Perspectives on medical outsourcing and telemedicine

Low-cost labor, time zone differences, and telecommunication advances have “flattened” the world of business and services1 ; however, health care has been relatively insulated from these world-flattening forces until recently. In particular, the fundamental physicality of medicine — the need to examine a patient or look at a chart or radiograph — prohibited the remote outsourcing that was possible in manufacturing or call centers.2 However, digitized health care now permits the outsourcing of a range of medical services, from clinical diagnostics to direct care.

Although outsourcing of any type triggers predictable worries,3 outsourcing of health care raises special issues. Health care takes place in a complex regulatory and legal environment. Reimbursement is often from private insurers and government agencies, each with their own concerns and agendas. Both cost and quality of care must be gauged against a backdrop of privacy, billing, licensing, and liability concerns.

In this article, we explore some of the critical regulatory, legal, and policy issues surrounding health care outsourcing and telemedicine. We do not address “medical tourism” (the practice of obtaining health care in another country)4 ; the regulatory issues that it raises, though somewhat related, undoubtedly merit separate treatment.

Overview of Medical Outsourcing and Telemedicine

Medical outsourcing refers to the process by which a health care provider (whether an individual physician, a medical group, a hospital, or a health care system) engages outside third parties to provide medical services. Telemedicine focuses on the electronic delivery of these services, which are usually clinical (e.g., specialist consultations) or diagnostic (e.g., teleradiology) but sometimes include information distribution.5 ,6

Medical outsourcing has grown more slowly than other types of outsourcing for several reasons. First, patients have traditionally regarded health care as intensely personal, making them wary of the relative anonymity of outsourcing. Moreover, outsourcing of services normally performed by highly trained, licensed professionals such as physicians and lawyers (so-called extreme professional outsourcing7 ) generally grows more slowly than outsourcing of other services such as call centers and manufacturing. Finally, most medical outsourcing requires a robust and, until recently, prohibitively expensive backbone of information technology.8 ,9

All of this is changing rapidly. Skilled health care labor is now available in many countries. Patients seem primed to embrace the kind of technology that has transformed personal finance and other services. Payers, reeling from runaway costs, may welcome outsourcing that delivers acceptable outcomes at substantially lower costs. The costs of the information technology needed for outsourcing have fallen considerably, and many hospitals have already installed the required infrastructure for local purposes.

The extent of U.S. health care outsourcing and telemedicine is unclear, but emerging evidence indicates a growing array of activities. As many as 300 hospitals nationwide, and two thirds of radiology practices, appear to be using some form of teleradiology.2 ,10 -13 One pioneer in remote intensive care unit services reports having 150 client hospitals,10 and hospitals in an estimated 27 states may be using some form of telepathology.14 A 2004 federal report estimated (at that time) a $380 million telemedicine market, with projected annual growth rates of 15 to 20% and particularly robust growth in the fields of radiology, dermatology, mental health consultation, and home care.6 The same report noted 240,000 annual teleconsultations by the Department of Veterans Affairs alone.

The more controversial question concerns the extent of foreign medical outsourcing. Beyond the well-acknowledged foreign market for teleimaging, foreign outsourcing of telepathology has been increasingly reported.14 A 2006 federal report suggests that many U.S. health institutions, unaware of foreign subcontracts by their domestic vendors, underreport foreign outsourcing.15 Recent commentaries suggest that India alone has already captured 2% of the U.S. health care market.8 ,16 This kind of growth will undoubtedly fuel considerable debate over the regulatory, legal, and policy context of outsourcing.

Regulatory, Legal, and Policy Context

Information Privacy

Information privacy remains the greatest source of concern about medical outsourcing. Several high-profile breaches involving foreign providers have contributed to the notion that international outsourcing of sensitive information is an inherently risky endeavor.2 ,17

The risk of a breach of privacy in any kind of outsourcing stems from both the manner of information transfer (i.e., through electronic channels vulnerable to hacking and other security breaches) and the reliance on third parties. Many of these third parties (even domestic ones), although contractually bound to maintain confidentiality, operate beyond the scope of direct supervision. In this environment, one must question whether foreign outsourcing is inherently more risky than other forms of transmission of health care data. A 2006 report disclosed that 40% of federal health insurance contractors and state health agencies, both engaged primarily in domestic outsourcing, had reported recent breaches in personal health information privacy15 ,18 ; additional data suggest that many such breaches arise from failure to dispose of information properly.19

Although the Health Insurance Portability and Accountability Act (HIPAA) establishes significant specific contractual requirements for primary contractors and business associates, the requirements for ongoing supervision of business associates, except in the case of known breaches, are minimal.20 ,21 Indeed, HIPAA and related regulations do not require significant information audits or pre-engagement due diligence, features typically seen in nonmedical professional-service agreements. In the future, policymakers may be challenged to craft these kinds of safeguards without nullifying the potential efficiency advantages of outsourcing arrangements.

Regulatory and Billing Compliance

In addition to the HIPAA regulations, providers must navigate rapidly changing Medicare and Medicaid regulations. Most of these regulations predate outsourcing based on information technology and were developed with relatively little regard for quality measurement and reporting. Whatever the vintage and intent of these regulations, their evolution is not easy to track, and they may either promote or restrict the international outsourcing of health care services for the foreseeable future.

For example, based on interpretations of the current regulations, most international teleradiology companies have required that their radiologists be licensed in the states of the patients whose films they are reading, have medical-staff privileges at the patients’ hospitals, and have local malpractice insurance. According to the founder of NightHawk Radiology Services, which has more than 100 affiliated radiologists (about half stationed overseas), the average NightHawk radiologist holds 38 state licenses and has staff privileges at more than 400 hospitals. NightHawk employs more than 35 people whose sole focus is credentialing and licensing.22 Obviously, these domestic licensure and accreditation requirements are burdensome, but they have not hindered NightHawk’s ability to create a viable business model.

The more challenging issues for international outsourcing companies may be related to payment. Most notably, recent changes in Centers for Medicare and Medicaid Services (CMS) regulations stipulate that providers cannot seek Medicare reimbursement for services physically performed outside the United States, even if the provider has a U.S. license and certification.23 The ambiguously worded CMS changes are currently being interpreted as not restricting the use of foreign outsourcing for preliminary work (i.e., work performed to facilitate completion of services by a qualified U.S. provider), assuming that the non-U.S.-based provider does not seek reimbursement. Accordingly, if a U.S. hospital uses a U.S.-credentialed radiologist operating in India to provide final readings of radiographs, it cannot properly seek reimbursement (from CMS at least). However, if the same hospital uses a radiologist in India to provide preliminary readings that are then reviewed for a final reading by a U.S.-based and U.S.-licensed radiologist, the final reading is probably reimbursable. Under such arrangements, the domestic provider (hospital or physician), not the payer, usually compensates the foreign radiologist or the radiologist’s company.

No doubt, this scenario could lead to abuse, particularly if the U.S.-based radiologist did not exercise requisite care in reviewing and approving the preliminary reading (a practice now commonly referred to as “ghosting”). Conceptually, though, this risk is not unique to the use of outsourcing for preliminary readings. Under current CMS regulations, preliminary readings by nonlicensed radiology residents may be used by a licensed radiologist to make final readings that are ultimately reimbursable.24

Because the growth of offshore medical outsourcing and telemedicine will be substantially influenced by regulations and reimbursement policies, one can expect increasing activism and even internal standard setting by professional associations. Though such associations are independent, nongovernment entities, they have several tools to influence practice within their fields. For example, the American College of Radiology Task Force on International Radiology has endorsed state licensure, certification, and continuing education requirements for telemedicine, as well as full disclosure of board certification to patients and contracting parties.25

Malpractice and Liability

Risk management in the era of telemedicine and medical outsourcing remains largely uncharted territory. Principal challenges and concerns include defining what constitutes telemedicine malpractice, determining where and against whom claims can be brought, and navigating diverse insurer policies regarding practices that are covered and those that are excluded.

The first question is whether a U.S. practice can be found liable for the acts of its foreign telemedicine providers. The answer is probably yes. Though there may be some variability in state law, the well-established “ostensible agency” doctrine would probably apply.16 ,26 ,27 In simple terms, if a U.S. hospital uses an offshore pathologist to provide diagnostic readings, the hospital would probably be liable for breaches committed by the pathologist. Hospitals may try to evade liability by informing patients that they use outsourced services and obtaining their consent to do so. Whether such consent and disclosure practices will allow hospitals to avoid liability remains an open question. If courts do interpret ostensible agency as making the hospital liable for acts of remote providers, it seems likely that a hospital being sued by a patient may, in turn, attempt to initiate its own claim against the remote provider.16 ,28

In the specific case of international teleradiology, the American College of Radiology has established standards governing how U.S. entities engage and supervise telemedicine providers and has issued additional policy statements strictly prohibiting ghosting practices.25 ,29 As these standards create more definable duties of care, the entity engaging the remote provider may be found liable for a variety of breaches related to the mechanism of outsourcing itself — for example, for ghosting, failure to supervise, and failure to ensure appropriate licensure — even if the remote provider is not found to be individually liable. The licensure issue may be particularly challenging, given that many states have not adopted licensing regulations that are applicable to telemedicine.30 ,31

All the issues regarding the standard of care and potential legal remedies are made even more confusing by variations in jurisdictional standards outside the United States. In a worst-case scenario, a U.S.-based plaintiff may be left with the choice of suing a foreign provider in a foreign jurisdiction or suing the provider in a U.S. court and attempting to enforce the judgment in the foreign jurisdiction. Many countries, including India, do not readily enforce U.S. court decrees.

Several solutions to the jurisdictional and enforcement uncertainties of telemedicine malpractice liability have been suggested, ranging from administrative compensation funds and the use of enforceable international arbitration provisions to strict liability rules (like those used for product liability) that would hold U.S. providers liable for any acts of third-party contractors.16 ,32 If compensation funds were to be created, the question of whether they should be underwritten by the primary domestic health entities, foreign providers, or insurers would have to be considered. Some of these uncertainties may become less important as large multinational corporations such as Wipro (offering services ranging from teleradiology to health plan administration), with deep pockets and most important a growing physical presence in the United States, aim to increase their share of the telemedicine markets.33

Of course, from a business standpoint, the most powerful tool for risk reduction, in the setting of a relatively vague standard of care, is a broad and comprehensive insurance policy. Wary of ambiguity and reassured by clearly defined risk, insurers have avoided the telemedicine market. At a minimum, they are likely to insist on appropriate licensure of telemedicine providers, excluding coverage for activities of nonlicensed providers. Whether preliminary readings of radiographs by nonlicensed overseas providers could also be excluded from coverage has not yet been tested. It also is not known whether insurers will try to avoid paying for telemedicine-related services by invoking a number of other common policy exclusions, such as breaches of the privacy of information and performance of acts that the insured “should have known” would result in loss.34 If insurers fail to offer clear guidelines, providers will be left to discern for themselves whether the uninsured risk involved in medical outsourcing is outweighed by the benefits of cost savings and increased efficiency.

Patient Consent

Medical outsourcing often occurs “behind the scenes,” with patients unaware that certain services may be delivered by foreign physicians or foreign vendors. Under HIPAA, hospitals and other primary providers are not required to obtain consent from patients to disclose private health information for the purpose of routine “treatment, payment and health care operations.”20 ,21 Medical outsourcing, whether domestic or offshore, would fall under this umbrella; thus, patient consent might not be required for the use of outsourced billing, transcription, teleradiology, or even intensive care unit or consultation services (even if the providers operate from other countries). The primary provider, however, would be required to disclose its privacy practices to patients. An appropriate description of practices would probably include disclosure of any use of outsourced, third-party contractors. What remains unclear is whether such a disclosure should include specific information regarding the kind of outsourcing used (e.g., offshore vs. domestic).

Ultimately, although consent for each outsourced service may not be required under HIPAA, primary providers nevertheless may choose to obtain consent. Consent and disclosure may mitigate the impression that the provider was using outsourcing inappropriately or engaging in concealment or misrepresentation and could reduce the risk of ostensible-agency liability.

Measuring and Ensuring Quality of Care

Health care services will increasingly be judged on the basis of considerations of value — quality divided by cost.35 In most international outsourcing arrangements, the denominator of the equation will be enviably small; the usual raison d’être for such outsourced care is that it is less expensive than domestic care. Even when outsourcing is filling the gap between the supply of and demand for critical services such as nighttime pathology or radiology coverage, the gap may be due not to a true shortage of domestic providers but rather to the prohibitive cost of providing around-the-clock service.

Even though outsourced care may be less expensive, few would support its growth if the cost savings came at the expense of quality or safety. This raises an important question: How do we adapt traditional measures of quality to a newly globalized practice environment? The answer may be surprisingly straightforward. Although medical outsourcing changes the pathway to quality end points, it does not change the nature of the end points themselves. For example, quality outcomes in a pathology practice might be measured by the number of correctly read specimens (assessed, perhaps, by means of random audits); the nature of this end point does not change simply because the readings are performed by a Singaporean pathologist or because a preliminary reading by a foreign physician is subsequently reviewed by a domestic one.

In the case of other services — international consultations delivered through telemedicine, for example — judging the quality of care may be more challenging. However, the technological scaffolding that makes international outsourcing possible will probably help in the quest to measure and ensure quality. One can envision a quality-assurance program that sends random samples of radiographs to expert domestic providers for second readings (with quality judged by the degree of concordance) or one that facilitates high-quality consultative advice by embedding evidence-based decision support into the information-technology system itself.

In addition to measuring quality at the level of individual decisions about care, developing international standards for the competence of providers and institutions might bolster the quality of care. Just as the Joint Commission has formed an international arm (Joint Commission International) to accredit hospitals around the world,36 one can envision initiatives by multinational specialty boards to establish standards for international board certification of individual providers. Moreover, the Joint Commission is currently considering modifications of its leadership standards to require more careful monitoring of nonaccredited service providers (i.e., most offshore telemedicine providers and some domestic telemedicine providers), including direct observation of the provision of care, information audits, and performance review.37 Whether the revised standards, or related efforts by U.S. specialty boards, will specifically address management of offshore or domestic medical outsourcing remains unclear, but the need to develop uniform, borderless standards of quality in an era of both outsourcing and medical tourism seems self-evident.

Conclusions

International outsourcing, in any field, raises concerns about quality, safety, privacy, and the financial interests of domestic providers. Health care has a number of unique attributes that magnify these concerns. Opponents of outsourcing have an unusual array of regulatory and legal tools to block widespread adoption of the practice. To the extent that international outsourcing is filling gaps in access to care (regionally or at night and on the weekend), it seems likely that protectionist hurdles will be few and weakly buttressed. When outsourcing competes directly with domestic providers, however, one can expect expressions of concern to be loud and numerous.

The predominant question, however, should be whether a regulatory framework can be created to promote outsourcing that truly enhances the value of care — decreasing costs while preserving quality — and to thwart practices that fall below appropriate standards. The sooner suitable measures of quality can be developed and promulgated, the better positioned American patients, policymakers, regulators, and accreditors will be to make reasoned judgments regarding these complex and politically charged questions.

Dr. Wachter reports serving on the board of directors of the American Board of Internal Medicine and being a paid member of the health care advisory boards of Google, Intellidot, and Hoana Medical. He reports holding an equity interest in the latter two companies, which do not make products that are relevant to this article. No other potential conflict of interest relevant to this article was reported.