HIPAA compliance for email communication is required to protect patients' sensitive information. You can establish a HIPAA compliant email system by implementing encryption, obtaining a BAA with your email provider, configuring your email correctly, training your staff, maintaining email retention, and obtaining patient consent.
The first step in making your email HIPAA compliant is to assess whether it is necessary. If you only plan to use email for internal communication within a firewall-protected network, encryption may not be required. However, if you intend to send emails containing electronic protected health information (ePHI) externally, beyond your organization's firewall, HIPAA compliance is mandated.
Read also: What is ePHI?
To make your email HIPAA compliant, encryption must be used. This means encrypting both the messages in transit and the stored messages. Encryption ensures that only the intended recipient and authorized personnel can access the messages, enhancing the security of ePHI.
Paubox offers a HIPAA compliant email service that ensures the confidentiality, integrity, and availability of ePHI.
Read more: How HIPAA defines confidentiality, integrity, and availability of ePHI.
If you use a third-party email provider, like Paubox, obtain a business associate agreement (BAA) before sending ePHI through their service. A BAA outlines the email service provider's responsibilities. It establishes the necessary safeguards to ensure the confidentiality, integrity, and availability of ePHI.
While having a BAA in place is important, it does not guarantee HIPAA compliance. Make sure you configure your email service correctly to avoid any potential violations of HIPAA rules. If you choose to use Google Workspace, which includes email, it can be made HIPAA compliant when used alongside a business subscription. However, proper configuration is necessary to ensure encryption is enabled.
Even with a business associate agreement in place with Google, you will still need to work with a HIPAA compliant email service too.
Go deeper: Why Google Workspace and Microsoft 365 aren't enough for complete HIPAA compliance
Data breaches can occur due to human error, such as accidentally sending unencrypted emails or sharing ePHI with unauthorized individuals. To mitigate these risks, educate your staff about their responsibilities under HIPAA and provide comprehensive training on the proper use of the email service.
Read more: How to train healthcare staff on HIPAA compliance
While HIPAA legislation does not specifically mention email retention, make sure to maintain a secure email archive to meet the requirements of an accounting of disclosures and legal actions. State laws may also impose retention periods for emails. To ensure compliance, consider using a secure, encrypted email archiving service instead of traditional email backups.
Before sending emails containing ePHI, obtain consent from patients for email communication. Even if you are using a HIPAA compliant email service provider, patients must be made aware of the risks associated with email communication and provide their consent.
If you are uncertain about the requirements of HIPAA regarding email communication, it is highly recommended to consult a healthcare attorney specializing in HIPAA. They can provide guidance on your responsibilities and help ensure compliance with HIPAA regulations.
See also: HIPAA Compliant Email: The Definitive Guide
Can a covered entity or business associate use a consumer email service provider like Yahoo or Hotmail?
A business associate agreement is required for any vendor handling or processing PHI on behalf of a covered entity or business associate. We have not found a single consumer email service that provides a BAA. Therefore, using a provider like Yahoo or Hotmail is not HIPAA compliant and should be avoided.
Read more:
What is an example of a HIPAA violation email?
When does HIPAA liability end when sending an email?
According to HIPAA, "covered entities are not responsible for safeguarding information once delivered to the individual."
Once an encrypted email has been delivered to the recipient, the covered entity or business associate is no longer responsible.