Am I allowed to work with public health information for a US company while overseas in Brazil?

Question

I'm in public health and specifically deal with public health information (PHI) of clients while working remotely in Brazil. However, I was told by my employer that i cannot be overseas while working with this company because i deal with public health information. I'm kindly asking, if the employer knows that im overseas and decides to take action against me, what consequences can i face? And is it legal to be overseas while working with PHI?  
 
Would appreciate your help. 
 
Thank you.

Jane Kim · Answer

As you know, penalties for healthcare data breaches are very high and your employer is required to protect PHI.  
When you work abroad, your employer cannot control security of your internet, your IP, your router, how the internet traffic travels and through which channels, etc. Since your employer cannot control the most elemental parts of Internet information flow, I'd say your employer is correct to prohibit you from accessing their system from abroad.  
 
It is very easy to identify where you are located based on your IP address. If you use VPN to trick their system into thinking you are in NY, for instance, it is also very easy to identify that. Anyone can trace IPs. I would expect their system will block any VPN traffic. I'd return state-side if you'd like to continue working on sensitive "PROTECTED" health information (PHI).

Tim Akpinar · Answer

It could lead to violations of the employment agreement. If there is improper/unauthorized release of patient information, it might involve violations of HIPAA laws. Good luck

James L. Arrasmith · Answer

As a Californian attorney, I can provide general guidance, but the specific legal implications may vary depending on the laws and regulations of your employer's location and the nature of the public health information (PHI) you handle. 
 
In the United States, working with PHI is subject to strict regulations under the Health Insurance Portability and Accountability Act (HIPAA). If you are handling PHI while overseas, it is essential to ensure compliance with HIPAA and any other relevant privacy and data protection laws in both the U.S. and Brazil. 
 
Your employer may have specific policies or contractual agreements regarding remote work and the handling of PHI, which you should review and adhere to. Failure to comply with these policies could lead to disciplinary action, including termination of employment. 
 
To fully understand your rights and responsibilities, it is best to consult with an employment attorney who can review your employment contract, company policies, and the applicable laws to provide you with personalized legal advice. - James Arrasmith, Owner. The Law Offices of James L. Arrasmith.

Q: Am I allowed to work with public health information for a US company while overseas in Brazil?