Healthcare organizations deal with Protected Health Information (PHI) and therefore must ensure that all the necessary security measures are in place and followed.

Healthcare providers have access to private information such as patient’s medical history, family’s medical history, patient’s financial information (such as credit card or bank) or Social Security number.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) set the standard for protecting sensitive patient data and all kinds of communication, storage and transmission of PHI should be HIPAA compliant, which also includes email communications.

However, mails sent internally may not be required to be HIPAA complaint. Mails that are sent externally beyond the firewall will need to be HIPAA-compliant.

End-to-end encryption for email

Email encryption is to ensure that the information contained within the email cannot be intercepted or received by any party other than the intended recipient. To make emails HIPAA compliant one should ensure end-to-end encryption, wherein messages both in transit and stored are encrypted. As per HIPAA rules emails downloaded onto computers and smartphones also need to be encrypted.

Emails not only need to be encrypted in the sender’s server, but it is also imperative to ensure that the email remains encrypted when it is accessed by the recipient’s server. They would need to have access to the same level of encryption as the sender’s server.

Once the sender of an email hits the “Send” button, the email goes to the sender’s email server which then sends the email to the recipient’s email server following which the email gets delivered to the recipient’s inbox. Each server retains copies of the email, so every time the “Send” button is pressed there are numerous points along the way where email data is vulnerable to hackers. Therefore encryption is an extremely important safeguard to consider.

It is highly crucial to be aware of the type of encryption used and currently AES 128, 192, or 256-bit encryption standards are recommended.

The BAA outlines the responsibilities of the service provider and ensure that administrative, physical and technical safeguards are in place thereby maintaining the confidentiality and integrity of PHI.

It is therefore of utmost importance to choose an email service provider that will sign the BAA for HIPAA compliance which essentially means that the service provider will be accepting the responsibilities for HIPAA compliance.

HIPAA compliant email needs to be configured such that it’s hard for hackers to access. That includes strong, unique passwords and multi-factor authentication, log management system in place to meet the logging requirements of HIPAA. Such safeguards will create an audit trail and help thwart a potential breach.

It is recommended to use a secure, encrypted email archiving service rather than email backups. This serves to free up storage space, and since an email archive is indexed, searching for emails in an archive is a quick and easy process. If emails need to be produced for legal discovery or for a compliance audit, they can be quickly and easily retrieved.

It is of paramount importance to encrypt emails in the process of archiving which greatly aids in preventing data breaches.

An email archiving service provider will also be subject to HIPAA Rules as they will be classed as a business associate.

It is recommended to use a secure, encrypted email archiving service rather than email backups. This serves to free up storage space, and since an email archive is indexed, searching for emails in an archive is a quick and easy process. If emails need to be produced for legal discovery or for a compliance audit, they can be quickly and easily retrieved.

It is of paramount importance to encrypt emails in the process of archiving which greatly aids in preventing data breaches.

An email archiving service provider will also be subject to HIPAA Rules as they will be classed as a business associate.

Have a privacy statement at the end of all emails

As per HIPAA best practices, it is recommended to append a Privacy Statement to the end of every outgoing email stating that the email content is confidential. Also it is a good practice to include contact information should any issues arise.

Maintaining data security and privacy is of paramount importance for today’s healthcare providers and health insurance companies, especially when it comes to communicating patient health information via emails.

Sensitive and personal medical information obtained from email communications can be used to create fraudulent billings, manipulate the use of government programs or to obtain illegal services.

Emails have proved to be an efficient way for healthcare providers to communicate both internally among staff and externally with patients. Using a HIPAA-compliant email system greatly eases the burden of other cumbersome communication methods and provides patients with their information in a way that most people in today’s world want and need.