How HIPAA compliant emails help the VA uphold the Paperwork Reduction Act

The Department of Veterans Affairs (VA) must adhere to the Paperwork Reduction Act (PRA) of 1995 to minimize paperwork burdens. Using HIPAA compliant emails can help the VA meet these requirements, improving administrative efficiency while maintaining the privacy of sensitive information.

Collecting information under PRA  

The PRA requires federal agencies to get approval from the Office of Management and Budget (OMB) before collecting information from the public.

Agencies must show that their methods minimize respondent burden and improve the quality of data collected. As an example, the VA’s proposed revisions to the Program of Comprehensive Assistance for Family Caregivers (PCAFC) reflect these priorities:

• The revised 38 CFR 71.25(a) will require veterans, service members, and caregivers to submit a new joint application to determine eligibility. The VA estimates that these changes will generate 140,671 applications annually, resulting in a reporting burden of over 35,000 hours.  
• Similarly, the revised 38 CFR 71.30(c) will introduce a process for requesting reassessment, and 38 CFR 71.45 outlines requirements for submitting requests for discharge.  

Under these provisions, respondents must provide personal and health-related information to the VA. 

How HIPAA compliant emails can help

HIPAA compliant email solutions, like Paubox, uphold the PRA and Health Insurance Portability and Accountability Act (HIPAA). It automatically encrypts outgoing emails, giving the VA a secure alternative to traditional paperwork or standard email.  

Secure submissions

HIPAA compliant email systems protect PHI during transmission and storage. For example, when veterans submit PCAFC applications, the VA must use HIPAA compliant emails to protect personal and medical information against unauthorized access.  

Improved accessibility

HIPAA compliant email allows respondents to submit their completed forms from any location. It eliminates the need for physical mail and reduces the delays associated with logistical barriers.  

Streamlined processes

Automated workflows can route incoming emails to the appropriate VA departments. For example, reassessment requests under 38 CFR 71.30(c) could be flagged for review immediately upon submission, reducing processing times and improving efficiency.  

Meet PRA objectives with technology

The PRA requires agencies to evaluate "the necessity, utility, and burden of their information collection methods." HIPAA compliant email supports these objectives by:

Minimizing burden: Respondents can complete and submit forms quickly and easily, reducing the estimated 35,451 hours of annual burden.  

Enhancing data quality: Automated systems minimize the risks of human errors, addressing the PRA’s mandate to “[enhance] the quality, usefulness, and clarity of the information to be collected.”  

Promoting efficiency: Using HIPAA compliant platforms allows the VA to process applications, reassessments, and discharge requests more effectively, reducing administrative costs.  

As noted in the VA’s rulemaking proposal, “the revised collection of information...is expected to result in an influx of new applications in the initial year of implementation.” Addressing this influx requires a scalable solution. HIPAA compliant email meets this demand without compromising respondents’ data security.

Real-world applications  

The VA estimates that processing a single PCAFC application takes 15 minutes. With over 140,000 applications expected annually, even small inefficiencies can compound into major delays. 

HIPAA compliant emails combined with secure online forms can address these inefficiencies by: 

• Facilitating electronic signatures: Veterans and caregivers can sign documents digitally, eliminating the need for physical paperwork.  
• Providing submission receipts: Automated confirmations help the VA know that respondent forms have been received and are being processed.  
• Reducing errors: Integrated form validation features prevent incomplete or inaccurate submissions, saving respondents and VA staff time.

Let’s say a caregiver submits a discharge request under 38 CFR 71.45 due to domestic violence (DV) or intimate partner violence (IPV). The provision allows supporting documentation, like police reports or protective orders, to justify extended benefits. With HIPAA compliant email, these sensitive documents are securely transmitted, minimizing the time to handle the case, while upholding the PRA.

Cost savings

The VA estimates the total annual cost to respondents and the government for processing PCAFC-related information at nearly $2.9 million. Using HIPAA compliant email solutions can help the VA reduce these costs while adhering to PRA requirements. For example:  

• Eliminating expenses: Digital submissions eliminate costs associated with printing, mailing, and manual data entry.  
• Faster decision-making: Automated systems allow VA staff to focus on eligibility assessments and program improvements instead of administrative tasks.  
• Improved security: HIPAA compliant solutions use advanced security measures, like access controls, authentication methods, and encryption, mitigating the risk of potential data breaches and associated costs.

Learn more: Which federal agencies must use HIPAA compliant email?

FAQs

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards for safeguarding protected health information (PHI). 

HIPAA mandates that healthcare providers, insurers, business associates, and some federal agencies safeguard patients' PHI during transit and at rest.

What makes an email HIPAA compliant?

An email is HIPAA compliant when it meets the HIPAA requirements for protecting sensitive health information. HIPAA compliant emailing platforms, like Paubox, offer encryption, access controls, and audit trails to safeguard protected health information (PHI) and mitigate data breaches.

Additionally, Paubox signs a business associate agreement (BAA) to ensure HIPAA compliance.

What should federal agencies do if they suspect a HIPAA breach?

If a HIPAA breach is suspected, federal agencies should follow their organization's incident response plan, which typically includes notifying the affected individuals, the HHS Office for Civil Rights, and possibly the media if the breach involves more than 500 people. All breaches must be documented and investigated to prevent future occurrences.