Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At a small office, my clients' HR department needs to communicate with some vendors regarding HIPAA-covered material. How do most companies deal with securely sending e-mails regarding HIPAA. I would prefer to encrypt the e-mails themselves instead of requiring vendors to log into a secure messaging server, but I don't know if this is commonplace

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

You are required to encrypt the data end to end. You can use TLS to send the email to their systems. Note that you cannot send email to another firm without them also being hipaa and hitech compliant. Since their ePHI must already be stored in an encrypted format you do not have to worry about encrypting the data prior to transmission. That being said since encryption of the message is an addressable security measure, you would have to show why this was unreasonable. You also have to ensure that only the person tat the email is addressed to can open the email. the simplest solution is to use outlooks abililty to sign and encrypt messages and send the recipent your certificate (by sending signed message to each other first.

I do not recomend any sort of seperate website based mail as it makes it requires a whole lot of infrastructure to make secure. this could also open up liabilities should the end user do osme thing like share their password. It's best to let the other party remain liable for their security.

share|improve this answer
add comment

I think the most common way is to send a plain text email (as it may be read on iphone, android, etc - a device that does not have built in email decryption). OTOH, all devices understand HTTPS. So the plain text email says something like, "You have a secure message from your health care provider. Please click this link to login to view your message."

share|improve this answer
    
I was asking if you should encrypt the email vs use a secure portal. –  Brett G Jun 10 '11 at 17:00
add comment

The vendors need to be HIPAA compliant and abide by HIPAA procedures and best practices. If you are a healthcare provider or covered entity of some sort and you're transmitting protected heath information, then you need to make sure your vendors (business associates) are HIPAA compliant or you (and they) can be held liable for a HIPAA violation, likely filed as a complaint by someone or if found by audit.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.