3 ms·

> The current method is for insurance companies to install software on their SMTP server and that's about it. I would hope that they require TLS encryption for

by u801e 9y ago

> The current method is for insurance companies to install software on their SMTP server and that's about it. I would hope that they require TLS encryption for any connection to their SMTP server. Otherwise, any communication containing PHI could easily be intercepted. This also doesn't address the issue of securing the IMAP or Exchange and MTA server(s) that the sender uses to send the email to the insurance company. > much less chance of mistakes Unless the sender CCs a copy to another address where the MTA doesn't require TLS encrypted connections and doesn't have any such software installed on the MTA. That's why the solution I proposed (having the client program automatically encrypt the email before sending it and relying on PKI to handle decryption on the other end) would be more fool-proof since, even if the email was CC'd to another address, it couldn't be decrypted by the unintended recipient. As for the cost argument, I think it could be implemented as a nominal cost on top of the costs that the physician already incurs in the process of applying/renewing their license, the practice license, etc (e.g. name, mailing address, telephone number, fax number, email address along with your PKI state board signed certificate). > Also, the vast majority of communication containing PHI is with insurance companies and the government Doctors have to communicate with other physicians outside of their group practice, hospitals they may not be affiliated with, and pharmacies. How is PHI communication in this context currently handled? > Of course there is no way to really tell unless we complete vet it out and put cost associations with everything and do PHI leak risk assessments. That is true. But I think that the technology we currently have to secure communication between clients and webservers (that allows us to do things like buy things online, interact with the bank, file taxes, etc along with client side certificates) should work perfectly well with PHI containing information. The problem is setting up the PKI for that type of communication. Since governments, universities, and private companies have already done this, there's no reason why hospitals (especially university affiliated hospitals), state boards, and health care providers can't also do this.

Clubber 9y ago
Based on that response, I don't think you are understanding how it works (or I didn't explain it well). This is for emails originating from insurance companies. Software intercepts any queued or targeted outbound email, then: 1. Replaces the body with a hyperlink to a web site and instructions, removing all PHI. 2. Hyperlink instructs recipient to login create account / login to view mail over SMTP. 3. Recipient logs into website (with TLS obviously) and reads email with PHI over secured channel. 4. Recipient can now read and reply using the website. Pretty simple. As far as physicians communicating with each other and pharmacies, they typically use faxes and phone calls.
- u801e 9y ago
  > This is for emails originating from insurance companies. That was the part I misunderstood. I thought it was for physician offices sending information to the insurance company. > Pretty simple. As far as physicians communicating with each other and pharmacies, they typically use faxes and phone calls. And that's an issue that could be addressed if all entities had a PKI set up such that they could communicate online regardless of application protocol used while maintaining compliance with HIPAA).
  - Clubber 9y ago
    Yes, if you wanted to extend a nationwide system for any and all PHI communications, your idea would be a good approach. In a more wonderful world than what we live in today, the US government would have setup a simple, unreadable (even by them) secure channel for everyday citizens to be able to transfer sensitive data to verified businesses and other citizens. They can't see past the criminals using it to subvert the police though.
    - u801e 9y ago
      > In a more wonderful world than what we live in today, the US government would have setup a simple, unreadable (even by them) secure channel for everyday citizens to be able to transfer sensitive data to verified businesses and other citizens. We pretty much already have that with the PKI system that web browsers (and other programs) check when verifying certificates for various websites we connect to (including this one). It doesn't require government intervention. It does require configuring servers that doctors, pharmacists, hospitals, labs, insurance companies, etc use to authenticate themselves with each other and a number of authorities to verify their identities (like the CA bundle that your web browser uses to verify that the server you connect to is indeed Hackernews and not some rogue entity). PKI is a powerful tool which certainly can be used in a healthcare setting. Unfortunately, because of organization inertia, it's probably not going to happen (despite the fact that the technology behind it has been around for decades).
      - 9y ago

by u801e 9y ago

Clubber 9y ago

Based on that response, I don't think you are understanding how it works (or I didn't explain it well). This is for emails originating from insurance companies. Software intercepts any queued or targeted outbound email, then: 1. Replaces the body with a hyperlink to a web site and instructions, removing all PHI. 2. Hyperlink instructs recipient to login create account / login to view mail over SMTP. 3. Recipient logs into website (with TLS obviously) and reads email with PHI over secured channel. 4. Recipient can now read and reply using the website. Pretty simple. As far as physicians communicating with each other and pharmacies, they typically use faxes and phone calls.

u801e 9y ago
> This is for emails originating from insurance companies. That was the part I misunderstood. I thought it was for physician offices sending information to the insurance company. > Pretty simple. As far as physicians communicating with each other and pharmacies, they typically use faxes and phone calls. And that's an issue that could be addressed if all entities had a PKI set up such that they could communicate online regardless of application protocol used while maintaining compliance with HIPAA).
- Clubber 9y ago
  Yes, if you wanted to extend a nationwide system for any and all PHI communications, your idea would be a good approach. In a more wonderful world than what we live in today, the US government would have setup a simple, unreadable (even by them) secure channel for everyday citizens to be able to transfer sensitive data to verified businesses and other citizens. They can't see past the criminals using it to subvert the police though.
  - u801e 9y ago
    > In a more wonderful world than what we live in today, the US government would have setup a simple, unreadable (even by them) secure channel for everyday citizens to be able to transfer sensitive data to verified businesses and other citizens. We pretty much already have that with the PKI system that web browsers (and other programs) check when verifying certificates for various websites we connect to (including this one). It doesn't require government intervention. It does require configuring servers that doctors, pharmacists, hospitals, labs, insurance companies, etc use to authenticate themselves with each other and a number of authorities to verify their identities (like the CA bundle that your web browser uses to verify that the server you connect to is indeed Hackernews and not some rogue entity). PKI is a powerful tool which certainly can be used in a healthcare setting. Unfortunately, because of organization inertia, it's probably not going to happen (despite the fact that the technology behind it has been around for decades).
    - 9y ago