6

At a small office, my clients' HR department needs to communicate with some vendors regarding HIPAA-covered material. How do most companies deal with securely sending e-mails regarding HIPAA. I would prefer to encrypt the e-mails themselves instead of requiring vendors to log into a secure messaging server, but I don't know if this is commonplace

Improve this question
1
  • The vendors need to be HIPAA compliant and abide by HIPAA procedures and best practices. If you are a healthcare provider or covered entity of some sort and you're transmitting protected heath information, then you need to make sure your vendors (business associates) are HIPAA compliant or you (and they) can be held liable for a HIPAA violation, likely filed as a complaint by someone or if found by audit.
    – user90559
    Aug 4, 2011 at 20:54

2 Answers 2

Reset to default
5

You are required to encrypt the data end to end. You can use TLS to send the email to their systems. Note that you cannot send email to another firm without them also being HIPAA and hitech compliant. Since their ePHI must already be stored in an encrypted format you do not have to worry about encrypting the data prior to transmission. That being said since encryption of the message is an addressable security measure, you would have to show why this was unreasonable. You also have to ensure that only the person that the email is addressed to can open the email. the simplest solution is to use outlooks ability to sign and encrypt messages and send the recipient your certificate (by sending signed message to each other first.

I do not recommend any sort of separate website based mail as it makes it requires a whole lot of infrastructure to make secure. this could also open up liabilities should the end user do some thing like share their password. It's best to let the other party remain liable for their security.

Improve this answer
5

I think the most common way is to send a plain text email (as it may be read on iphone, android, etc - a device that does not have built in email decryption). OTOH, all devices understand HTTPS. So the plain text email says something like, "You have a secure message from your health care provider. Please click this link to login to view your message."

Improve this answer
1
  • I was asking if you should encrypt the email vs use a secure portal.
    – Brett G
    Jun 10, 2011 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .