6 ms·

I'm pretty sure email can be HIPAA compliant as long as you implement the system using the established guidelines.

toomuchtodo 9y ago
Indeed it is as long as you’ve configured your email system to use TLS and not downgrade to no encryption if the handshake fails for mail systems where HIPAA-governed information is departing to. Source: Not a lawyer, not your lawyer. Sign off provided by non profit bio research orgs lawyer before I set it up.
- newman8r 9y ago
  This is my understanding as well. Additionally, I believe you can send encrypted attachments over an unencrypted connection. Furthermore, https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.p... suggests that it's acceptable to send patients unencrypted PHI if they've explicitly agreed to accept the risks associated with that (although I'd be extremely cautious in those situations)
- Spooky23 9y ago
  That’s more for B2B use cases. Like between a medical practice and hospital. The unreliability of delivery to destinations that don’t support TLS will create customer service issues in B2C scenarios.
Clubber 9y ago
Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body. The email becomes just a notification via SMTP. The recipient then goes to the site and logs in to view the email. The PHI is what you care about (and it's, very, very strict). No PHI in the subject either. I suspect the reason faxes are compliant is a few: 1. Grandfathered in. 2. The number of unauthorized people that can see them is very limited (to whomever has access to the fax machine). 3. Modern fax machines print face down. 4. Data is in hard copy format which is more difficult to copy. As an aside, modern fax machines are probably less secure than the old ones. Fax machines using digi-boards and databases and whatnot. The vast majority of US healthcare use faxes though.
- u801e 9y ago
  > Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. On the subject of fax machines, would they still be compliant if they're connected to a VOIP system?
  - Clubber 9y ago
    >Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.
    - u801e 9y ago
      > but that's typically more cumbersome as you have to trade keys with everybody that needs an email. What would be needed is a public key infrastructure. If organizations like the state board of medicine could serve as a certificate authority for physicians licensed in that state (or maybe the DEA since they issue id numbers to physicians that are needed for controlled substance prescriptions), then the key management would not be as much of an issue. In other words, it shouldn't be handled by individual organizations; it should be handled by the authorities who are responsible for licensing doctors, nurses, pharmacists, hospitals, etc. > On top of all that, each client will have to be taught how to decrypt (and encrypt) emails This is certainly something that can be automated and shouldn't have to be a manual process. A plug-in for a program like Outlook should work in the vast majority of cases. That is, if the email is sent to the wrong address, then the recipient would only see encrypted text, but it would automatically be decrypted for the correct recipient.

Indeed it is as long as you’ve configured your email system to use TLS and not downgrade to no encryption if the handshake fails for mail systems where HIPAA-governed information is departing to. Source: Not a lawyer, not your lawyer. Sign off provided by non profit bio research orgs lawyer before I set it up.

newman8r 9y ago
This is my understanding as well. Additionally, I believe you can send encrypted attachments over an unencrypted connection. Furthermore, https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.p... suggests that it's acceptable to send patients unencrypted PHI if they've explicitly agreed to accept the risks associated with that (although I'd be extremely cautious in those situations)
Spooky23 9y ago
That’s more for B2B use cases. Like between a medical practice and hospital. The unreliability of delivery to destinations that don’t support TLS will create customer service issues in B2C scenarios.

Clubber 9y ago

Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body. The email becomes just a notification via SMTP. The recipient then goes to the site and logs in to view the email. The PHI is what you care about (and it's, very, very strict). No PHI in the subject either. I suspect the reason faxes are compliant is a few: 1. Grandfathered in. 2. The number of unauthorized people that can see them is very limited (to whomever has access to the fax machine). 3. Modern fax machines print face down. 4. Data is in hard copy format which is more difficult to copy. As an aside, modern fax machines are probably less secure than the old ones. Fax machines using digi-boards and databases and whatnot. The vast majority of US healthcare use faxes though.

u801e 9y ago
> Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. On the subject of fax machines, would they still be compliant if they're connected to a VOIP system?
- Clubber 9y ago
  >Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.
  - u801e 9y ago
    > but that's typically more cumbersome as you have to trade keys with everybody that needs an email. What would be needed is a public key infrastructure. If organizations like the state board of medicine could serve as a certificate authority for physicians licensed in that state (or maybe the DEA since they issue id numbers to physicians that are needed for controlled substance prescriptions), then the key management would not be as much of an issue. In other words, it shouldn't be handled by individual organizations; it should be handled by the authorities who are responsible for licensing doctors, nurses, pharmacists, hospitals, etc. > On top of all that, each client will have to be taught how to decrypt (and encrypt) emails This is certainly something that can be automated and shouldn't have to be a manual process. A plug-in for a program like Outlook should work in the vast majority of cases. That is, if the email is sent to the wrong address, then the recipient would only see encrypted text, but it would automatically be decrypted for the correct recipient.