Are there different degrees of "confidentiality"? What is the best way for a psychologist to maintain confidentiality of communications with patients?

Question

A non-tech savvy friend of mine is a psychologist. She has many patients who constantly invite her to communicate through all sorts of mediums such as text, email, voicemail, and other mediums. But she is concerned she is not knowledgeable enough about information security and would like to learn more.

As a doctor (a practicing clinical psychologist), she has two primary goals:

1. To be able to preserve the confidentiality of communications with her patients.
2. To make intelligent choices about how she communicates so that, if information must remain off the record, she knows how to communicate in a way that remains off the record.

Given the problems with information security these days, she doesn't know what the best way is to achieve these goals, so I suggested bringing the question to Information Security SE.

Obviously, my friend isn't likely to want to read lots and lots about information security. She also is looking for information tailored to those two particular goals, which are probably common for all psychologists.

My Question:

What is the best way to achieve the two goals stated above?

Answer 1

I would like to disagree with the idea that email could be safe enough for confidential information exchange of any kind particularly between a psychologist and her patients.

An often quoted rule is that you should always treat any unencrypted e-mailed communication to be about as confidential as if you wrote it on the back of a postcard. In reality it's a bit worse than that since it's a fair amount of work to index, search and filter messages on post cards (especially since you need to make copies first) while it's trivial to do the same thing for email.

At the very least you have breaches of confidentiality at both the psychologists mail provider and the patients mail provider. To make matters worse the patients mail provider might be his employer who might actually have interest in the information being exchanged, and worse still if their internal policies are set up in ways many are, might have a legal right to inspect that email.

I would also like to disagree with the idea that "There is no incentive for an attacker to read someone's life story", quite the opposite. As an example consider a politician who might say be going to counselling for alcohol abuse. I'm sure an opposition politician would find information about that to be worth a lot of money. The same might be said for many other cases, be it employees with symptoms of work related diseases developing or parents in a divorce fight.

Last but not least (disclaimer: I'm not a legal expert and my knowledge of HIPAA is cursory) I think there is a very good chance that HIPAA does apply and very probably regulates which things can be communicated to a patient through email if any.

All in all I think it would be advisable not to use unencrypted email communication for anything short of setting up appointments and even for that I would be extremely wary. On the off chance your friend would consider setting up certificates for herself and her clients and using encrypted email she should bear in mind that subject lines of emails are never encrypted.

EDIT I realize this isn't really an answer to the question I just wanted to make sure disagreement with email was voiced. I will write up a more comprehensive answer later when I have more time.

EDIT2 So having spent a lot of words destroying an idea let's try and be constructive. If you can't use email (unencrypted) what can you use?

Well the "easiest" solution would be encrypted email. Assuming you make sure to not put any sensitive information in the subject fields this is a very secure solution when set up right.

The usual problem with using encrypted email is that both parties need to have certificates, and need to have correctly set up trust chains. This is usually a fair amount harder then would seem especially when the certificates aren't managed centrally. Encrypted emails work pretty well within an organization where everyone gets issued certificates on a regular basis preferably by internal IT and where that same IT ensures their email, computer and what have you is set up correctly. Sadly lacking that most people tend to struggle with certificate management and use. Still assuming the people are able to deal with these obstacles using encrypted email used properly and consistently is really quite safe.

Another alternative I would consider is setting up a normal webserver which only allows connection using HTTPS reasonably hardened, and on that server set up a very simple messaging system. Each client gets to choose a user name and a password first time they come. This password is then used to log them into the system over HTTPS. The website then does very little other then save and display messages sent between the client and the psychologist. Now this can be implemented very well but will probably be overkill for a single doctor. Done well it could easily serve many though.

To round it off with something that is certainly not perfectly secure but might solve your problems with a reasonable degree of security, a lot better then mail anyway. If your friend only needs to send confidential information quite rarely one very easy and free way to do that is using encrypted zip archives. All up to date zip programs (winzip, 7-zip,gzip even) are capable of state of the art symmetric encryption with key derived from a password. You are left with the problem of distributing the keys ofcourse, but that can be handled either using predetermined keys (a bit kludgy) or by sending the keys for example using SMS (not very secure). While using SMS to send the keys is certainly not particularly secure it does split the data and the key over two different channels at least and if you want to get to the message you have to do a decent amount of work. It still isn't safe against the feds,NSA, local police or probably even a really dedicated private investigator, it's still miles beyond just sending the message using email only.

Personally if I were your friend I would look into seeing if they can't possibly join up with some already set up secure messaging solution possibly used by other doctors in the area or maybe even available through a health care insurer they might have a contract with.

Last but Most important whatever solution they choose to go with I would strongly advise to consult with someone who has extensive knowledge of the HIPAA regulations. Haven't looked up a few things online the penalties for non compliance can be extremely painful this article http://www.aaos.org/news/aaosnow/aug12/managing5.asp talks about $50'000 fine.