Ensuring automated email responses to patient forms are HIPAA compliant

Automated responses to completed patient forms often contain forms of protected health information (PHI) like the patients' names, contact information, medical history, insurance plan, etc, depending on the script created by the organization. The sensitive information that directly links to the patient's identity and health status creates the need for HIPAA compliance in all aspects of the transmission and storage of these communications.

The benefit behind automated email responses to online patient forms

The central benefit of automating initial email responses is the timely acknowledgment of form admissions. A paper from the Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining provides, “With the rapid increase in email overload, it has become increasingly challenging for users to process and respond to incoming messages. It can be especially time-consuming to type email replies…” The automation serves to free up healthcare staff from the urgent need to respond, leaving them available for hands-on patient care. 

These benefits do however hinge on the creation of adequate and efficient responses sent through the right email provider. It should be detailed enough to confirm the receipt of the form, outline the next steps, and provide clear timelines for when the patient can expect a response or action. 

Best practices to ensure automated email responses to patients' forms remain HIPAA compliant

Tokenized data in emails:

• Use tokenization to replace sensitive PHI with nonidentifiable tokens in automated email responses. 
• Tokenization minimizes the risk of PHI being exposed while allowing for follow-up process to continue. 

Paubox encrypted email

• Leverage Paubox’s, a HIPAA compliant email service, built-in email encryption to automatically secure every message sent. 
• Paubox products also come with Paubox Forms which provides secure HIPAA compliant online forms that can be easily customized. 

Automated identity verification

• When collecting sensitive information, integrate automated identity verification into the Paubox forms process. This ensures that the person submitting the form is the correct patient.

Separate PHI from general information

• Use separate email templates for general information (e.g., confirming receipt of a form) and PHI-containing information. 

Including a privacy notice

• Automated responses should include a HIPAA compliant privacy notice or disclaimer informing patients about the security of the email. 

Related: Top 12 HIPAA compliant email services

FAQs

What is a digital signature? 

A digital signature is an electronic method of verifying the authenticity and integrity of a digital document. 

What is encryption?

Encryption is converting data into a secure format that can only be accessed or decoded by authorized persons. 

What is protected health information?

Any form of information about health status, healthcare provisions, or payment for healthcare can be linked to an individual.