The Government Accounting Office (GAO), a non-partisan audit, evaluation and investigative arm of Congress, recently surveyed federal and state health insurance operators to determine the extent of personal information being shared with domestic and offshore outsourcers (PDF of the report here). The results can remind us all of the security risks and controls required when sharing information with outsourcers.

Federal contractors and state Medicaid agencies are responsible for the day-to-day operations of the Medicare, Medicaid and TRICARE heath insurance programs. Because these entities may contract with vendors to perform services involving the use of personal health data, outsourcing and privacy protections are of interest. The GAO surveyed all federal Medicare and TRICARE contractors and all state Medicaid agencies (a combined total of 378 entities). Federal contractors and state Medicaid agencies widely reported domestic outsourcing of services involving the use of personal health information but little direct offshore outsourcing. More than 90% of Medicare contractors and state Medicaid agencies and 63% of TRICARE contractors reported some domestic outsourcing in 2005.

One federal contractor and one state Medicaid agency reported outsourcing services directly offshore. However, some federal contractors and state Medicaid agencies also knew that their domestic vendors had initiated offshore outsourcing. Thirty-three Medicare Advantage contractors, two Medicare fee-for-service (FFS) contractors, and one Medicaid agency indicated that their domestic vendors transfer personal health information offshore, although they did not provide information about the scope of personal information transferred offshore. Moreover, the reported extent of offshore outsourcing by vendors may be understated because many federal contractors and agencies did not know whether their domestic vendors transferred personal health information to other locations or vendors. The bulk of the known offshore outsourcing was to India, with Ghana, Mexico, Canada, Jamaica, Bermuda and the Philippines also receiving such work.

More than 40% of the federal contractors and state Medicaid agencies reported that they experienced a recent privacy breach involving personal health information. The frequency or severity of these breaches was not reported.