While HIPAA does not explicitly require that emails be encrypted, it requires that covered entities and business associates implement reasonable and appropriate technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.
HIPAA's Security Rule requires the usage of appropriate safeguards to protect electronically protected health information (ePHI). While HIPAA does not explicitly state that emails must be encrypted, a standard method to ensure HIPAA compliance when emailing ePHI is to encrypt emails.
The "addressable" implementation specification for encryption allows for flexibility in choosing the appropriate security measures based on the risks and vulnerabilities of the covered entity. Covered entities and business associates are not required to implement encryption for email transmissions if they have implemented an equivalent alternative measure that achieves the same purpose.
However, encryption is one of the security measures used to protect ePHI when it is transmitted electronically, including via email. The HIPAA Security Rule recommends encryption as a best practice for the protection of ePHI via email.
Related: HIPAA Compliant Email: The Definitive Guide
Email encryption reduces the risk of unauthorized access to ePHI. It helps to maintain the confidentiality of ePHI and protect against data breaches.
Email encryption also helps covered entities and business associates to comply with the HIPAA Security Rule's requirements for the protection of ePHI. By implementing email encryption, covered entities, and business associates can demonstrate that they have taken reasonable and appropriate steps to protect ePHI transmitted via email.
Sending confidential patient information to a specialist or provider, sharing patient data between healthcare providers, and communicating test results or diagnoses to patients are all examples of when email encryption is used in healthcare settings to protect ePHI and ensure HIPAA compliance.
Encryption requires technical expertise, and some healthcare providers may not have the necessary knowledge or skills to implement encryption. Additionally, user adoption can be an issue, as some staff may be hesitant to change or find encryption systems too cumbersome to use.
Not all email encryption solutions are created equal, and some may not meet HIPAA's standards for security and privacy.
Best Practices for Email Encryption