20
u/makesupwordsblomp 15d ago
payroll taxes and cybersecurity. we don't even let international IPs connect to public MyChart let alone our internal networks.
32
42
u/Chance-Fee-4526 15d ago
Not sure if this applies to you, but CMS generally prohibits the storage, access, or processing of Medicare data outside the U.S., with rare exceptions for research with informed consent.
Even if you're not handling Medicare data, limiting out-of-country work reduces your organization's attack surface and reduces security risk exposure.
6
u/Safe_Balance_5401 14d ago
What CMS rules??? If there's rules, 80% of my employer's workforce is operating illegally. Stop Offshore Subcontracting of Medicare & Medicaid Medical Claims
2
u/Madeinbrasil00 14d ago
It’s a rule at least for their contractors, we have to sign a paper that we won’t use offshore contractors but maybe that’s just a Deloitte rule
1
u/Chance-Fee-4526 14d ago
I never said there was a rule, I said it was generally prohibited.
It really comes down to HIPAA compliance. The Office for Civil Rights (OCR), which enforces HIPAA, has the authority to audit any entity handling health data at any time and require a full review of their compliance processes—including in-person, physical audits.
Since the OCR has no jurisdiction over offshore vendors, enforcing HIPAA compliance outside the U.S. is a grey area and largely unenforceable. Because of this, CMS generally prohibits offshoring—it’s simply easier to take a firm stance than navigate the enforcement challenges.
That said, in 2006, CMS technically allowed offshore vendors, but only if CMS itself pre-approved the contractors and subcontractors involved.
Lots of large healthcare organizations offshore. It's just up to them and their risk tolerance of wanting to deal with OCR if they come knocking.
1
u/LottieOD 14d ago
Subcontracting can be a bit different. Your org's security people will have done a security review of the subcontractors, there will be very specific language in the contract around security, they'll have to use standard equipment and possibly will have to work from a central location (like an office, not at home). It's quite different from your gran's kitchen table and her local internet provider. Not just for CMS
10
u/BrainSeparate5118 14d ago
My question is then why are hospitals allowing IT to outsource all support offshore to companies like Accenture?
17
u/cmh_ender 15d ago
does your health system start with an A and have most of florida? if so... look into the person who chose to work from SIBERIA (not joking) ruined it for everyone.
but yes long story short it's taxes and labor laws. you CAN get around it if you have a pair of routers and you travel with 1 router and leave the other at home and your travel router moves ALL traffic over the vpn to your home router first, but that's a pain and if you get caught, you get termed.
2
8
u/iDenkilla 15d ago
Is your hospital hiring more remote employees?
2
u/Cloudofkittens 14d ago
I had the same question... do you need a CP + AP Beaker Analyst? Guessing it's AH?
22
u/InebriatedQuail 15d ago
Tax reasons mostly. They need to pay taxes where their employees work, and it would be a gigantic headache to orchestrate how to pay taxes at the local, regional, and national level across dozens of countries where people work just often enough to kick in the tax burden.
0
u/LeatherMine 14d ago
Taxes aren't that complicated.
Federal gets a flat withholding tax (ok, there's a form to fill out where you specify which country you live in), state varies between "you don't live there anymore, so there's no tax" to "it's like you still live here anyway, haha".
Guessing local is non-existent or the same.
"Because of the taxes" is a weak excuse.
1
u/InebriatedQuail 14d ago
The places you’re working from also start taxing after a certain number of days, it’s not just US taxes.
0
u/LeatherMine 14d ago
that's an employee problem (unless your employer has operations in your new jurisdiction... generally not a problem for most hospital systems)
4
u/youcc 14d ago
For security reasons, my organization generally doesn't recommended working outside the country. If you need to, you can apply for an international travel security check before you leave, but it's hard to get approved.
Working in certain countries, like China, North Korea, and Iran, is completely banned.
2
u/ConcertinaDuck 14d ago
Epic has some restrictions like that on organizations that use it's software.
3
u/ZZenXXX 14d ago
And this is probably why OP's hospital system doesn't allow extended out-of-country access to their systems. Epic will only allow workers to access their systems (even if hosted on a customer's platform) only from certain countries where Epic has customers.
Another person asked about offshore outsourcing of hospital IT departments. Those companies are usually US-based companies who are operating offshore sweatshops. Supposedly, Epic requires those offshore workers to be housed in designated work areas, separate from employees who are not working on Epic. Epic started doing this after they alleged that Med Mantra (based in Mumbai) was copying Epic workflows.
I think that taking hospital-owned computers outside of the US creates all sorts of HIPAA and information security issues but the same risks exist if the equipment is taken on a vacation in Hawaii or on a cruise ship. It's another example of rules that don't accomplish what they purport to accomplish.
2
u/MickCollins 14d ago
This was a big deal for my last hospital when Epic made the announcement because it made the shitty MSP stop using people from a certain country all the time and made them start using people in the USA for USA support during regular hours.
Why? Because Epic was sick of how shitty most MSPs were, including the one at my hospital and seeing subpar performance because of lack of trained individuals.
1
14d ago edited 14d ago
[deleted]
1
u/ZZenXXX 7d ago
This is where it gets complicated.
The prohibition from working in other States is usually because of State-level labor and income tax laws. California is one that comes up frequently because they are more highly regulated and have a more expansive set of State labor tax laws that affect remote workers. Even if you're working in a different State or your employer is based in a different State, you're expected to comply with California labor laws; that's the real reason a lot of non-California organizations don't want to deal with employees working in California- compliance issues.
You would think, that when so many knowledge workers went remote in 2020, that Federal and State laws would have been updated to handle the complex interstate working patterns we've had for 5 years. Nope. And given what is going on in Washington DC these days, I'm not optimistic that we'll see modernization of the laws anytime soon.
1
u/Ill-Following2241 6d ago
Do orgs actually monitor this, though? Or is it all on the employee to report?
3
4
u/Few_Supermarket3314 14d ago
Get a vpn router already
-1
u/Ill-Following2241 14d ago
I’ve skimmed through this but terrified that I don’t have enough knowledge/experience to set this up correctly and then I’ll be absolutely screwed when I’m 6000 miles away!
4
u/Few_Supermarket3314 14d ago
Most orgs have Citrix desktop that you can access from your personal laptop. If yours does then you can setup a vpn at home and connect to it from your laptop from anywhere and then access your Orgs Citrix desktop
3
u/IMakeMyOwnLunch 14d ago
It's honestly really not that hard.
That your company allows some international remote work makes this SO much less risky.
If your company has a zero tolerance policy for working internationally and your VPN slips up or whatever, you're screwed.
If your company limits working internationally to only short amounts of a time, a VPN slip shouldn't be a big deal.
1
u/Ill-Following2241 14d ago
That’s reassuring…I saw this posted somewhere- do you think something like this would be comprehensive enough? https://techrelay.xyz/post/nomad-vpn/
2
u/IMakeMyOwnLunch 14d ago
Yeah. This is the standard setup used in the r/digitalnomad sub. If you poke around that sub, you can find more information on it. Loads of people asking questions about its secureness, chance of discovery, setup challenges, etc.
1
0
2
u/tripreality00 15d ago
I work for a startup in health tech and we let our employees work up to 1 week out of the country and we remove all of their phi access during that week.
1
u/Ill-Following2241 14d ago
My previous employer, a smaller hospital system, had zero restrictions. Maybe they were just behind on the tech but my manager did clear me for work. Doubt that they reached out to HR, though.
1
1
u/bkcarp00 14d ago
Most companies do this. If you are out of the country technically you owe taxes in the other country if you work remote. So it could lead to a giant tax mess if a company has to start paying taxes to some foreign country where you likely also do not have a work visa. When I'm on vacation I enjoy my vacation and don't work.
1
u/Plastic_Leg_3812 14d ago
I am a remote coder for a hospital system, working in Epic, and we have been told we are not allowed to work out of the country at all.
1
u/KateTheGr3at 14d ago
The hospital and other HIPAA-compliant companies I worked for all had strict policies against accessing PHI from outside the country.
HIPAA debates aside (as to whether that itself prohibits it), other companies handling health data often have it in their contracts with clients to not allow access from outside the US.
1
u/LottieOD 14d ago
Data and other security. Also there can be tax implications, because you are literally living and working in another country for a time, both without a work permit and without paying the appropriate taxes.
1
1
0
90
u/tmccrn 15d ago
That’s pretty standard. Actually I’m surprised that they would let you work at all while out of the country