The Pakistani woman's threat was withdrawn only after she received hundreds=20
of dollars from another person indirectly caught up in the extortion attempt=
.=20
The $20 billion medical-transcription business handles dictation from doctor=
s=20
relating to all aspects of the health-care process, from routine exams to=20
surgical procedures. Patients' full medical histories often are included in=20
transcribed reports.=20
While it's impossible to know for sure how much of the work is heading=20
overseas, the American Association for Medical Transcription, an industry gr=
oup,=20
estimates that about 10 percent of all U.S. medical transcription is being d=
one=20
abroad.=20
For two decades, UCSF has outsourced a portion of its transcription work to=20
Transcription Stat. Kim Kaneko, the owner of the Sausalito firm, said she=20
maintains a network of 15 subcontractors throughout the country to handle th=
e=20
"hundreds of files a day" received by her office.=20
One of those subcontractors is a Florida woman named Sonya Newburn, whom=20
Kaneko said she'd been using steadily for about a year and a half. Kaneko kn=
ew=20
that Newburn herself used subcontractors but assumed that was as far as it w=
ent.=20
What Kaneko said she didn't know is that one of Newburn's transcribers, a=20
Texas man named Tom Spires, had his own network of subcontractors. One of th=
ese,=20
apparently, was a Pakistani woman named Lubna Baloch.=20
On Oct. 7, UCSF officials received an e-mail from Baloch, who described=20
herself as "a medical doctor by profession." She said Spires owed her money=20=
and had=20
cut off all communication. Baloch demanded that UCSF find Spires and remedy=20
the situation.=20
She wrote: "Your patient records are out in the open to be exposed, so you=20
better track that person and make him pay my dues or otherwise I will expose=
all=20
the voice files and patient records of UCSF Parnassus and Mt. Zion campuses=20
on the Internet."=20
Actual files containing dictation from UCSF doctors were attached to the e-=20
mail. The files reportedly involved two patients.=20
"I can't believe this happened," Kaneko said. "We've been working for UC for=
=20
20 years, and nothing like this has ever happened before."=20
The files in question were quickly traced to Newburn, the Florida woman, who=
=20
typically handled about 30 UCSF files every day.=20
An emotional Newburn said in an interview that she's as much a victim as=20
Kaneko. "I feel violated," she said.=20
Nevertheless, she said she's taking responsibility for what happened, even=20
though she said she explicitly told Spires not to send any work overseas. "W=
hat=20
he did was despicable," Newburn said.=20
Spires could not be reached for comment. E-mail to his company, Tutranscribe=
,=20
was returned as undeliverable this week.=20
Newburn said she contacted Spires as soon as she learned about Baloch's=20
threat and obtained a number to reach the Pakistani transcriber at her home=20=
in=20
Karachi.=20
"I spoke with her," Newburn said. "She was very upset but said she wouldn't=20
have really released the files. So I said she had to take back the threat."=20
Newburn agreed to pay a portion of the money Baloch claimed she was owed -=20
about $500 - and Baloch said she would tell UCSF that its files were safe.=20
On Oct. 8, UCSF received a second e-mail from Baloch. "I verify that I do no=
t=20
have any intent to distribute/release any patient health information out and=
=20
I have destroyed the said information," she wrote. "I am retracting any=20
statements made by me earlier."=20
The problem, however, will not go away so easily.=20
"We do not have any evidence that the person has destroyed the files,"=20
acknowledged UCSF's Ryba.=20
Moreover, how can UCSF or any other medical institution prevent something=20
like this from happening again? Should legislation be passed barring U.S. me=
dical=20
data from going overseas?=20
"I don't know the answer to that," responded Amy Buckmaster, president of th=
e=20
American Association for Medical Transcription. "We don't say that=20
outsourcing is a terrible thing. We say that it needs to be disclosed."=20
UCSF has reached the same conclusion. Ryba said the medical center is=20
revising its contracts with transcription firms to require up-front notice o=
f all=20
subcontracting.=20
At the same time, she accepts that with a growing percentage of transcriptio=
n=20
work being exported abroad, there will always be a chance that something lik=
e=20
this could happen again.=20
"We'll have to live with this risk on a daily basis," Ryba said.=20
David Lazarus' column appears Wednesdays, Fridays and Sundays. He also can b=
e=20
seen regularly on KTVU's "Mornings on 2." Send tips or feedback to=20
dlazarus@sfchronicle.com.=20
=A92003 San Francisco Chronicle | Feedback=20
Page A - 1=20
-------------------------------1066877877
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
<HTML><HEAD>
<META charset=3DUTF-8 http-equiv=3DContent-Type content=3D"text/html; charse=
t=3Dutf-8">
<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial; BACKGROUND-COLOR: #fffff=
f">
<DIV>
<BLOCKQUOTE>
<DIV><!--BEGIN SpecificPOP.com http://www.sfgate.com (PopUnder Window)--><NO=
SCRIPT></NOSCRIPT><!-- begin ZEDO --><NOSCRIPT>Without a federal right of co=
nsent, US patients cannot stop and personal health information from going in=
to their medical records; and on to Pakistan!</NOSCRIPT></DIV>
<DIV><NOSCRIPT></NOSCRIPT> </DIV>
<DIV><NOSCRIPT>The Amended HIPAA Privacy Rule eliminates US patien=
ts' rights to consent to ROUTINE uses of their medical records--like for tra=
nscription overseas. Under the amended Rule transcription is a ROUTINE=20=
and legally permitted use of every American's medical records. Th=
e ROUTINE uses of medical records now permitted clearly expose everyone's se=
nsitive personal health information to people in foreign lands who will=
use it as they see fit.</NOSCRIPT></DIV>
<DIV><NOSCRIPT></NOSCRIPT> </DIV>
<DIV><NOSCRIPT>Overseas, nothing can stop Pakistani transcriptioni=
sts and businesses from selling or using Americans' medical records&nbs=
p;for any purpose, including extortion.</NOSCRIPT></DIV>
<DIV><NOSCRIPT>Deborah Peel MD</NOSCRIPT></DIV>
<DIV><FONT size=3D4><B></B></FONT> </DIV>
<DIV><FONT size=3D4><B>A tough lesson on medical privacy <BR>Pakistani trans=
criber threatens UCSF over back pay <BR></B></FONT><FONT face=3Dgeneva,arial=
size=3D1><A href=3D"mailto:dlazarus@sfchronicle.com">David Lazarus</A><BR><=
/FONT><FONT face=3Dgeneva,arial size=3D-2>Wednesday, October 22, 2003 <BR><A=
href=3D"http://www.sfgate.com/chronicle/info/copyright/">=A92003 San Franci=
sco Chronicle</A> | <A href=3D"http://www.sfgate.com/feedback/">Feedback</A>=
</DIV>
<P></FONT>
<P><FONT size=3D-1>URL: <A href=3D"http://www.sfgate.com/cgi-bin/article.cgi=
?file=3D/c/a/2003/10/22/MNGCO2FN8G1.DTL">sfgate.com/article.cgi?file=3D/c/a/=
2003/10/22/MNGCO2FN8G1.DTL </A></FONT>
<P>
<P>"Your patient records are out in the open... so you better track that per=
son and make him pay my dues."=20
<P>A woman in Pakistan doing cut-rate clerical work for UCSF Medical Center=20=
threatened to post patients' confidential files on the Internet unless she w=
as paid more money.To show she was serious, the woman sent UCSF an e-mail ea=
rlier this month with actual patients' records attached.=20
<P>The violation of medical privacy - apparently the first of its kind - hig=
hlights the danger of "offshoring" work that involves sensitive materials, a=
n increasing trend among budget-conscious U.S. companies and institutions.=20
<P>U.S. laws maintain strict standards to protect patients' medical data. Bu=
t those laws are virtually unenforceable overseas, where much of the labor-=20=
intensive transcribing of dictated medical notes to written form is being ex=
ported.=20
<P>"This was an egregious breach," said Tomi Ryba, chief operating officer o=
f UCSF Medical Center. "We took this very, very seriously."=20
<P>She stressed that the renowned San Francisco facility is not alone in fac=
ing the risk of patients' confidential information being used as leverage by=
unscrupulous members of the increasingly global health-care industry.=20
<P>"This is an issue that affects the entire industry and the entire nation,=
" Ryba said.=20
<P>Nearly all Bay Area hospitals contract with outside firms to handle at le=
ast a portion of their voluminous medical-transcription workload. Those firm=
s in turn frequently subcontract with other companies.=20
<P>In the case of the threat to release UCSF patient records online, a chain=
of three different subcontractors was used. UCSF and its original contracto=
r, Sausalito's Transcription Stat, say they had no knowledge that the work e=
ventually would find its way abroad.=20
<P>The Pakistani woman's threat was withdrawn only after she received hundre=
ds of dollars from another person indirectly caught up in the extortion atte=
mpt.=20
<P>The $20 billion medical-transcription business handles dictation from doc=
tors relating to all aspects of the health-care process, from routine exams=20=
to surgical procedures. Patients' full medical histories often are included=20=
in transcribed reports.=20
<P>While it's impossible to know for sure how much of the work is heading ov=
erseas, the American Association for Medical Transcription, an industry grou=
p, estimates that about 10 percent of all U.S. medical transcription is bein=
g done abroad.=20
<P>For two decades, UCSF has outsourced a portion of its transcription work=20=
to Transcription Stat. Kim Kaneko, the owner of the Sausalito firm, said she=
maintains a network of 15 subcontractors throughout the country to handle t=
he "hundreds of files a day" received by her office.=20
<P>One of those subcontractors is a Florida woman named Sonya Newburn, whom=20=
Kaneko said she'd been using steadily for about a year and a half. Kaneko kn=
ew that Newburn herself used subcontractors but assumed that was as far as i=
t went.=20
<P>What Kaneko said she didn't know is that one of Newburn's transcribers, a=
Texas man named Tom Spires, had his own network of subcontractors. One of t=
hese, apparently, was a Pakistani woman named Lubna Baloch.=20
<P>On Oct. 7, UCSF officials received an e-mail from Baloch, who described h=
erself as "a medical doctor by profession." She said Spires owed her money a=
nd had cut off all communication. Baloch demanded that UCSF find Spires and=20=
remedy the situation.=20
<P>She wrote: "Your patient records are out in the open to be exposed, so yo=
u better track that person and make him pay my dues or otherwise I will expo=
se all the voice files and patient records of UCSF Parnassus and Mt. Zion ca=
mpuses on the Internet."=20
<P>Actual files containing dictation from UCSF doctors were attached to the=20=
e- mail. The files reportedly involved two patients.=20
<P>"I can't believe this happened," Kaneko said. "We've been working for UC=20=
for 20 years, and nothing like this has ever happened before."=20
<P>The files in question were quickly traced to Newburn, the Florida woman,=20=
who typically handled about 30 UCSF files every day.=20
<P>An emotional Newburn said in an interview that she's as much a victim as=20=
Kaneko. "I feel violated," she said.=20
<P>Nevertheless, she said she's taking responsibility for what happened, eve=
n though she said she explicitly told Spires not to send any work overseas.=20=
"What he did was despicable," Newburn said.=20
<P>Spires could not be reached for comment. E-mail to his company, Tutranscr=
ibe, was returned as undeliverable this week.=20
<P>Newburn said she contacted Spires as soon as she learned about Baloch's t=
hreat and obtained a number to reach the Pakistani transcriber at her home i=
n Karachi.=20
<P>"I spoke with her," Newburn said. "She was very upset but said she wouldn=
't have really released the files. So I said she had to take back the threat=
."=20
<P>Newburn agreed to pay a portion of the money Baloch claimed she was owed=20=
- about $500 - and Baloch said she would tell UCSF that its files were safe.=
=20
<P>On Oct. 8, UCSF received a second e-mail from Baloch. "I verify that I do=
not have any intent to distribute/release any patient health information ou=
t and I have destroyed the said information," she wrote. "I am retracting an=
y statements made by me earlier."=20
<P>The problem, however, will not go away so easily.=20
<P>"We do not have any evidence that the person has destroyed the files," ac=
knowledged UCSF's Ryba.=20
<P>Moreover, how can UCSF or any other medical institution prevent something=
like this from happening again? Should legislation be passed barring U.S. m=
edical data from going overseas?=20
<P>"I don't know the answer to that," responded Amy Buckmaster, president of=
the American Association for Medical Transcription. "We don't say that outs=
ourcing is a terrible thing. We say that it needs to be disclosed."=20
<P>UCSF has reached the same conclusion. Ryba said the medical center is rev=
ising its contracts with transcription firms to require up-front notice of a=
ll subcontracting.=20
<P>At the same time, she accepts that with a growing percentage of transcrip=
tion work being exported abroad, there will always be a chance that somethin=
g like this could happen again.=20
<P>"We'll have to live with this risk on a daily basis," Ryba said.=20
<P><I>David Lazarus' column appears Wednesdays, Fridays and Sundays. He also=
can be seen regularly on KTVU's "Mornings on 2." Send tips or feedback to <=
A href=3D"mailto:dlazarus@sfchronicle.com">dlazarus@sfchronicle.com</A>.</I>=
=20
<P><!-- Standard Article Footer --><A href=3D"http://www.sfgate.com/chronicl=
e/info/copyright/">=A92003 San Francisco Chronicle</A> | <A href=3D"http://w=
ww.sfgate.com/feedback/">Feedback</A>=20
<P> Page A - 1 </FONT><!--End Article Footer--><A name=3Dsections=
></A><!--END CHRONICLE SECTIONS PULLDOWN--></P></BLOCKQUOTE></DIV></BODY></H=
TML>
-------------------------------1066877877--