Articles

International Verifications Present Unique Risks

A couple of years ago, there was a news story about a California hospital that outsourced its medical transcribing, and the work ended up in Pakistan. A medical transcriber in Pakistan got into a dispute with her employer about wages and threatened to publish the medical records of thousands of Americans on the Internet. Needless to say, the hospital suffered through a great deal of negative publicity, and the privacy and confidentially of medial records for numerous Americans were endangered because their personal information was sent-offshore beyond the reach of U.S. privacy laws. Of course, even after the matter was settled with appropriate payments, no one knows for sure what information the off-shore worker may have decided to keep or for what reason.

Background firms that send Personally Identifiable Information (PII) offshore for processing could find themselves in the same boat. When a background-screening firm does an international verification of employment or education by sending PII such as a copy of a diploma or passport to an offshore agent, that background firm is playing Russian Roulette with its reputation and the financial repercussions that can occur from a data breech. The offshore agent is completely beyond U.S. Privacy rules and there is little control over what they do with the information. As the California hospital found out, sending private data abroad for processing is risky business.

In order to protect U.S. screening firms as well as U.S. employers and job applicants, ReferencePro has developed a unique approach to international verification of employment and education. Employers and schools providing verification information to ReferencePro are, in the parlance of international privacy agreements, “data controllers.” ReferencePro only provides PII directly to the “data controller” meaning the school or employer that has the information needed. Even then, ReferencePro only supplies the minimum amount needed by the school or employer to get the verification.

For those countries where ReferencePro has agents on the ground, those agents do NOT receive or handle any PII. The agent instead contacts the “data controller” to establish the means of verification. Where PII is needed it is sent DIRECTLY and securely from the ReferencePro U.S. offices to the “data controller,” and the offshore agent never has confidential or personal information.

The only exception is where the verification must be done in person, such as a recent case where ReferencePro confirmed past education at an African school by having its agent take a four-hour bus trip to the school to obtain the verification in person.

ReferencePro has taken additional steps to protect PII. First, ReferencePro is Safe Harbor Certified with the U.S. Department of Commerce, meaning ReferencePro has privacy policies meant to protect confidential and personal data in the European Union (EU) countries. EU Privacy policies are arguably the strictest the world. Furthermore, ReferencePro has retained one of the leading law firms in the United Sates and has consulted with its expert on international privacy laws in order to give its clients the best possible protection.

The bottom-line: Protection of PII is mission critical for any screening firm, and it does not change when there is an international verification. Sending any PII offshore creates a substantial and entirely unnecessary risk. By using ReferencePro, screening firms can provide their clients with international verifications without risk of compromising PII.

« Back to Articles