Overseas outsourcing of private information & individual remedies for breach of privacy.

I. INTRODUCTION

Using personal medical and financial information to blackmail unsuspecting individuals may sound like the plotline to a conspiracy theory movie. In reality, it may also be a consequence of the practice of outsourcing electronic data to foreign countries for business processing. Since the fall of 2003, major newspapers have reported at least two instances of threats by foreign medical record transcriptionists to release patients' medical information via the Internet. (1) On October 7, 2003, a medical transcriptionist in Karachi, Pakistan, sent an email message to the University of California San Francisco Medical Center ("UCSF"), demanding payment for her work, with patient files attached. (2) In a similar incident only a few weeks later, Heartland Information Services ("Heartland"), an Ohio-based company, received an email message from its own employees in Bangalore, India, who attempted to extort money by threatening to reveal confidential material. (3)

The average patient would not normally know if her medical information was transmitted abroad following a hospital visit. Transcription of medical records generally is classified as one of the operations for which health care providers can disclose individuals' information without meeting the statutory requirement of obtaining consent. (4) Sometimes medical records awaiting transcription are forwarded, without the knowledge of the health care provider, to several different individuals through subcontracted relationships. For example, in the UCSF incident, the medical center had outsourced its medical record transcription to a California-based company, which in turn had subcontracted with an individual in Florida. (5) Against the terms of her original contract with the California-based firm, the subcontractor in Florida had subcontracted work to an individual in Texas, who, unbeknownst to her, had solicited work from the freelance transcriptionist in Karachi. (6)

On the other hand, some health care providers knowingly outsource their records transcription to companies that use overseas employees to complete the work. (7) Heartland's extortion threat is perhaps more alarming than the UCSF incident because, while its clients knew their work was being sent overseas, the company never informed them of this incident. (8) Moreover, the company's representative failed to mention the incident during his appearance at a hearing before state legislators in California on the subject of industry safeguards to protect outsourced information. (9)

Although the Supreme Court has implied that it might recognize a right to privacy of personal information, (10) the current legal environment provides limited remedies to those whose privacy rights are transgressed. (11) In the face of a technological world advancing at a rapid rate, legislative action is the only way to guarantee individuals protection of their private information. However, legislators fear that adequate privacy protections will only be implemented as a result of some future scandal. (12) Privacy rights experts warn that just such a scandal is on the horizon. (13)

This article addresses the threat of disclosure to consumers' private, personal information due to the increasing practice of outsourcing business processes to foreign companies. By way of introduction, it examines the trend of outsourcing: what jobs are commonly outsourced, in which industries, and the reasons why the practice has become increasingly common in the global economy. The article continues by describing the kinds of personal information that are commonly shared in outsourcing practices and examines two industries in depth: Internet-based loan processing and medical record transcription.

To analyze consumer rights and remedies in this context, the article considers the notion of a right to privacy in one's personal information, and then discusses federal statutes and case law which may enable such a right, in particular, the Health Insurance Portability and Accountability Act of 1996 (14) and the Gramm Leach-Bliley Act. (15) The discussion then focuses on the remedies provisions of each of these statutes, as well as possible common law tort remedies for disclosure of personal information. Next, the article turns to the special problem created by outsourcing to foreign-based companies and what effects this situation has on the availability of remedies to individual consumers; it addresses some international legislation on the subject and discusses the possible approaches to resolution of Internet-based disputes. Finally, the article analyzes proposed legislation on this subject in the U.S. This article concludes that individual consumers currently have no realistic remedial option for any injury incurred due to unwanted disclosure of their outsourced private, electronic information. To remedy this situation, consumers must demand legislation, specifically conferring liability for U.S. businesses that choose to outsource consumer data and an individual right to civil action against those companies.

II. BACKGROUND

A. What is Outsourcing?

The business practice of using other companies, either domestically or internationally, to fill jobs formerly performed in house, or more succinctly, "the transfer of jobs to low-cost labour markets" is known as outsourcing. (16) In the international context, the practice is sometimes referred to as offshoring or global outsourcing. (17) While Americans may view outsourcing as an economic problem unique to their country, the same concerns exist among European Union Member States and other countries. (18)

Although the United States saw a similar job market shift in the 1970s, when manufacturing jobs began moving overseas, the current outsourcing trend dates from the 1990s. (19) At that time, companies, which had formerly supplied all of their own business service needs, began looking for foreign labor sources "to remain competitive by reducing costs and increasing shareholder value." (20) The trend accelerated in the late 1990s with Y2K fears causing an increase in demand for computer software work. (21) At present, the outsourcing trend commands major attention from both the news media and politicians. Lou Dobbs, of CNN television, has devoted part of his show to an on-going segment entitled "Exporting America." (22) Outsourcing was also among the topics of discussion during the televised debates for the last U.S. presidential election. (23)

Outsourced service jobs originally consisted primarily of customer service and call center positions. (24) However, companies now also outsource technical support positions and even more professional, "white-collar" jobs. (25) The outsourcing of service-based jobs is even more cost effective than that of manufacturing jobs, as:

[I]nformation-based analytical services (for example,

information technology, Internet, accounting, medicine, legal

services, financial consulting, banking, and silicon-based

business) and more mundane information services (for example,

data processing) can fly through cyberspace at virtually no cost.

More concretely, the auditing of electronic-based financial

records, meeting transcriptions, or hearing records, now can be

performed conveniently anywhere in the world for

instantaneous use anywhere else in the world. We have only

just begun. (26)

The use of outsourcing spans across all industries. (27) However, the prevalence of outsourcing varies by industry. By 2005, estimates of outsourced legal services predict displacement of only 15,000 U.S. lawyers. (28) On the other hand, experts anticipated higher growth rates in the outsourcing of IT services in 2004. (29) By some estimates, "at least one-third of new IT development work for big U.S. companies is [now] done overseas." (30) Overall, economists predict that a minimum of fourteen million service-based jobs could be outsourced in the next ten years. (31)

B. Types of Private Information Shared through Outsourcing

As a result of outsourcing on the part of U.S.-based companies, personal information is transferred electronically to contracted vendor companies in foreign countries. The list of countries with outsourced labor is growing and currently includes: China, Ghana, Guatemala, India, Ireland, Jamaica, Mexico, Pakistan, and the Philippines. (32) Personal information being shared electronically includes: social security numbers, credit card numbers and balances, credit histories, mortgage information, tax documents, investment and brokerage information, insurance records, billing records, employee records, and medical records. (33)

Shared financial information is utilized in outsourced credit-reporting services, (34) income tax preparation, (35) debt collection services, (36) and loan processing services. (37) Medical and health information about patients is transferred to foreign companies for medical record transcription, billing, and data entry for insurance firms. (38) Most of this information is transferred for "business-process outsourcing," or BPO, outsourced back-office operations and call center work. (39) Although BPO is a nascent industry, it is quickly growing. In India, the BPO industry is only five years old; yet, according to the Indian trade association, NASSCOM (National Association of Software and Services Companies), the past year showed more than a fifty percent increase in industry revenues. (40)

C. Internet-based Loan Processing