Email Messages and HIPAA Electronic mail messages
Email Messages and HIPAA Electronic mail messages (”email”) is an economical and timely manner for doctors and patients to communicate with each other and is discussed in the Code of Federal Regulations, 45 CFR 164 522 (b). The prevailing principle is that covered entities (doctors) are not restricted from using email to leave messages for appointments or dispensing of product, but that the content of the message must be “the minimal necessary amount”. However, if the patient specifically restricts email or phone messages, the doctor cannot still use those channels to communicate with the patient. The next question is whether all email from a doctor needs to be secure. In most cases, if the patient authorizes the doctor, the doctor can use email to send a message to a patient. It is not required that all correspondence between a doctor and patient be secure, but ensuring that the doctor might unintentionally release protected health information (PHI), the doctor should consider using only secure email. A popular program, Google Mail (also known as “GMail”) is not HIPAA compliant because it relies solely on Secure Socket Layer (SSL) as the form of encryption. This makes the transport secure but not the content. HIPAA requires the content to also be secure which what encryption of the content will do. There are a number of encrypted email providers that meet the HIPAA requirements and can be found through a query on the Internet. An example of minimum necessary information through an insecure email or unencrypted email content is “Ms. Smith, please call (123) 456-7890 Dr. ABC” . The doctor should avoid saying what the call is for or by identifying the specialty of the doctor. Even if the patient explicitly authorizes the doctor for normal email messaging, the doctor should still observe the minimal necessary PHI. This also includes telephone or text messages. In summary, the doctor should use secure email providers to send messages with the minimum necessary information.
Tips4EyeDocs, Richard Hom OD Dr. Hom is a noted security and computer blogger.
