Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am the Compliance Officer for a laboratory. Is it permissible to send an unencrypted email with a patient accession number? It does not include patient name, DOB, SS# or address. It is just an associated, unique number related to a test.

share|improve this question

In my interpretation of HIPAA/HITECH, NO, it should be encrypted.

From everything that I've read on this over the years the broadest translation of EPHI is ANY information that COULD be used to IDENTIFY a patient.(This would include any account or test numbers) The debate would be "entities that need access to" or "provide access to" however if ruled as negligent in court, it's not an excuse and since you have the title of compliance officer I would require encryption (atleast in writing). If you don't have the ability to approve spending on say encrypted email then provide who does have the authority with Section 164.312(e)(2)(ii) of HIPAA and BCC your external email address to cover yourself that the company is going rogue and not yourself. I always say unencrypted email is like writing information on a piece of paper and putting it on "Joe's" car under the windshield wiper. Enen though it's addressed to "Joe" anyone who is walking by with "curiousity" could read that paper on the windshield of Joe's car and he might never know. If that data is valuable in ANY way, people will try to "acquire it".

Here's a quote from wikipedia's site: PHI is any information held by a covered entity which concerns health status, provision of health care, or payment for health care that can be linked to an individual.[13] This is interpreted rather broadly and includes any part of an individual's medical record or payment history.

taken from:

Unfortunately an ex-employee could social engineer with that information, additional information such as a SS#.

Depending on how much data is sent and how often it will be sent you may want to consider building a SFTP server (usually favored over FTPS by most Hospitals I.T. departments)

Personally I've done this for two of the largest hospitals in my state and that's how they send reports and patient data. I used a turnkey linux distro here:

It's FREE and very easy to setup and will cover the issue of using encryption while the data's "in motion" Also be sure to make a unique login for EACH entity that will connect since all login attempts are logged and be sure to use a long random password and only give that info over the phone or fax since your email does not sound like it's being encrypted.

A word of experience on email encryption, stay away from Trend Micro, it's too difficult for computarded users to count on their fingers and toes the numerical placeholders of their passwords.

ex. password: doggypuppy123 enter characters 1, 2, 7, and 9 of your password answer: d o u p

plus they have security questions on top of that as well.

It is horrible, I was stuck with it for a year from the previous admin and now we have something much more computarded user friendly. Let me know if you have any other questions.

If you just want to send the information VIA email and don't have the capability to run a SFTP server thatn you could use which offers FREE low volume encrypted emails. The onlything in question is when you look at the HIPAA compliant version of the "FREE" service they say that they charge $49.95/yr per user account.

share|improve this answer
I just looked into Is it actually HIPAA compliant? Do you sign a business associate agreement (contract) with them to allow sharing of proprietary data (which arrive at their server unencrypted (transported encrypted via SSL) to encrypt for you? It doesn't appear like this step is done.… – dr jimbob Mar 29 '12 at 17:39
Good point, I forgot about that. I had to sign my life away years ago. Your management should have boiler plates for that and go from there. On the compliance of ANY email provider the only company that I've come across that has a business associate agreement for email encryption is luxsci check out otherwise I've had companies argue that they don't need to supply you with such an agreement since they are only "assisting" in you building your own compliance. – Brad Mar 29 '12 at 18:45
I don't buy there argument for not needing an agreement -- you are giving them access to your data; but as I said in my other reply to you comment (to Mark's post) its quite doubtful that this would be prosecuted for violating HIPAA. – dr jimbob Mar 29 '12 at 18:59
All it takes is one person to point their finger to get the ball rolling on an investigation for a HIPAA violation. When I first started with this company they were going through an issue because of a mis-emailed documents from incompetent state employees, even though it was a violation on the states behalf, since the person complaining owned a similar domain. Story learned is better to over protect stuff then to under protect it from a design aspect. – Brad Mar 29 '12 at 23:46

I am not a lawyer and this is not legal advice.

I've run into a similar issue and asked the same question on healthcareit.

As you are probably aware, an accession number is a unique identifier issued by your entity (e.g., your hospital) typically a 6-10 digit number to track a patient order in your information system (e.g., scheduling to providing the service to storing the report/data for the service). When de-identifying data in HIPAA, the guidelines explicitly state 'unique identifying numbers' should be removed, unless an expert has 'determine[d] that the risk is very small that the information could be used, alone or in combination with other reasonably available information ... to identify an individual, and document[ed] the methods and results of the analysis that justif[ies] such determination'.

I would not leave in accession numbers when de-identifying research data as this is a 'unique identifying number'. Let's say I am doing a research study and have been sharing the de-identified MRI data with co-investigators and some 'unique identifying number' was not removed. A co-investigator conceivably could go into the RIS find out what patient that unique identifying number belongs to and then will have the MRI of that patient without any audit trail saying they've downloaded this patient's MRI (there may be a trail saying they've seen their accession number -- but many employees see many accession numbers in the course of routine work). HIPAA does allow you to have a reidentification code in your de-identified data, but it cannot be derived from any existing 'unique identifying numbers' and these re-identification codes must be kept secret.

See page 66 of (section 164.514)

Not commenting on the legality of the matter, what you are saying in practice wouldn't violate patient privacy. Telling a doctor that they have an outstanding task (someone needs to read the report on accession number 1234567) doesn't give any private health information to an eavesdropper. The accession number to someone who doesn't have access to your information systems cannot be tied to a patient. Granted it would possibly be a violation of patient privacy to email an accession number + any medical data about the person. E.g., accession # 1234567 has a finding of disease X. Because say audit logs for searches for an accession number on the information system may not be as thoroughly analyzed as someone searching for the reports by patient/accession number. (For medical record numbers (MRN), this argument would not apply; as a MRN has a one-to-one correspondance with a patient. E.g., an eavesdropper may have prior knowledge of a patient to MRN and learn that they came in by observing emails containing their MRN).

However, this does not mean it would not be in violation of the law. I would guess it would be less likely to be prosecuted/convicted, but it probably not be worth the risk. For my system I ended up adding a step; I send an email and then they have to click to my password protected VPN/intranet system to see the accession #s.

share|improve this answer

According to the website below this is not considered part of your private information and as such it would be acceptable to send in an unencrypted email. HIPAA compliance applies specifically to personal information which this does not fall under.

share|improve this answer
Unfortunately lawyers who don't understand technology like an engineer would and they write the laws for HIPAA and HITECH. Since the law is open to interpretation and how much a judge and jury are able to comprehend you would be best off with the strictest interpretation of the legal documentation. – Brad Mar 29 '12 at 18:13
@Brad - I agree its the lawyers writing the laws and its safest to assume strictest compliance. However, its unlikely you would be prosecuted/convicted for designing a system that gave Accession #s alone in emails--more likely someone would tell you to redesign it. There is ambiguity and a reasonble prosecutor wouldn't try you and you could build a solid defense. HIPAA convictions are rare and usually involve either egregious violations (e.g., identity theft, selling celebrity records). – dr jimbob Mar 29 '12 at 18:56
All coins have 2 sides to them, here's' the other side that I see. From my understanding one must provide documented reasonable efforts to secure a system. This creates plausable deniability which would assist if a lawsuit were to be filed. If you just document the laws, your interpretation, and what you put in place for compliance sake then you should be fine. Just be sure to document everything and keep backups for yourself. – Brad Apr 2 '12 at 17:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.