Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not asking a "should" question here. I know patient-doctor communications should be encrypted. I know that the meaningful use requirements now in draft reward for Direct Project based communications.

What want to know is, definitively, can healthcare providers have patients sign waivers that allow the doctors to legally email in plain text with them? People seem to read the different HIPAA-HITECH act regulations very differently. Vendors of secure products always say that secure email is legally required. Yet I know several healthcare providers who communicate PHI using plain-text email with their patients, by having their patients sign something that says that the patient understands the issues with plain text email and still considers it "protected" under HIPAA.

So there at least some people who argue that it is illegal (vendors) and some who argue that it is legal and actively send plain text emails.

I am not asking this because I do not have an opinion on this myself. I am asking for someone to make an assertion regarding this issue, and back it up with quotes and corresponding links to the various sections of the laws and federal rules in question. Obviously all of the relevant national level rules and laws should be referenced in an accepted answer.

Because this can be a bit of work, I am putting a bounty on this one.

share|improve this question
1  
healthcareit.stackexchange.com/questions/849/…; is related. –  Steve Wranovsky Apr 5 '12 at 13:05
    
A great question. Look forward to any answers. However, I have to state my prediction that you could put a 'real' bounty out to lawyers who could give you a winning case either direction. I doubt there is enough concrete print legislation to definitively state an answer. Honestly, though, GREAT question (as I believe vendors over-hype their over-engineered solution offerings) –  Wayne Heilala Apr 9 '12 at 22:20
add comment

migrated from healthcareit.stackexchange.com Apr 30 '12 at 22:46

This question came from our site for healthcare IT professionals and solution providers.

2 Answers

The Office of Civil Rights is responsible for enforcing HIPAA regulations.

They released a document that addresses your question directly. Here is the link to that document - Safeguards.pdf. Read the answer to Question 3.

Note, in particular, this paragraph:

Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual. If the provider feels the patient may not be aware of the possible risks of using unencrypted e-mail, or has concerns about potential liability, the provider can alert the patient of those risks, and let the patient decide whether to continue e-mail communications.

Additional HIPAA information is available at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/.

Hope this helps.

share|improve this answer
add comment

There is one issue that you would have to cover to get a valid answer to this question, which facility... HIPAA was written so that each facility could interpret it's requirements to best fit their needs, so the way that one facility interprets the requirement could be entirely different than the way another does.

With that said, the way we handled it at my previous hospital is that the e-mail did not need to be encrypted as long as it didn't include privacy act information (SSN, Address, etc). Beyond that, supplying a valid e-mail was stated on the patient information form as permission to initiate e-mail communications until the patient put in a request in writing to desist e-mailing them.

For instance, this document from Health and Human Services says in its FAQ:

Q3: Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?

A3: Yes. The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so. See 45 C.F.R. § 164.530(c). For example, certain precautions may need to be taken when using e-mail to avoid unintentional disclosures, such as checking the e-mail address for accuracy before sending, or sending an e-mail alert to the patient for address confirmation prior to sending the message. Further, while the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications between health care providers and patients, other safeguards should be applied to reasonably protect privacy, such as limiting the amount or type of information disclosed through the unencrypted e-mail. In addition, covered entities will want to ensure that any transmission of electronic protected health information is in compliance with the HIPAA Security Rule requirements at 45 C.F.R. Part 164, Subpart C. [...]

Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual. If the provider feels the patient may not be aware of the possible risks of using unencrypted e-mail, or has concerns about potential liability, the provider can alert the patient of those risks, and let the patient decide whether to continue e-mail communications.

share|improve this answer
    
Thanks, @powelljf3! Are you aware of any evidence (cites to federal regulations, federal law, legal opinions, etc.) that the practices you describe at your previous hospital are allowable by law? –  D.W. May 1 '12 at 15:41
    
Have a look at this report: healthit.hhs.gov/portal/server.pt/.../DisclosureReport.pdf It has a section 1.1.1 which covers patient privacy and consent. It also points out the different paragraphs in the act which are used to make these assertions. –  powelljf3 May 1 '12 at 16:56
    
Sounds interesting. Unfortunately, the link doesn't work for me (perhaps because of the "..." in the middle?): maybe a failure of copy-paste? –  D.W. May 1 '12 at 17:56
    
This might work a little better. –  powelljf3 May 1 '12 at 18:21
    
Thanks, that did work better. While interesting, Section 1.1.1 in that report is extremely high-level and doesn't seem to answer the original poster's question. (Additionally, the word "email" doesn't appear anywhere in the report that I could find.) –  D.W. May 1 '12 at 18:38
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.