Contractors and Medicaid Agencies Commonly Outsource Domestically; Some Vendors Outsource Offshore, but Full Extent of Offshoring Is Unknown

A majority of the federal contractors and state Medicaid agencies we  surveyed engage domestic vendors to perform services involving personal  health information, but rarely transfer personal health information directly  offshore. No Medicare FFS contractors or TRICARE contractors reported direct  offshore outsourcing. Some Domestic Vendors Outsource Offshore, but Full Extent of Data Transfers Is Unknown

Although only one federal contractor and one state Medicaid agency  reported transferring personal health information directly to an offshore  vendor, contractors and Medicaid agencies also reported offshore  outsourcing through the activities of their domestic vendors. No TRICARE contractors  reported offshore outsourcing by their domestic vendors. When asked about their three  largest domestic vendors, 57 percent of Medicare Advantage contractors  reported that they did not know whether these vendors further transferred  personal health information. TMA requires reports of privacy breaches from all of its  contractors. Many Federal Contractors and State Medicaid Agencies Reported a Breach of Data Privacy

In responding to our survey, over 40 percent of federal contractors and  state Medicaid agencies indicated that they, or one of their vendors,  experienced a privacy breach involving personal health information in  2004 or 2005. Among Medicare Advantage contractors, 47 percent reported  recent privacy breaches, as did 42 percent of Medicare FFS contractors,   44 percent of Medicaid agencies, and 38 percent of TRICARE contractors. TMA officials said that the agency  analyzes trends in the monthly reports and follows up with federal  contractors that report recurring lapses in privacy. In May 2005, CMS began requiring Medicare FFS contractors—but not  Medicare Advantage contractors or Medicaid agencies—to report privacy  breaches. In this report we (1) examined the extent to which the  Medicare and TRICARE federal contractors and state Medicaid agencies  outsource—domestically or offshore—services involving the use of  personal health information; (2) identified measures recommended by  privacy experts for safeguarding outsourced personal information and  examined use of these measures by the federal contractors and state  Medicaid agencies; and (3) determined whether the federal contractors  and state Medicaid agencies have experienced privacy breaches and  whether the federal agencies that oversee Medicare, Medicaid, and  TRICARE require notice from them when privacy breaches occur. The federal contractors included in our survey were all those that held  contracts with the Department of Health and Human Services’ Centers for  Medicare & Medicaid Services (CMS) and the Department of Defense’s  TRICARE Management Activity (TMA) to participate in these programs at  the national level, as of January 2005. Survey response rates  ranged from 69 percent (Medicare Advantage contractors) to 80 percent  (state Medicaid agencies). To obtain information on federal agencies’  requirements for notification of privacy breaches experienced by the  federal contractors and state Medicaid agencies, we interviewed officials  at TMA and CMS—the federal agency with oversight responsibility for  Medicare and Medicaid. We  did not provide a definition of privacy breach in the survey.
Why GAO Did This Study

Federal contractors and state Medicaid agencies are responsible for the day-to-day operations of the Medicare, Medicaid, and TRICARE programs. Because these entities may contract with vendors to perform services involving the use of personal health data, outsourcing and privacy protections are of interest. GAO surveyed all federal Medicare and TRICARE contractors and all state Medicaid agencies (a combined total of 378 entities) to examine whether they (1) outsource services--domestically or offshore--and (2) must notify federal agencies when privacy breaches occur. Survey response rates ranged from 69 percent for Medicare Advantage contractors to 80 percent for Medicaid agencies. GAO interviewed officials at the Department of Health and Human Services' Centers for Medicare & Medicaid Services (CMS), which oversees Medicare and Medicaid, and the Department of Defense's TRICARE Management Activity (TMA), which oversees TRICARE.

What GAO Found

Federal contractors and state Medicaid agencies widely reported domestic outsourcing of services involving the use of personal health information but little direct offshore outsourcing. Among those that completed GAO's survey, more than 90 percent of Medicare contractors and state Medicaid agencies and 63 percent of TRICARE contractors reported some domestic outsourcing in 2005. Typically, survey groups reported engaging from 3 to 20 U.S. vendors (commonly known as subcontractors). One federal contractor and one state Medicaid agency reported outsourcing services directly offshore. However, some federal contractors and state Medicaid agencies also knew that their domestic vendors had initiated offshore outsourcing. Thirty-three Medicare Advantage contractors, 2 Medicare fee-for-service (FFS) contractors, and 1 Medicaid agency indicated that their domestic vendors transfer personal health information offshore, although they did not provide information about the scope of personal information transferred offshore. Moreover, the reported extent of offshore outsourcing by vendors may be understated because many federal contractors and agencies did not know whether their domestic vendors transferred personal health information to other locations or vendors. In responding to GAO's survey, over 40 percent of the federal contractors and state Medicaid agencies reported that they experienced a recent privacy breach involving personal health information. (The frequency or severity of these breaches was not reported.) By survey group, 47 percent of Medicare Advantage contractors reported privacy breaches within the past 2 years, as did 44 percent of Medicaid agencies, 42 percent of Medicare FFS contractors, and 38 percent of TRICARE contractors. TMA and CMS differ in their requirements for notification of privacy breaches. TMA requires monthly reports on privacy breaches from its TRICARE contractors and follows up with contractors that report recurring lapses in privacy. While CMS requires Medicare FFS contractors to report privacy breaches within 30 days of discovery, such oversight is lacking for privacy breaches that may occur with personal health information held by state Medicaid agencies and Medicare Advantage contractors, as CMS does not require reports of privacy breaches from these entities.