{"id":1333,"date":"2017-10-20T16:16:14","date_gmt":"2017-10-20T23:16:14","guid":{"rendered":"https:\/\/blog.sprucehealth.com\/?p=1333"},"modified":"2023-10-26T06:04:22","modified_gmt":"2023-10-26T13:04:22","slug":"bottom-line-hipaa-compliance-email","status":"publish","type":"post","link":"https:\/\/sprucehealth.com\/blog\/bottom-line-hipaa-compliance-email\/","title":{"rendered":"The Bottom Line on HIPAA Compliance and Your Email"},"content":{"rendered":"

Email is everywhere, and it’s not going away anytime soon. Social media, texting, and other forms of electronic communication have had an important and notable rise recently<\/a>, but about half of the world now uses email, and that figure is increasing.1<\/sup> In medicine, approximately 50% of patients either\u00a0use or want to use email to contact their healthcare providers, and about a third of\u00a0clinics are actually making it possible for them to do so.2,3<\/sup><\/p>\n

Email, however, was invented\u00a0well\u00a0before\u00a0either HIPAA\u00a0or our society’s modern appreciation for\u00a0the\u00a0importance of strong online security. Because of this, in its most basic and typical form, email has no credible controls to ensure sender and recipient identity, to protect message integrity, or, perhaps most importantly, to prevent third-party snooping. These deficiencies intersect particularly poorly with the legal and ethical demands on\u00a0healthcare communication,\u00a0which turns the situation into a powder keg.<\/p>\n

In short, email in medicine\u00a0can be a HIPAA disaster. But it doesn’t have to be.<\/strong><\/p>\n

Let’s talk about the\u00a0problem and what you can do to solve it.<\/p>\n

\n

What HIPAA Compliance Demands from Email<\/h2>\n

If your healthcare activities are covered by HIPAA<\/a>\u00a0and you want\u00a0to use email to store\u00a0or transmit\u00a0protected health information (PHI), then\u00a0two\u00a0important sections of\u00a0the HIPAA regulations will apply to you: the Privacy Rule and the Security Rule.<\/p>\n

We’ve discussed these rules before<\/a> in more detail, but the one-sentence summary is that the Privacy Rule governs how all PHI must be treated, while\u00a0the Security Rule provides\u00a0additional regulations for PHI that\u00a0is in electronic form (ePHI).<\/p>\n

The HIPAA Privacy Rule and email<\/h3>\n

When it comes to email and the HIPAA Privacy rule, the U.S. Department of Health and Human Services (HHS), which administers HIPAA, has actually weighed in with specific guidance<\/a>.4<\/sup> Here’s a snippet of their position:<\/p>\n

Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?<\/strong><\/em><\/p>\n

Yes. The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so. See 45 C.F.R. \u00a7 164.530(c).<\/em><\/p>\n

Sounds like great news! For reference,\u00a0the\u00a045 CFR \u00a7 164.530(c)<\/a>\u00a0that they referenced is just a citation\u00a0for a section of the actual HIPAA regulations, and it simply requires that you “have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.”<\/p>\n

Of course, when it comes to email, the definition of an “appropriate technical safeguard” becomes important. HHS weighs in on this, as well:4<\/sup><\/p>\n

Covered entities will want to ensure that any transmission of electronic protected health information is in compliance with the HIPAA Security Rule requirements at 45 C.F.R. Part 164, Subpart C.<\/em><\/p>\n

So that brings us to the Security Rule…<\/p>\n

The HIPAA Security Rule and email<\/h3>\n

The 45 CFR Part 164, Subpart C<\/a>,\u00a0which HHS referenced above\u00a0is actually quite long and contains many of the foundational aspects of the HIPAA Security Rule. Instead of going through all of it, we’re going to\u00a0assume that you already have a functioning HIPAA compliance program in place,\u00a0and\u00a0we’ll spend this section highlighting\u00a0just a few key\u00a0regulations that are especially important\u00a0when it comes to email. If you\u00a0need a more\u00a0thorough rundown on the Security Rule first, check out our earlier complete guide to HIPAA compliance<\/a>.<\/p>\n

Within the Security Rule, much\u00a0of the important technical guidance shows up in\u00a045 CFR \u00a7 164.312<\/a>, a section on “technical safeguards.”5<\/sup> Let’s take an abridged look at some of this section’s requirements as they apply to email:<\/p>\n