I am the Compliance Officer for a laboratory. Is it permissible to send an unencrypted email with a patient accession number? It does not include patient name, DOB, SS# or address. It is just an associated, unique number related to a test.
In my interpretation of HIPAA/HITECH, NO, it should be encrypted.
From everything that I've read on this over the years the broadest translation of EPHI is ANY information that COULD be used to IDENTIFY a patient.(This would include any account or test numbers) The debate would be "entities that need access to" or "provide access to" however if ruled as negligent in court, it's not an excuse and since you have the title of compliance officer I would require encryption (atleast in writing). If you don't have the ability to approve spending on say encrypted email then provide who does have the authority with Section 164.312(e)(2)(ii) of HIPAA and BCC your external email address to cover yourself that the company is going rogue and not yourself. I always say unencrypted email is like writing information on a piece of paper and putting it on "Joe's" car under the windshield wiper. Enen though it's addressed to "Joe" anyone who is walking by with "curiousity" could read that paper on the windshield of Joe's car and he might never know. If that data is valuable in ANY way, people will try to "acquire it".
Here's a quote from wikipedia's site: PHI is any information held by a covered entity which concerns health status, provision of health care, or payment for health care that can be linked to an individual. This is interpreted rather broadly and includes any part of an individual's medical record or payment history.
Unfortunately an ex-employee could social engineer with that information, additional information such as a SS#.
Depending on how much data is sent and how often it will be sent you may want to consider building a SFTP server (usually favored over FTPS by most Hospitals I.T. departments)
Personally I've done this for two of the largest hospitals in my state and that's how they send reports and patient data. I used a turnkey linux distro here: http://www.turnkeylinux.org/fileserver
It's FREE and very easy to setup and will cover the issue of using encryption while the data's "in motion" Also be sure to make a unique login for EACH entity that will connect since all login attempts are logged and be sure to use a long random password and only give that info over the phone or fax since your email does not sound like it's being encrypted.
A word of experience on email encryption, stay away from Trend Micro, it's too difficult for computarded users to count on their fingers and toes the numerical placeholders of their passwords.
ex. password: doggypuppy123 enter characters 1, 2, 7, and 9 of your password answer: d o u p
plus they have security questions on top of that as well.
It is horrible, I was stuck with it for a year from the previous admin and now we have something much more computarded user friendly. Let me know if you have any other questions.
If you just want to send the information VIA email and don't have the capability to run a SFTP server thatn you could use http://www.jumbleme.com/ which offers FREE low volume encrypted emails. The onlything in question is when you look at the HIPAA compliant version of the "FREE" service they say that they charge $49.95/yr per user account.
I am not a lawyer and this is not legal advice.
I've run into a similar issue and asked the same question on healthcareit.
As you are probably aware, an accession number is a unique identifier issued by your entity (e.g., your hospital) typically a 6-10 digit number to track a patient order in your information system (e.g., scheduling to providing the service to storing the report/data for the service). When de-identifying data in HIPAA, the guidelines explicitly state 'unique identifying numbers' should be removed, unless an expert has 'determine[d] that the risk is very small that the information could be used, alone or in combination with other reasonably available information ... to identify an individual, and document[ed] the methods and results of the analysis that justif[ies] such determination'.
I would not leave in accession numbers when de-identifying research data as this is a 'unique identifying number'. Let's say I am doing a research study and have been sharing the de-identified MRI data with co-investigators and some 'unique identifying number' was not removed. A co-investigator conceivably could go into the RIS find out what patient that unique identifying number belongs to and then will have the MRI of that patient without any audit trail saying they've downloaded this patient's MRI (there may be a trail saying they've seen their accession number -- but many employees see many accession numbers in the course of routine work). HIPAA does allow you to have a reidentification code in your de-identified data, but it cannot be derived from any existing 'unique identifying numbers' and these re-identification codes must be kept secret.
See page 66 of (section 164.514) http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/adminsimpregtext.pdf
Not commenting on the legality of the matter, what you are saying in practice wouldn't violate patient privacy. Telling a doctor that they have an outstanding task (someone needs to read the report on accession number
However, this does not mean it would not be in violation of the law. I would guess it would be less likely to be prosecuted/convicted, but it probably not be worth the risk. For my system I ended up adding a step; I send an email and then they have to click to my password protected VPN/intranet system to see the accession #s.
According to the website below this is not considered part of your private information and as such it would be acceptable to send in an unencrypted email. HIPAA compliance applies specifically to personal information which this does not fall under.