If you dictate patient charts, you have a big stake in the debate about "offshoring" American jobs.

An estimated 10 percent of hired-out medical transcription is done in India, Pakistan, the Philippines, and other countries where millions speak English and work for far less than their US counterparts. It's part of a growing movement to have workers in other countries handle medical chores ranging from billing and coding to X-ray interpretation.

However, globetrotting information is at risk, and that's not just HIPAA hype. Last fall, the University of California, San Francisco Medical Center received an e-mail from a disgruntled Pakistani transcriptionist who vowed to put UCSF medical files on the Internet if she wasn't paid money that she was owed. The transcriptionist retracted her threat the next day, after she received some money. Weeks later, Heartland, a medical transcription company in Toledo, OH, received a similar threat from two employees in India. Heartland says it tracked down the employees and turned them over to Indian authorities before they divulged any patient information.

Lawmakers want privacy safeguards

Theoretically, such acts of privacy terrorism could happen in Indiana as well as India, but they're unlikely on home soil, given the prospect of immediate civil and criminal prosecution. But that deterrent is weaker when a transcriptionist is 8,000 miles away from US courts.

Not surprisingly, several states have introduced legislation to protect personal information that's traversing a digitized, global economy. California, often a bellwether, is pondering three such bills. One would prohibit any work involving confidential information, such as medical charts, from being performed outside US borders; the other two would require transcription companies to disclose whether they send files offshore. One of the bills would even force companies doing business in California to agree to heed state privacy laws and come under the jurisdiction of state courts.

The desire to have transcription companies reveal where they operate is understandable, given the murkiness that surrounds transcribing abroad. While some US companies advertise that they rely on foreign employees or subcontractors, others hide this fact or simply don't know where their files end up. That appears to be the case in the UCSF extortion incident. The medical center's longtime transcription company in California had subcontracted work to a Florida company, which subcontracted with a Texas company, which subcontracted with the Pakistani woman.

While recent extortion threats have rung alarm bells, some healthcare information leaders say the key to security is using the right technology and business practices, not imposing legislation they consider draconian. Steven Mandell, Heartland's president, told a California state Senate subcommittee in March that Heartland's computers prevent employees from downloading, transmitting, or printing patient information. Furthermore, they're not allowed to bring patient information into or out of the building. Mandell didn't mention the plot that the two Indian employees hatched, which surfaced in the news after his testimony. He declined to be interviewed for this story.

Overseas transcription: Fast and cheap

Despite privacy risks, offshore transcription appears poised for further growth. One selling point is a turnaround time of 24 hours or less, made possible by transmitting digitized files over the Internet and leveraging time-zone differences. Indian workers type while US doctors sleep.

Then there's cut-rate pricing. While transcription performed here costs 10 to 14 cents per line, it's routinely done in India for half that much, sometimes less. The quality of dictation transcribed abroad, though, receives mixed reviews. "If you saw documents from overseas that have not been touched by US editors, you'd be shocked," says Sheri Steadman, who owns a transcription company in Peoria, AZ, and runs an online forum called MTStars ( www.mtstars.com ), which opposes offshore medical transcription.

However, internist Leo Waivers in Greenville, NC, says sending dictation to India serves him well. "We've saved $1,000 to $2,000 a month, without any perceptible change in quality," says Waivers.

Take these steps to protect yourself

If you want to take advantage of offshore transcription, it's imperative to HIPAA-proof yourself as much as possible. For starters, ask the transcription company to document its security precautions both here and abroad, says Sue Miller, a healthcare attorney in Concord, MA. Does it encrypt digitized dictation transmitted over the Internet? Is data stored in secure, firewall-protected servers, and are user IDs and passwords required to access it? Have transcriptionists signed confidentiality agreements? Are they prevented from downloading, printing, faxing, or otherwise capturing patient files for possible misuse?

Experts also recommend that you tighten the business-associate contract that a transcription company must sign under HIPAA. This contract, as defined by the federal government, obliges the company to comply with many of the same requirements that HIPAA imposes on you as a "covered entity." Likewise, the company must ensure that any subcontractor takes similar pains to protect patient information.

Your business-associate agreement may be based on the HIPAA privacy regulations alone. That's okay for now, since the HIPAA security standards, which say more about protecting electronic patient data, won't become obligatory until April 21, 2005. You can tweak your contracts before then.

To put teeth in the contract, include a damages clause that makes the transcription company financially responsible for HIPAA violations committed by employees or subcontractors, says healthcare attorney Robyn Meinhardt in Denver. But don't put too much confidence in a piece of paper. "It could be very hard to enforce the contract in a foreign court," she says.

To play it safe, you can simply choose a transcription company that uses only US workers or will keep your dictation stateside upon request. As an added measure, says Meinhardt, draft the business-associate contract to prohibit the company from sending the work it gets from you overseas.

And then pray you don't receive an angry e-mail from half a world away.

Robert Lowes. Special Report: Overseas transcription: Is it safe? Medical Economics Jun. 18, 2004;81:16.