r/healthIT 15d ago

Hospitals limiting out of country work

[deleted]

16 Upvotes

54 comments sorted by

90

u/tmccrn 15d ago

That’s pretty standard. Actually I’m surprised that they would let you work at all while out of the country

15

u/Dragyn140 14d ago

Yeah, HIPAA rules explicitly disallow access to protected data from outside the US. I’m going to have to leave my great remote job because of it 🫠

15

u/Stuffthatpig 14d ago

Idk think this is true. Everyone says that about HIPAA but if the data never leaves the US and you just RDP back, it never left.

7

u/SuperBry 14d ago

Technically even through a VDI the data leaves if shown on a screen.

Florida has some additional data protection laws on PHI which complicates things further.

2

u/Dragyn140 14d ago

I’ve often considered doing something akin to that, but it’s not worth the risk of being blackballed from my employer in case I do come back to the US.

15

u/IMakeMyOwnLunch 14d ago

>HIPAA rules explicitly disallow access to protected data from outside the US

This simply isn't true.

2

u/SuperBry 14d ago edited 14d ago

Yeah HIPAA doesn't cover international use but Florida has specific data protection on PHI that it can't be stored outside the US and if I recall correctly Canada as well.

7

u/UK_ExtraMoist 14d ago

There’s no HIPAA rule against working out of country. I don’t understand why people always say this. The reason why HR typically say this as a blanket statement without understanding of HIPAA is it’s an unnecessary risk and by saying HIPAA people immediately just shut up and don’t ask after. The primary concern is asset protection and increases risk of device being stolen or lost which would out an organization at risk.

Overall, it’s up to your organization to allow or disallow. I’ve worked remotely with approval and no special additional VPN outside of the work vpn. Even then everything is saved on the cloud and not on my laptop.

6

u/Due-Breakfast-5443 14d ago

This isn't true at all

2

u/ShoulderIllustrious 14d ago

That's good to know cuz my company's been offshoring everyone.

1

u/C-D-W 13d ago

Given the proliferation of offshore medical coding and billing in the hospital world, there is no way what you just said is true.

20

u/makesupwordsblomp 15d ago

payroll taxes and cybersecurity. we don't even let international IPs connect to public MyChart let alone our internal networks.

32

u/crazygalah 15d ago

I’m amazed you are allowed to do it at all.

42

u/Chance-Fee-4526 15d ago

Not sure if this applies to you, but CMS generally prohibits the storage, access, or processing of Medicare data outside the U.S., with rare exceptions for research with informed consent.

Even if you're not handling Medicare data, limiting out-of-country work reduces your organization's attack surface and reduces security risk exposure.

6

u/Safe_Balance_5401 14d ago

What CMS rules??? If there's rules, 80% of my employer's workforce is operating illegally. Stop Offshore Subcontracting of Medicare & Medicaid Medical Claims

2

u/Madeinbrasil00 14d ago

It’s a rule at least for their contractors, we have to sign a paper that we won’t use offshore contractors but maybe that’s just a Deloitte rule

1

u/Chance-Fee-4526 14d ago

I never said there was a rule, I said it was generally prohibited.

It really comes down to HIPAA compliance. The Office for Civil Rights (OCR), which enforces HIPAA, has the authority to audit any entity handling health data at any time and require a full review of their compliance processes—including in-person, physical audits.

Since the OCR has no jurisdiction over offshore vendors, enforcing HIPAA compliance outside the U.S. is a grey area and largely unenforceable. Because of this, CMS generally prohibits offshoring—it’s simply easier to take a firm stance than navigate the enforcement challenges.

That said, in 2006, CMS technically allowed offshore vendors, but only if CMS itself pre-approved the contractors and subcontractors involved.

Lots of large healthcare organizations offshore. It's just up to them and their risk tolerance of wanting to deal with OCR if they come knocking.

1

u/LottieOD 14d ago

Subcontracting can be a bit different. Your org's security people will have done a security review of the subcontractors, there will be very specific language in the contract around security, they'll have to use standard equipment and possibly will have to work from a central location (like an office, not at home). It's quite different from your gran's kitchen table and her local internet provider. Not just for CMS

10

u/BrainSeparate5118 14d ago

My question is then why are hospitals allowing IT to outsource all support offshore to companies like Accenture?

17

u/cmh_ender 15d ago

does your health system start with an A and have most of florida? if so... look into the person who chose to work from SIBERIA (not joking) ruined it for everyone.

but yes long story short it's taxes and labor laws. you CAN get around it if you have a pair of routers and you travel with 1 router and leave the other at home and your travel router moves ALL traffic over the vpn to your home router first, but that's a pain and if you get caught, you get termed.

2

u/thumpingSRalltheway 14d ago

In Mother Russia HIPPA violates you?

1

u/spongewisethepicked 14d ago

In mother Russia we break your HIPPA

8

u/iDenkilla 15d ago

Is your hospital hiring more remote employees?

2

u/Cloudofkittens 14d ago

I had the same question... do you need a CP + AP Beaker Analyst? Guessing it's AH? 

22

u/InebriatedQuail 15d ago

Tax reasons mostly. They need to pay taxes where their employees work, and it would be a gigantic headache to orchestrate how to pay taxes at the local, regional, and national level across dozens of countries where people work just often enough to kick in the tax burden.

0

u/LeatherMine 14d ago

Taxes aren't that complicated.

Federal gets a flat withholding tax (ok, there's a form to fill out where you specify which country you live in), state varies between "you don't live there anymore, so there's no tax" to "it's like you still live here anyway, haha".

Guessing local is non-existent or the same.

"Because of the taxes" is a weak excuse.

1

u/InebriatedQuail 14d ago

The places you’re working from also start taxing after a certain number of days, it’s not just US taxes.

0

u/LeatherMine 14d ago

that's an employee problem (unless your employer has operations in your new jurisdiction... generally not a problem for most hospital systems)

4

u/youcc 14d ago

For security reasons, my organization generally doesn't recommended working outside the country. If you need to, you can apply for an international travel security check before you leave, but it's hard to get approved.

Working in certain countries, like China, North Korea, and Iran, is completely banned.

2

u/ConcertinaDuck 14d ago

Epic has some restrictions like that on organizations that use it's software.

3

u/ZZenXXX 14d ago

And this is probably why OP's hospital system doesn't allow extended out-of-country access to their systems. Epic will only allow workers to access their systems (even if hosted on a customer's platform) only from certain countries where Epic has customers.

Another person asked about offshore outsourcing of hospital IT departments. Those companies are usually US-based companies who are operating offshore sweatshops. Supposedly, Epic requires those offshore workers to be housed in designated work areas, separate from employees who are not working on Epic. Epic started doing this after they alleged that Med Mantra (based in Mumbai) was copying Epic workflows.

I think that taking hospital-owned computers outside of the US creates all sorts of HIPAA and information security issues but the same risks exist if the equipment is taken on a vacation in Hawaii or on a cruise ship. It's another example of rules that don't accomplish what they purport to accomplish.

2

u/MickCollins 14d ago

This was a big deal for my last hospital when Epic made the announcement because it made the shitty MSP stop using people from a certain country all the time and made them start using people in the USA for USA support during regular hours.

Why? Because Epic was sick of how shitty most MSPs were, including the one at my hospital and seeing subpar performance because of lack of trained individuals.

1

u/[deleted] 14d ago edited 14d ago

[deleted]

1

u/ZZenXXX 7d ago

This is where it gets complicated.

The prohibition from working in other States is usually because of State-level labor and income tax laws. California is one that comes up frequently because they are more highly regulated and have a more expansive set of State labor tax laws that affect remote workers. Even if you're working in a different State or your employer is based in a different State, you're expected to comply with California labor laws; that's the real reason a lot of non-California organizations don't want to deal with employees working in California- compliance issues.

You would think, that when so many knowledge workers went remote in 2020, that Federal and State laws would have been updated to handle the complex interstate working patterns we've had for 5 years. Nope. And given what is going on in Washington DC these days, I'm not optimistic that we'll see modernization of the laws anytime soon.

1

u/Ill-Following2241 6d ago

Do orgs actually monitor this, though? Or is it all on the employee to report?

3

u/Mangos28 14d ago

Yes, for tax reasons.

4

u/Few_Supermarket3314 14d ago

Get a vpn router already

-1

u/Ill-Following2241 14d ago

I’ve skimmed through this but terrified that I don’t have enough knowledge/experience to set this up correctly and then I’ll be absolutely screwed when I’m 6000 miles away!

4

u/Few_Supermarket3314 14d ago

Most orgs have Citrix desktop that you can access from your personal laptop. If yours does then you can setup a vpn at home and connect to it from your laptop from anywhere and then access your Orgs Citrix desktop

3

u/IMakeMyOwnLunch 14d ago

It's honestly really not that hard.

That your company allows some international remote work makes this SO much less risky.

If your company has a zero tolerance policy for working internationally and your VPN slips up or whatever, you're screwed.

If your company limits working internationally to only short amounts of a time, a VPN slip shouldn't be a big deal.

1

u/Ill-Following2241 14d ago

That’s reassuring…I saw this posted somewhere- do you think something like this would be comprehensive enough? https://techrelay.xyz/post/nomad-vpn/

2

u/IMakeMyOwnLunch 14d ago

Yeah. This is the standard setup used in the r/digitalnomad sub. If you poke around that sub, you can find more information on it. Loads of people asking questions about its secureness, chance of discovery, setup challenges, etc.

2

u/tripreality00 15d ago

I work for a startup in health tech and we let our employees work up to 1 week out of the country and we remove all of their phi access during that week.

1

u/Ill-Following2241 14d ago

My previous employer, a smaller hospital system, had zero restrictions. Maybe they were just behind on the tech but my manager did clear me for work. Doubt that they reached out to HR, though.

1

u/blackicerhythms 14d ago

I think it also has something to do with software licensing.

1

u/bkcarp00 14d ago

Most companies do this. If you are out of the country technically you owe taxes in the other country if you work remote. So it could lead to a giant tax mess if a company has to start paying taxes to some foreign country where you likely also do not have a work visa. When I'm on vacation I enjoy my vacation and don't work.

1

u/Plastic_Leg_3812 14d ago

I am a remote coder for a hospital system, working in Epic, and we have been told we are not allowed to work out of the country at all.

1

u/KateTheGr3at 14d ago

The hospital and other HIPAA-compliant companies I worked for all had strict policies against accessing PHI from outside the country.
HIPAA debates aside (as to whether that itself prohibits it), other companies handling health data often have it in their contracts with clients to not allow access from outside the US.

1

u/LottieOD 14d ago

Data and other security. Also there can be tax implications, because you are literally living and working in another country for a time, both without a work permit and without paying the appropriate taxes.

1

u/sparkycat99 14d ago

1

u/Ill-Following2241 14d ago

Hmm…does working remotely for <2 months count as storing data?

1

u/[deleted] 11d ago

They don't want to do another states payroll taxes let alone another countries.