Your business may be one of the many that has outsourced important parts of it to India. However, make sure that your outsourcing doesn’t run afoul of HIPAA!
How HIPAA Compliance Being Handled in India
Many coding and medical transcription services (among others) are now being handled in India. By necessity, this means that sensitive data is communicated to India – and raises concerns about how that data is handled once it gets there, and its security on the way there. Staying in line is an important part of your business practice, no matter where the tasks are being carried out.
First, make sure that your security for the method of transporting data is adequate. Numerous software solutions have been developed to ensure that transmissions are made in a compliant way. These programmers understand not just programming, but both how and why compliance with HIPAA is so crucial. Also, as HIPAA is an evolving regulation, you need to make sure you establish a relationship with information technology individuals who will stay up on the current standards – and be able to adjust your systems safely, quickly, and relatively inexpensively.
Additionally, be aware that many are advocating that 100% U.S.-based infrastructure should be used – in other words, that your servers and routers should be based in the United States. This is an additional guard against data being sold while overseas.
‘The next thing to consider is who you are doing business with in India. Make sure that the individuals are professional, and that they are members of the American Association of Professional Coders or other appropriate bodies. Ask to see a copy of their HIPAA compliance policies, and make sure there is appropriate understanding.
Additionally, because HIPAA changes so quickly and so often, training is key. Make sure to hold regular trainings on the subject, both as refreshers and updates on new or changed regulations or requirements. You may wish to link completion of training to performance incentives or rewards, so that staff is motivated to upgrade their knowledge of this important area.
While this is good practice for your own employees, you should make sure that whomever you are dealing with in India (or wherever else you may have outsourced to) also has similar programs. An experienced company should be able to tell you this upfront.
Indian companies have many good reasons for wanting to become HIPAA compliant. If they do not do so, they risk losing a sizable part of their business. You do not want to face fines, and neither do they – or the embarrassment that will come with them.
Outsourcing to India can be a smart business decision. While there are obvious pitfalls and concerns regarding HIPAA, the best way to alleviate those is by knowing what the provider’s policies are, ensuring they are up on their training (and continue to maintain training), and making sure that your technology is industry-standard and infrastructure is secure.
