As shown in table 1, CMS and TMA contract with numerous firms to perform many of the functions necessary to administer the Medicare and TRICARE programs. In addition, state agencies administer the Medicaid program. Federal contractors and state Medicaid agencies perform a wide variety of functions that require the use of personal health information. Such information may include medical diagnosis and treatment records and patient identifiers, such as name, address, date of birth, Social Security number, and evidence of insurance coverage. For example, when making a claims payment determination, federal contractors and state Medicaid agencies verify patient eligibility and assess whether the services provided were medically necessary. In some cases, assessing medical necessity requires a review of the patient’s medical history and treatment records. In addition to claims processing, federal contractors and state Medicaid agencies use personal health information when enrolling beneficiaries, operating telephone call centers, conducting disease management programs, administering pharmaceutical benefit management services, and performing fraud investigations. A number of laws provide protection for personal health information. Under the HIPAA Privacy Rule, certain health care organizations and individuals—known as covered entities—are required to ensure that patients’ personal health information is not improperly disclosed. Covered entities—health care providers, health plans, and health care clearinghouses—must develop policies and procedures for protecting health information. These include restricting the amount of information disclosed to the minimum necessary to accomplish the intended purpose and to the workforce needing access. Other requirements under the HIPAA Privacy Rule include designating a privacy official and training employees on the covered entity’s privacy policies. Certain HIPAA Privacy Rule safeguards also apply to “downstream users”—whether or not they are covered entities—through contractual agreements. The HIPAA Privacy Rule requires covered entities to enter into “business associate agreements” with other firms or individuals to which they transfer personal health information for certain clinical, operational, or administrative functions. Business associate agreements must establish the conditions under which a downstream vendor may use and disclose personal health information and the privacy safeguards they must apply. Covered entities are not required, under the rule, to monitor their business associates’ use of privacy safeguards, but must take corrective action if they become aware of a pattern of activity or practice that amounts to a material breach of the agreement. The HIPAA Privacy Rule applies directly to state Medicaid agencies, Medicare Advantage contractors, and TRICARE contractors that act as health plans or providers, and indirectly to Medicare FFS contractors and other TRICARE contractors. Specifically, state Medicaid agencies, Medicare Advantage, and TRICARE contractors that act either as health plans or providers are covered entities under the HIPAA Privacy Rule, while Medicare FFS contractors and the remaining TRICARE contractors are considered business associates to CMS and TRICARE, respectively, in their capacity as program contractors. Requirements under the HIPAA Privacy Rule also apply to certain downstream vendors that receive personal health information from federal contractors and state Medicaid agencies through outsourcing arrangements. In addition to the HIPAA Privacy Rule, U.S. law includes a number of statutes that provide privacy protections, and some of them are applicable only to federal agencies and their contractors. The Privacy Act of 1974, for example, places limitations on agencies’ collection, disclosure, and use of privacy information. Furthermore, the Federal Information Security Management Act of 2002 generally concerns the protection of personal information in the context of securing federal agencies’ information, and requires agencies to develop information security programs that include contractors. Finally, the Social Security Act requires that state Medicaid agencies limit the use and disclosure of personally identifiable information to purposes directly related to administering the state’s Medicaid program. A majority of the federal contractors and state Medicaid agencies we surveyed engage domestic vendors to perform services involving personal health information, but rarely transfer personal health information directly offshore. However, offshore outsourcing is initiated by some domestic vendors, which transfer personal health information to offshore locations. The actual prevalence of offshore outsourcing by domestic vendors may be greater than reported, as many federal contractors and state Medicaid agencies did not know whether their domestic vendors further transferred personal health information. A majority of federal contractors and state Medicaid agencies use domestic vendors to perform services involving personal health information. (See table 2.) At the same time, only one Medicare Advantage contractor and one state Medicaid agency reported direct offshore outsourcing of services involving personal health information. No Medicare FFS contractors or TRICARE contractors reported direct offshore outsourcing. When outsourcing domestically, the federal contractors and state Medicaid agencies typically rely on more than one vendor, although the extent to which this occurs varies across the three insurance programs. In our survey, Medicare Advantage contractors reported outsourcing services involving personal health information to a median of 20 domestic vendors per contractor. In contrast, TRICARE contractors and Medicaid agencies reported a median of 7 domestic vendors, while Medicare FFS contractors reported a median of 3 domestic vendors per contractor. Although only one federal contractor and one state Medicaid agency reported transferring personal health information directly to an offshore vendor, contractors and Medicaid agencies also reported offshore outsourcing through the activities of their domestic vendors. Specifically, federal contractors and state Medicaid agencies reported that their domestic vendors further transfer personal health information either to the vendors’ offshore locations or to another vendor located outside the United States through downstream outsourcing. Nineteen percent—33 of 173—of the Medicare Advantage contractors who responded to our survey reported that one or more of their largest domestic vendors transfer personal health information to a location outside of the United States. Four percent (2 of 45) of Medicare FFS contractors and 2 percent (1 of 45) of Medicaid agencies reported offshore outsourcing initiated by domestic vendors. Although each respondent indicated that these offshore transfers involved personal health information, we did not ask for detailed information about amount of data transferred. No TRICARE contractors reported offshore outsourcing by their domestic vendors. Our survey results may underestimate the full extent of offshore outsourcing of services involving personal health information. Some federal contractors and state Medicaid agencies did not always know whether their domestic vendors engaged in further transfers of personal health information—domestically or offshore—while others indicated that they did not have mechanisms in place to obtain such information. Medicare Advantage contractors—which have more domestic vendors per contractor than other federal contractors or state agencies in our survey— were least likely to have information about whether further data transfers were occurring on behalf of their program. When asked about their three largest domestic vendors, 57 percent of Medicare Advantage contractors reported that they did not know whether these vendors further transferred personal health information. Similarly, 29 percent of Medicare FFS contractors and 26 percent of Medicaid agencies reported that they did not have this information for all three of their largest domestic vendors. (See table 3.) According to our survey, most instances of offshore outsourcing by vendors occur when the domestic vendor transfers personal health information to one of its own locations outside of the United States or to an affiliated entity, such as a subsidiary, located in another country. Of the 33 Medicare Advantage contractors that reported offshore outsourcing by vendors, 30 described instances that fit this pattern. For example, one Medicare Advantage contractor reported outsourcing to a Midwest vendor a contract to scan paper claims and create and store electronic records. The vendor, which has multiple domestic and several international locations, performs these services in Mexico. In another case, a Medicare Advantage contractor reported using its wholly owned subsidiary to provide claims data entry services. Rather than using employees at its U.S. location, the subsidiary transfers the personal health information to a location it has in India, where the data entry services are performed. A Medicare FFS contractor reported a similar instance in describing its vendor’s offshore outsourcing. Its domestic vendor transfers personal health information to the vendor’s own facility in Jamaica to process Medicare claims. Offshore outsourcing was also reported to occur when domestic vendors transfer data to independent, third-party vendors located in other countries. According to our survey, this type of offshore outsourcing is less common than the type in which the offshore vendor is related to the domestic vendor. Three of the 33 Medicare Advantage contractors who reported vendor-initiated offshore outsourcing indicated that their domestic vendors transfer personal health information to an independent foreign vendor. For example, a Medicare Advantage contractor reported using a domestic subsidiary to provide claims data entry services. This subsidiary, in turn, engages in downstream outsourcing with an independent vendor located in India, where the data entry services for the Medicare Advantage contractor are performed. Medicare Advantage contractors were not the only respondents to report such downstream outsourcing relationships. A state Medicaid agency reported that its domestic vendor for customer services, which include handling call center operations and member enrollment, relies on an independent vendor located in India to perform these services. Although our survey identified several countries as locations for offshore vendors, India was the predominant destination for outsourcing services that involve personal health information. Of the 33 Medicare Advantage contractors whose domestic vendors were responsible for most of the offshore outsourcing reported in our survey, 25 reported that personal health information had been transferred to workers located in India. Less common locations included Ghana and Mexico, with nine and six instances of offshore outsourcing, respectively. (See table 4.) Privacy experts have emphasized that the contracts between firms and their vendors are important to ensuring privacy when outsourcing services that involve personal information. They also suggest safeguard measures that should be considered to protect privacy when outsourcing. These include measures to be taken during the vendor selection process and after personal health information has been outsourced. Federal contractors and state Medicaid agencies responding to our survey varied substantially in their reported use of these safeguard measures. Privacy experts indicated that having specific provisions in contractual agreements is key to ensuring that personal information is properly protected when transferred to a vendor. They noted that contracts should specify the vendors’ responsibilities for maintaining safeguards to protect personal information, circumstances under which personal information may be disclosed, and rules for subcontracting.