35

Where I am in the US, health care providers refuse to send anything through email (e.g. even something as trivial as an appointment reminder). Often they claim that email is not secure.

Instead they will send me information (e.g. appointment reminders, messages from my doctor) through voicemail, snail mail, or through some clunky and badly-designed internet portal you have to sign up for.

Is there any evidence that email is any less secure than these other modes of communication? It would seem to me that the exact opposite is true - e.g. snail mail could get lost, or get stolen by anyone willing to stroll over to my mailbox (at least in most of suburban America where there is no lock and key for mailboxes).

Improve this question
4
  • Having worked with email reminders, it just doesn't work well enough, either from people not reading their email, it getting in the junkfolder, or the recipients reading and forgetting. Snail-mail and text-messages have a much larger response.
    – Pieter B
    Commented Sep 19, 2014 at 10:22
  • I too have to use a really poorly designed web portal to contact my health provider and I learned that people in the office can look into it whenever they want... seems not very secure to me even thought they touted it as a security measure.
    – Jasper
    Commented Sep 19, 2014 at 18:17
  • 2
    In most cases, the insecurity actually comes from the user-side (e.g. malware reading mails from Outlook). But indeed, mail is not very secure. I hate it when sites send me my password via email. What seems trivial for one (e.g. confirmation of an appointment), can be very interesting for one other (e.g. information gathering about someone).
    – BlueCacti
    Commented Sep 19, 2014 at 19:49
  • While snail mail may be even less secure, it is older and thus more "trusted", and certainly more protected by legislature. Tampering with snail mail is quite a serious felony offense in the U.S., and thus the company would be more protected if something were to go wrong with snail mail rather than e-mail. I don't think it's allowed to leave many details in a voice-mail either, those tend to be a "call back to find out more" situation. And while web portals may be clunky, they have more control over them and CAN be secured better than e-mail.
    – user2813274
    Commented Sep 20, 2014 at 21:53

2 Answers 2

Reset to default
42

Yes, email is insecure, and should not be used to deliver sensitive data. That doesn't mean that they should need to refuse to send anything via email, but given HIPAA and the potential penalties for non-compliance, I'm not surprised that some providers would choose to err on the side of extreme caution and shun email entirely.

Here is why email is insecure: The provider does not control the entire channel. Once an email had left their system, they have no way of guaranteeing that it will be encrypted and protected from prying eyes as it wends its way through the Internet and to your inbox. In fact, with the state of email today, its quite likely that it will not be encrypted along the entire transit path. Hence, if they were to send PHI via email and it was stolen or misused, it would not be unreasonable to argue that they failed to show due care and should have known better, thus, be held liable for the leakage. When you're looking their web site in a browser, they can confidently assert that the information is being delivered securely to your screen by using HTTPS.

This risk can be (virtually) eliminated through the use of encryption such as PGP. Do you know what the uptake of PGP is? Percentage-wise of all email-users, in the low single digits at best. And even those users tend to hate it and view it as a necessary evil. That may change in the future, but that's the reality today. Do you know what the uptake is for HTTPS use over the web? 100%. Every browser supports it, and it's completely painless for the end user. Use what works for your users.

Is snail mail more insecure? No. Why not? Because the piece of mail has a single physical location, and can't be stolen without the physical presence of, and personal risk to the thief. Stealing things off the Internet is easy. That network captures trap, and mail servers log unencrypted email is not so much a risk as it is a given. Snail mail is very unlikely to be intercepted. The USPS has an entire law enforcement division to protect it. They have a stellar (not perfect by any stretch of the imagination, but very very good) record of delivering mail to the intended recipients. It is reasonable for a company to entrust the USPS to deliver confidential information to you unmolested. It is not reasonable to expect the same from SMTP email.

So, yes, the fact that they won't provide any information to you over email is excessively conservative. The fact that they won't provider PHI that way, is certainly not.

Improve this answer
11
  • What about say email vs internet portal (which, in the case of my particular healthcare provider, appears, at least superficially, to be pretty unprofessionally done)? Or email vs voicemail?
    – user55743
    Commented Sep 18, 2014 at 17:10
  • 3
    @KennyLJ With a web portal, the quality may be poor, but with an adequate authentication system and HTTPS, they control the entire channel from their end to yours, and can reasonably assess it and declare it secure.
    – Xander
    Commented Sep 18, 2014 at 17:15
  • @KennyLJ Voicemail is different, and somewhere between snail mail and email in that it leaves the providers system and is left in the hands of a telco to deliver to you. While voicemail is not immune to attack (as we well know from the Fox News case in England a few years back) it doesn't have the systemic weakness of email. When I leave someone a voicemail, there's nearly 100% chance of them receiving it without it being intercepted first. Not 100%, but close enough to be negligible. The confidence level for email is far, far below that, and quite non-negligible.
    – Xander
    Commented Sep 18, 2014 at 17:19
  • @KennyLJ An ugly web site is not necessarily an insecure web site. It just means they value security more than eye candy. Not a bad value system for a healthcare provider, in my opinion. Ever notice how banks have some of the worst web sites/apps? They are clunky, ugly, confusing, and outright obnoxious to use. But I bet you they are safe.
    – Brandon
    Commented Sep 19, 2014 at 12:54
  • Also, if HealthCareCo said your email had to be from one of a list of reputable providers to whom they can deliver direct from their server by SMTPS, then they'd be in a similar position to where they are with snail mail: they hand it securely to Google, Google under normal circs does a good job of secure delivery, and if you set your Google account to forward somewhere less secure, well, that's like you taking out your mail and leaving it on your lawn. But the health care industry presumably doesn't see enough benefit in assessing and enforcing good email provision, can't say I blame them.
    – Steve Jessop
    Commented Sep 19, 2014 at 13:29
8

HIPAA makes using email complicated.

99% of covered entities make the huge mistake of thinking they can become HIPAA Compliant by simply deploying an email encryption solution. What they fail to understand is there is a lot more to HIPAA Email Compliance than just using encryption.

However, a trivial appointment reminder might be OK, if you opted in and they confirmed your email address,

The Security Rule does not prohibit communication via e-mail or other electronic means. Information can be sent over the Internet as long as it is adequately protected. In general, e-mailing information such as appointment reminders is allowable as a part of treatment and does not require authorization under the Privacy Rule. Providers should make sure that the e-mail contains the minimum amount of information needed, should verify the e-mail address, and confirm that the patient wants to receive e-mails. The privacy notice should include language about appointment reminders.

IMO the health care providers are not security experts and are therefore not making a notable claim about email: instead they're trying to comply with HIPAA legislation.

Improve this answer
3
  • 3
    I can confirm that at least some healthcare providers in the US are willing/able to send emails for appointment reminders, as I have had more than one provider email me exactly that.
    – Brian S
    Commented Sep 18, 2014 at 14:31
  • "...the health care providers are not security experts and are therefore not making a notable claim about email" Most health care providers do however have security experts on staff, often many of them. The policies on email certainly are put in place after input from them, and often at their direct behest.
    – Xander
    Commented Sep 18, 2014 at 17:09
  • 2
    @Xander or they made very conservative suggestions to avoid liability
    – ratchet freak
    Commented Sep 19, 2014 at 8:15

You must log in to answer this question.