The consequences of not having a BAA with an email service provider

Not having a business associate agreement (BAA) with email service providers increases the risk of HIPAA violations due to insufficient safeguards for protected health information (PHI). This negligence can lead to potential fines from the Department of Health and Human Services (HHS), reputational damage, legal liabilities, patient lawsuits, and heightened vulnerability to data breaches. BAAs ensure email providers comply with HIPAA regulations, protect patient privacy, and maintain organizational integrity.

Understanding HIPAA and PHI

According to NCBI, "Protected health information breaches have impacted over 176 million patients in the United States from 2009 to 2020. Most of these breaches have occurred due to the carelessness of employees and failure to comply with HIPAA rules versus external hackers.". HIPAA establishes national standards for the protection of PHI, which includes any information about health status, provision of healthcare, or payment for healthcare that can be linked to an individual. Covered entities and business associates must adhere to these regulations to ensure patient privacy and data security. 

HIPAA requirements for email

• Encryption requirements: Emails and attachments containing PHI must be encrypted during transmission and storage to prevent unauthorized access. Encryption scrambles the data, making it unreadable to anyone without the decryption key, ensuring data security.
• Secure email solutions: Standard email services do not typically provide adequate security measures to meet HIPAA standards. Healthcare providers should opt for specialized HIPAA compliant email services. These services often include built-in encryption, secure storage options, and additional safeguards to protect PHI.
• Authorization and consent: Only transmit PHI via email to authorized recipients directly involved in patient care or other permissible purposes outlined by HIPAA. Obtain patient consent before sending any PHI electronically, ensuring patients know how their information will be used and protected.
  
  

The role of BAAs with email service providers

A BAA ensures that an email service provider, as a business associate, handles PHI with the same level of care and security that HIPAA requires. It outlines specific purposes for accessing PHI, mandates security measures like encryption and access controls, and establishes procedures for reporting breaches promptly and effectively. Integrating BAAs into email service agreements allows healthcare organizations to protect patient information and maintain compliance with HIPAA regulations.

Read more: FAQs: Business associate agreements (BAAs)

Consequences of not having a BAA with an email service provider

Increased risk of HIPAA violations

Without a BAA, there is no legally binding agreement detailing the email provider's responsibilities for protecting PHI. That makes it challenging for the covered entity to demonstrate they have taken reasonable steps to ensure HIPAA compliance.

Potential for fines and penalties

If a data breach involving PHI occurs due to inadequate safeguards by the email provider, the covered entity could face substantial fines. Advocate Health Care (AHC) faced a $5.55 million HIPAA fine in 2016 following two data breaches and a failure to attain a BAA and this was reported as one of the largest HIPAA violation cases. 

Related: What are the penalties for breaching HIPAA?

Reputational damage

A HIPAA breach can severely damage a covered entity's reputation, leading to patient distrust and potential loss of business. Patients expect their healthcare providers to protect their sensitive information, and a breach can erode this trust.

Legal repercussions

The patients affected by a PHI breach may have legal grounds to sue the covered entity. That can result in costly legal battles and settlements, further straining the organization's resources.

Increased risk of data breaches

Without a BAA, email providers may not implement necessary security measures like encryption and access controls, increasing the risk of data breaches. Email is the second most common breach location, affecting 108,199 individuals. The combination of human error, inadequate encryption, and the systematic use of email in healthcare settings contributes to its frequent occurrence.

Mitigation strategies

Ensuring HIPAA compliant email solutions

Healthcare organizations should choose email service providers that offer HIPAA compliant solutions and are willing to sign a BAA. Regular security audits can help ensure ongoing compliance.

Related: Features to look for in a HIPAA compliant email service provider

Implementing and reviewing BAAs

Ensure that all relevant service providers sign a BAA. Key clauses should cover permissible uses of PHI, security safeguards, and breach notification procedures. Regularly review and update BAAs to reflect any changes in services or regulations.

Employee training and awareness

Train employees on secure email practices and the importance of HIPAA compliance. Regular training sessions can help maintain a high level of awareness and adherence to privacy and security protocols.

FAQs

Why is obtaining patient consent important when sending PHI via email?

Patient consent ensures transparency and compliance with HIPAA regulations regarding the secure transmission of sensitive health information, reinforcing patient trust.

What should healthcare organizations consider when choosing a HIPAA compliant email service provider?

Ensure the provider offers robust encryption and secure storage options, and signs a BAA to guarantee adherence to HIPAA standards for protecting PHI.

What are some common mistakes healthcare organizations make regarding BAAs with email providers?

One common mistake is assuming standard email services automatically comply with HIPAA without signing a BAA, which could lead to compliance gaps and potential breaches.