3 ms·
Does that mean whenever medical information is sent via phone or Fax, HIPAA is being violated today? Because plain old telephone service is not E2E and the pho
by javagram 6y ago
Does that mean whenever medical information is sent via phone or Fax, HIPAA is being violated today?
Because plain old telephone service is not E2E and the phone company can eavesdrop on you quite easily (as can the government with a warrant, or a bad guy with a phone tap on your line...)
Not saying that e2e shouldn’t be used when practicable but a blanket assertion that e2e is required for HIPAA seems a little unbelievable to me when I’ve recently received COVID test results from providers via a cell phone call.
- dragonwriter 6y ago> Does that mean whenever medical information is sent via phone or Fax, HIPAA is being violated today? Phone and fax are not considered “electronic” under HIPAA, so the rules, including the rule regarding encryption for exposed PHI to be considered secured vs. unsecured, specific to electronic communication don't apply. I think they may be explicitly given special treatment for some of the not-electronic-specific rules, too. They are well-known to be legacy loopholes to HIPAA privacy/security rules, which is one of the reasons fax held on so long in healthcare as a way of minimizing compliance costs. You absolutely should not try to intuit what HIPAA requires for anything else by how fax and phone communication in healthcare operates.
- BlueTemplar 6y ago> Phone and fax are not considered “electronic” Lolwut? Have they confused "electronic" with "computerized" ?
- junon 6y agoFormer HIPAA security officer here. Yes, mostly. We had a dedicated room with a single computer hooked up only to a dial-up line to submit claims forms to a specific insurance company.
- addaon 6y agoKeep in mind that, while the current phone system is very much electronic, the phone system historically predates electronics. It is electric, but not inherently electronic.