Also, note that there is a criminal penalty for intentionally committed offenses.
Does it sound serious enough? It does, but before we move forward, let’s check what is not subject to HIPAA:
- A patient gave you written consent to communicate via non-secure, non-encrypted channels. However, it is better to transmit data securely – just to stay on the safe side.
- As a patient, you send an email to your doctor. According to HIPAA, the one who started the data transmission is considered the liable party. Be careful: if you as a doctor reply to the patient’s email, it becomes subject to HIPAA compliance.
- Your email communications don’t contain personal information. If you are sending the results of medical research or statistic to a hospital, for instance, they are not subject to HIPAA.
- No HIPAA entity is involved in the data transmission process. For example, you develop an application that allows users to schedule their visits to doctors and creates reminders for taking medicine or alerts when their plan is up to expire. The email notifications from such an app won’t be subject to HIPAA as well.
As a rule of thumb, it is better to protect the information that is not HIPAA compliant information than to miss something and send HIPAA covered data in an insecure way.
HIPAA requirements
The most complicated thing about HIPAA compliance is that the requirements are broad but still vague. Another difficulty encompasses the unavailability of the official compliance certification.
After all, as a HIPAA covered entity, you have to follow technical, physical, and administrative safeguards to ensure proper ePHI protection.
Technical safeguards relate to technology methods to protect ePHI and data access.
Their only provision is that all confidential information transferred outside the internal firewalled servers must be encrypted according to the standards approved by the U.S. National Institute of Standards and Technology (NIST). We will discuss the email encryption in a separate section of this article.
In the rest, you have to ensure the following, in any appropriate method:
- ePHI access control
- ePHI authentication mechanism
- encryption and decryption tools
- audit controls and activity logs
- automated logout for any device
Physical safeguards concern the data storage and include physical access to data on servers (both local and cloud) and devices.
Administrative safeguards focus on the implementation of technical and physical protection.
For more details, we recommend following the HIPAA Journal and the U.S. Department of Health & Human Services website.
How to encrypt emails for HIPAA compliance?
We have already mentioned that according to the HIPAA requirements, emails must be encrypted to NIST standards. It means that messages need to be both encrypted and decrypted to ensure security while sending, transferring, receiving, and storing information.
AES encryption is one of the recommended algorithms. It is implemented in TLS as well, but note that simple TLS encryption is not enough: mostly, email services use opportunistic TLS. This is enough for sending encrypted information but if the recipients’ server doesn’t support TLS, the message arrives without encryption.
So, how can you implement the required encryption for your email messages?
Set up your own infrastructure
This method fits large corporate organizations that have resources for setup and maintenance of their own secure hosting and email infrastructure. This is a complicated and highly tech savvy task. If you are not absolutely sure that you are able to ensure the required level of security, it is better to use a third-party service.
Don’t send confidential information via email
It sounds weird but in fact, you can keep all the ePHI on the dedicated patient portal, which is HIPAA compliant, and send a link to the appropriate notification via email. You should consider this option if you already use (or plan to use) a patient portal software. Such platforms offer all-in-one service for scheduling, payments, messaging, and more. Some of the popular systems are Athenahealth, Epic, Cerner, NextGen Office, etc.
Use an encrypted email service
This is the most popular option and you have a broad selection of HIPAA compliant email sending providers. Some of them offer standalone services and other – plugins for your preferred email clients. We will do a brief overview of the most popular options in a separate section.
Patient safety and confidentiality are top priorities for services provided by the server. As a healthcare provider, a HIPAA compliance security checklist is a must. If you have a medical website built with WordPress, you are probably wondering if it should (and can) be compatible with HIPAA.
Whichever method you choose, keep in mind the following rules:
- Train your staff to make sure they are aware of HIPAA regulations and properly use your software to transfer ePHI data. The majority of HIPAA violations happen due to human errors. Ideally, everyone who has access to PHI must sign the HIPAA awareness agreement to acknowledge their responsibility for violations.
- If you use a third-party provider for email sending or hosting, whatever, sign a business associate agreement. Such an agreement defines the methods that your provider uses to fulfill the HIPAA requirements as well as defines the responsibility for compliance.
- Make sure that all related online communications and archived, stored, and available for legal purposes. In case a data breach occurs, they may serve as proof of the reasonable care taken to comply with HIPAA.
HIPAA compliant email providers
The most popular solution is to entrust the transmission of sensitive data to a HIPAA compliant email service provider. In this section, we will answer the frequent questions like which email providers can be considered HIPAA compliant and whether it is possible to keep sending emails via your preferred service.
The main idea of using the proper email service is to ensure that only the authorized sender and recipient are able to access the content of the message.
The HIPAA Journal lists 10+ compliant email providers. Let’s review several services and methods they use to ensure the security of your communications.
Hushmail provides you with an email account, which is available as a web service or an iPhone app. If your recipients don’t use Hushmail, they will get emails protected with a password or a security question.
