3 ms·

> Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be int

by u801e 9y ago

> Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. On the subject of fax machines, would they still be compliant if they're connected to a VOIP system?

Clubber 9y ago
>Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.
- u801e 9y ago
  > but that's typically more cumbersome as you have to trade keys with everybody that needs an email. What would be needed is a public key infrastructure. If organizations like the state board of medicine could serve as a certificate authority for physicians licensed in that state (or maybe the DEA since they issue id numbers to physicians that are needed for controlled substance prescriptions), then the key management would not be as much of an issue. In other words, it shouldn't be handled by individual organizations; it should be handled by the authorities who are responsible for licensing doctors, nurses, pharmacists, hospitals, etc. > On top of all that, each client will have to be taught how to decrypt (and encrypt) emails This is certainly something that can be automated and shouldn't have to be a manual process. A plug-in for a program like Outlook should work in the vast majority of cases. That is, if the email is sent to the wrong address, then the recipient would only see encrypted text, but it would automatically be decrypted for the correct recipient.
  - Clubber 9y ago
    That sounds fine in theory and if implemented well it would work, but I'm not sure how well it would work in reality. I just refer to my small business tax return every year to get an idea of how many forms would need to be filled out to just send email. How would that work for offices that send non PHI emails? Would it go through that system too, or would it have to key on recipient email addresses? How hard would it be to shut down and create a new email for each employee that left, etc. Would you have to have a special email server just for PHI and another for regular? How many times would employees accidentally send PHI over a non-secured channel on accident? Also, physicians themselves rarely send emails, they have office assistants do it. They are busy providing care. How would that work? The office assistant position doesn't have any direct regulation (that I know of) so you'd either have to have the physicians send out emails (ya right), have an assistant use the physician's account (oh no), or add a bunch of regulation to office assistants (to the tune of doctors and nurses) which would make them more expensive and make office visits more expensive (etc). It sounds good as a technologist, but if you look for unintended consequences (costs), I'll bet there are a bunch I didn't even think of. Also, organizations are highly motivated to get this right because the fines have teeth. Up to $50K per incident capped at $1.5 million per annum. https://www.truevault.com/blog/what-is-the-penalty-for-a-hipaa-violation.html https://www.truevault.com/blog/what-is-the-penalty-for-a-hip...
    - u801e 9y ago
      > How would that work for offices that send non PHI emails? They could encrypt those emails as well. While sending a non-encrypted email that contains PHI is a problem, sending an encrypted email that doens't contain PHI shouldn't be an issue (as long as the intended recipient can decrypt it, which they should). > How hard would it be to shut down and create a new email for each employee that left, etc. That comes down to revoking the certificate or using shorter intervals for the duration where the certificate is considered valid. For example, if the organization requires that one changes their password every 60 days, then a certificate should not have more than a 60 day period where it's valid. > Would you have to have a special email server just for PHI and another for regular? This wouldn't be server dependent. This would be dependent on the email client handling the encryption and decryption. The more that's automated, the less chance that there's a mistake with regards to email containing PHI. > Also, physicians themselves rarely send emails, they have office assistants do it. They are busy providing care. Physicians have to do all sorts of things like writing progress notes, dictating admission and discharge summaries, calling in prescriptions, writing orders, etc. The system they use could also be used to securely send PHI containing email to other physicians, pharmacists, or hospital systems. But regulation could be a good incentive against physicians allowing others to use their account credentials to do things like sending PHI information to other organizations. No physician would like to be summoned by the board of medicine of the state they're licensed in over something like that. But I think that a lot of the problems could be addressed by those who have cross-domain knowledge about technology and health-care (speaking as someone who went through medical school and subsequently changed fields to computer science/software development).

by u801e 9y ago

Clubber 9y ago

>Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.

u801e 9y ago
> but that's typically more cumbersome as you have to trade keys with everybody that needs an email. What would be needed is a public key infrastructure. If organizations like the state board of medicine could serve as a certificate authority for physicians licensed in that state (or maybe the DEA since they issue id numbers to physicians that are needed for controlled substance prescriptions), then the key management would not be as much of an issue. In other words, it shouldn't be handled by individual organizations; it should be handled by the authorities who are responsible for licensing doctors, nurses, pharmacists, hospitals, etc. > On top of all that, each client will have to be taught how to decrypt (and encrypt) emails This is certainly something that can be automated and shouldn't have to be a manual process. A plug-in for a program like Outlook should work in the vast majority of cases. That is, if the email is sent to the wrong address, then the recipient would only see encrypted text, but it would automatically be decrypted for the correct recipient.
- Clubber 9y ago
  That sounds fine in theory and if implemented well it would work, but I'm not sure how well it would work in reality. I just refer to my small business tax return every year to get an idea of how many forms would need to be filled out to just send email. How would that work for offices that send non PHI emails? Would it go through that system too, or would it have to key on recipient email addresses? How hard would it be to shut down and create a new email for each employee that left, etc. Would you have to have a special email server just for PHI and another for regular? How many times would employees accidentally send PHI over a non-secured channel on accident? Also, physicians themselves rarely send emails, they have office assistants do it. They are busy providing care. How would that work? The office assistant position doesn't have any direct regulation (that I know of) so you'd either have to have the physicians send out emails (ya right), have an assistant use the physician's account (oh no), or add a bunch of regulation to office assistants (to the tune of doctors and nurses) which would make them more expensive and make office visits more expensive (etc). It sounds good as a technologist, but if you look for unintended consequences (costs), I'll bet there are a bunch I didn't even think of. Also, organizations are highly motivated to get this right because the fines have teeth. Up to $50K per incident capped at $1.5 million per annum. https://www.truevault.com/blog/what-is-the-penalty-for-a-hipaa-violation.html https://www.truevault.com/blog/what-is-the-penalty-for-a-hip...
  - u801e 9y ago
    > How would that work for offices that send non PHI emails? They could encrypt those emails as well. While sending a non-encrypted email that contains PHI is a problem, sending an encrypted email that doens't contain PHI shouldn't be an issue (as long as the intended recipient can decrypt it, which they should). > How hard would it be to shut down and create a new email for each employee that left, etc. That comes down to revoking the certificate or using shorter intervals for the duration where the certificate is considered valid. For example, if the organization requires that one changes their password every 60 days, then a certificate should not have more than a 60 day period where it's valid. > Would you have to have a special email server just for PHI and another for regular? This wouldn't be server dependent. This would be dependent on the email client handling the encryption and decryption. The more that's automated, the less chance that there's a mistake with regards to email containing PHI. > Also, physicians themselves rarely send emails, they have office assistants do it. They are busy providing care. Physicians have to do all sorts of things like writing progress notes, dictating admission and discharge summaries, calling in prescriptions, writing orders, etc. The system they use could also be used to securely send PHI containing email to other physicians, pharmacists, or hospital systems. But regulation could be a good incentive against physicians allowing others to use their account credentials to do things like sending PHI information to other organizations. No physician would like to be summoned by the board of medicine of the state they're licensed in over something like that. But I think that a lot of the problems could be addressed by those who have cross-domain knowledge about technology and health-care (speaking as someone who went through medical school and subsequently changed fields to computer science/software development).