5 ms·

HIPPA and privacy laws. Communications have to be secure.

by njharman 7y ago

mavhc 7y ago
So only send it to email services that support TLS, ie 99% of them
- noelsusman 7y ago
  Not secure in the sense that it's encrypted, though that's part of it. Secure in the sense that you know you're communicating with the patient and only the patient, not their spouse, or their grandson, or Google's servers.
  - mavhc 7y ago
    Can't people just put in their email address, verify it by sending an email, and agree that that they're fine with that?
    - noelsusman 7y ago
      Yes, that is possible, and some do that. In practice, HIPAA is pretty complicated and email is more of a dark gray area than a hard no. For that reason most providers avoid it and prefer to use dedicated secure messaging systems that have things like consent and auditing built in.
  - smileysteve 7y ago
    > or Google's servers But it's fine if it's (approved and) over a telecom provider as long as the medium is unencrypted facsimile.
  - SilasX 7y ago
    If that's actually a requirement, then why are most providers happy to accept that it's me over the phone/at the pharmacy if I simply say I'm Silas and maybe give the right date of birth?
    - travisoneill1 7y ago
      Because it's not actually about meeting the stated goal. It's about checking all the boxes on some asinine bureaucratic form that assumes if all the boxes are checked, then the goal is met. This is how stupid people do things when you give them authority.
    - noelsusman 7y ago
      Because the laws governing all of this were written in 1996.
- munk-a 7y ago
  HIPAA compliance is a very complicated thing. Sending PHI over a non-encrypted channel would probably be acceptable in response to a patient request - while sending PHI over a heavily encrypted channel in an unsolicited manner would likely be a violation. HIPAA is complicated and a lot of the things it is concerned with are far less technical than they may appear on the tin. Also, IANAL - nothing in this post should be considered sound advice for any reason in any context.
lotsofpulp 7y ago
In my experience they won't print it out either.
travisoneill1 7y ago
But, of course they can leave a printed copy in your mailbox for anyone to grab. That is defined as "secure".

HIPPA and privacy laws. Communications have to be secure.

mavhc 7y ago

So only send it to email services that support TLS, ie 99% of them

noelsusman 7y ago
Not secure in the sense that it's encrypted, though that's part of it. Secure in the sense that you know you're communicating with the patient and only the patient, not their spouse, or their grandson, or Google's servers.
- mavhc 7y ago
  Can't people just put in their email address, verify it by sending an email, and agree that that they're fine with that?
  - noelsusman 7y ago
    Yes, that is possible, and some do that. In practice, HIPAA is pretty complicated and email is more of a dark gray area than a hard no. For that reason most providers avoid it and prefer to use dedicated secure messaging systems that have things like consent and auditing built in.
- smileysteve 7y ago
  > or Google's servers But it's fine if it's (approved and) over a telecom provider as long as the medium is unencrypted facsimile.
- SilasX 7y ago
  If that's actually a requirement, then why are most providers happy to accept that it's me over the phone/at the pharmacy if I simply say I'm Silas and maybe give the right date of birth?
  - travisoneill1 7y ago
    Because it's not actually about meeting the stated goal. It's about checking all the boxes on some asinine bureaucratic form that assumes if all the boxes are checked, then the goal is met. This is how stupid people do things when you give them authority.
  - noelsusman 7y ago
    Because the laws governing all of this were written in 1996.
munk-a 7y ago
HIPAA compliance is a very complicated thing. Sending PHI over a non-encrypted channel would probably be acceptable in response to a patient request - while sending PHI over a heavily encrypted channel in an unsolicited manner would likely be a violation. HIPAA is complicated and a lot of the things it is concerned with are far less technical than they may appear on the tin. Also, IANAL - nothing in this post should be considered sound advice for any reason in any context.

lotsofpulp 7y ago

In my experience they won't print it out either.

travisoneill1 7y ago

But, of course they can leave a printed copy in your mailbox for anyone to grab. That is defined as "secure".