Offshoring Patient Health Data: Navigating Complex Federal and State Privacy Regulation, Mitigating Client Risk

Description

Healthcare companies are increasingly contracting with third-party vendors to provide software and a variety of support services, such as claims processing, call center staffing, and technical support, for cost savings. Often this involves offshoring mass amounts of patient data to subcontractors.

Offshoring occurs when a party contracts with another party located outside of the U.S. and its territories. With federal and state privacy laws governing patient data becoming more stringent and offshoring becoming more common, counsel should be aware of how to help their clients navigate the complex and often inconsistent interplay of laws, regulations, and guidance to ensure compliance.

In addition to federal regulations, such as HIPAA and ACA, and CMS guidance that impact the offshoring of patient data, several states have taken steps to limit this practice as well. For example, the Florida Electronic Health Records Exchange Act effectively prohibits certain covered healthcare providers from storing electronic health records offshore themselves and from relying on third-party offshore vendors to store such records. Other states have issued executive orders prohibiting the offshoring of certain activities that are paid for by state agencies.

Listen as our expert panel discusses the compliance challenges facing healthcare counsel and their clients who must decide whether and to what extent to use offshore third-party vendors for support while maintaining their obligations to protect patient data. The panel will discuss the network of federal and state regulations and guidance governing the offshoring of patient data and best practices for helping clients remain compliant.