We use Office 365, which might make a difference.

Can I (legally) send an MRN, with no other demographic or health information, from me@mycompany.com to coworker@mycompany.com?

  • So, just the number without other data or context? Does the recipient have a business reason to know this number and does the recipient have authorization to receive it? – schroeder Nov 14 '16 at 22:23
  • 3
    BTW, this is the kind of question you normally ask your Privacy Officer about. They will know the impacts of your email carrier and all the other details relevant to your organization. – schroeder Nov 14 '16 at 22:26
  • Just the number. Yes, there is a business reason. I'm curious about the actual HIPAA policy regardless of the company and assuming the email provider is compliant. – JOATMON Nov 14 '16 at 22:28
  • And for the record, we are a small company with no dedicated privacy officer. Also, I know this is technically "off topic" because there is no technical question/answer, but the hipaa tag was more popular here than other SE sites and I didn't know where else to post it. – JOATMON Nov 15 '16 at 14:27
  • 1
    I'm a mod here and I haven't closed it. We aren't always about technical answers. The problem might be that we are not going to have all the details to sort this out for you. MRN is protected, but in context of other data. Internal, valid use is fine, but you are using an external email service. A lot to balance. – schroeder Nov 15 '16 at 17:23

DISCLAIMER: I am not a legal expert and I strongly believe you should consult one. This answer is based on my reading of the rules. Others may read them differently.

First, note that Microsoft claims that Office 365 can be made HIPAA compliant if you have a "Business Associate Agreement" (BAA) with them. See the Microsoft Trust Center - HIPAA for details.

The HIPAA Privacy Rule explicitly lists an MRN as Protected (PHI), meaning that the Security Rule disallows sending it over an insecure system. By default, Office 365 would be considered insecure for this purpose.

However, if you have set up a BAA with Microsoft, which Microsoft's marketing literature says will make your Microsoft Office 365 be HIPAA Security Rule compliant, then sending PHI over this properly secured system would not be a problem.

NOTE: You still need to make sure that any computers or mobile devices which access the email server are set up for HIPAA compliance, but that is outside the scope of this question.

  • Super helpful. I have emailed management to ask some more educated questions now, including whether or not we have a BAA with MS. Thanks! – JOATMON Nov 15 '16 at 18:50
  • I'm with you on the "not an expert" club. That said, with the Safe Harbour De-identification process, the MRN alone without any other data should be 'de-identified' enough. But, consult someone... – schroeder Nov 15 '16 at 21:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.