4 ms·

Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be inter

Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body. The email becomes just a notification via SMTP. The recipient then goes to the site and logs in to view the email. The PHI is what you care about (and it's, very, very strict). No PHI in the subject either. I suspect the reason faxes are compliant is a few: 1. Grandfathered in. 2. The number of unauthorized people that can see them is very limited (to whomever has access to the fax machine). 3. Modern fax machines print face down. 4. Data is in hard copy format which is more difficult to copy. As an aside, modern fax machines are probably less secure than the old ones. Fax machines using digi-boards and databases and whatnot. The vast majority of US healthcare use faxes though.

u801e 9y ago
> Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. On the subject of fax machines, would they still be compliant if they're connected to a VOIP system?
- Clubber 9y ago
  >Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.
  - u801e 9y ago
    > but that's typically more cumbersome as you have to trade keys with everybody that needs an email. What would be needed is a public key infrastructure. If organizations like the state board of medicine could serve as a certificate authority for physicians licensed in that state (or maybe the DEA since they issue id numbers to physicians that are needed for controlled substance prescriptions), then the key management would not be as much of an issue. In other words, it shouldn't be handled by individual organizations; it should be handled by the authorities who are responsible for licensing doctors, nurses, pharmacists, hospitals, etc. > On top of all that, each client will have to be taught how to decrypt (and encrypt) emails This is certainly something that can be automated and shouldn't have to be a manual process. A plug-in for a program like Outlook should work in the vast majority of cases. That is, if the email is sent to the wrong address, then the recipient would only see encrypted text, but it would automatically be decrypted for the correct recipient.
    - Clubber 9y ago
      That sounds fine in theory and if implemented well it would work, but I'm not sure how well it would work in reality. I just refer to my small business tax return every year to get an idea of how many forms would need to be filled out to just send email. How would that work for offices that send non PHI emails? Would it go through that system too, or would it have to key on recipient email addresses? How hard would it be to shut down and create a new email for each employee that left, etc. Would you have to have a special email server just for PHI and another for regular? How many times would employees accidentally send PHI over a non-secured channel on accident? Also, physicians themselves rarely send emails, they have office assistants do it. They are busy providing care. How would that work? The office assistant position doesn't have any direct regulation (that I know of) so you'd either have to have the physicians send out emails (ya right), have an assistant use the physician's account (oh no), or add a bunch of regulation to office assistants (to the tune of doctors and nurses) which would make them more expensive and make office visits more expensive (etc). It sounds good as a technologist, but if you look for unintended consequences (costs), I'll bet there are a bunch I didn't even think of. Also, organizations are highly motivated to get this right because the fines have teeth. Up to $50K per incident capped at $1.5 million per annum. https://www.truevault.com/blog/what-is-the-penalty-for-a-hipaa-violation.html https://www.truevault.com/blog/what-is-the-penalty-for-a-hip...

u801e 9y ago

> Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. On the subject of fax machines, would they still be compliant if they're connected to a VOIP system?

Clubber 9y ago
>Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.
- u801e 9y ago
  > but that's typically more cumbersome as you have to trade keys with everybody that needs an email. What would be needed is a public key infrastructure. If organizations like the state board of medicine could serve as a certificate authority for physicians licensed in that state (or maybe the DEA since they issue id numbers to physicians that are needed for controlled substance prescriptions), then the key management would not be as much of an issue. In other words, it shouldn't be handled by individual organizations; it should be handled by the authorities who are responsible for licensing doctors, nurses, pharmacists, hospitals, etc. > On top of all that, each client will have to be taught how to decrypt (and encrypt) emails This is certainly something that can be automated and shouldn't have to be a manual process. A plug-in for a program like Outlook should work in the vast majority of cases. That is, if the email is sent to the wrong address, then the recipient would only see encrypted text, but it would automatically be decrypted for the correct recipient.
  - Clubber 9y ago
    That sounds fine in theory and if implemented well it would work, but I'm not sure how well it would work in reality. I just refer to my small business tax return every year to get an idea of how many forms would need to be filled out to just send email. How would that work for offices that send non PHI emails? Would it go through that system too, or would it have to key on recipient email addresses? How hard would it be to shut down and create a new email for each employee that left, etc. Would you have to have a special email server just for PHI and another for regular? How many times would employees accidentally send PHI over a non-secured channel on accident? Also, physicians themselves rarely send emails, they have office assistants do it. They are busy providing care. How would that work? The office assistant position doesn't have any direct regulation (that I know of) so you'd either have to have the physicians send out emails (ya right), have an assistant use the physician's account (oh no), or add a bunch of regulation to office assistants (to the tune of doctors and nurses) which would make them more expensive and make office visits more expensive (etc). It sounds good as a technologist, but if you look for unintended consequences (costs), I'll bet there are a bunch I didn't even think of. Also, organizations are highly motivated to get this right because the fines have teeth. Up to $50K per incident capped at $1.5 million per annum. https://www.truevault.com/blog/what-is-the-penalty-for-a-hipaa-violation.html https://www.truevault.com/blog/what-is-the-penalty-for-a-hip...