HIPAA Compliance in Email Communication: Best Practices and Tools

One of the biggest challenges that healthcare providers face when trying to align their organization and processes with the Health Insurance Portability and Accountability Act (HIPAA), is the proper use of email when communicating with patients. 

While HIPAA does not prohibit the use of email communication, it enforces strict privacy and security requirements. To comply, organizations must use, and make available HIPAA-compliant email solutions that safeguard Protected Health Information (PHI) during transmission and storage. 

In this article, you’ll learn about the dos and don’ts of using email for sharing or managing PHI, and how to choose an email solution for your clinic that is HIPAA compliant.

The Need for HIPAA Compliant Email in Healthcare

The healthcare sector is undergoing a massive digital transformation that enables faster and more efficient care. And these transformations have made email a central medium – whether it’s for sending patient records, lab results and x-rays, or simply to act as a login credential to platforms that manage sensitive electronic Protected Health Information (ePHI). However, as email dependence grows, so does the risk of security breaches and HIPAA violations.

Take the Umass Memorial Health data breach lawsuit, for example. The healthcare provider had to settle the lawsuit for $1.2 million. According to reports, the hackers gained access to patient information – including names, medical record numbers, driver’s license numbers, financial account information, and social security numbers – through clicks on phishing emails sent by them. 

The incident highlights the risks associated with using insecure email providers and a lack of proper HIPAA Compliance and Breach Prevention Training for staff. 

Risks of Using Generic Email for Patient Communication

Under the HIPAA Privacy and Security rules, the HHS (the US Department of Health and Human Services) does not prohibit covered entities and business associates from using generic email platforms that may not be compliant with HIPAA regulations. 

Healthcare providers must offer a HIPAA compliant email option for communicating with patients. However, if patients insist on using a non-secure channel of email communication, providers can do so after explaining the risks associated with it and collecting the patient’s consent. 

Here are some of the important risks associated with using generic email for healthcare communication.

• Email addresses are usually used as usernames or login credentials for digital accounts. Anyone who gains access to your email account would then have access to your communications with patients containing confidential information as well as patient email addresses. It then becomes very easy for cybercriminals to hack into patient accounts containing vital ePHI or even banking details.
• Email addresses accessed on personal or unsecured devices are more prone to unauthorized access. Without encryption, antivirus or strong access controls, these devices are more vulnerable to theft and hacking.
• Most generic email addresses do not offer message recall options in the (all too common) event of message misdelivery. This is particularly important when dealing with sensitive ePHI.
• Generic email providers do not offer audit logs, making it difficult to monitor access, detect misuse, or respond to breach incidents effectively.
• Once PHI is emailed, the sender loses control over where and how it’s stored or forwarded, or archived insecurely.
• Email is the leading attack vector for phishing, ransomware, and social engineering. Using non-secure email increases the attack surface, making it easier for cybercriminals to exploit vulnerabilities and target both healthcare professionals and patients.

What are the HIPAA email requirements according to the HHS?

According to the HHS, healthcare providers must apply ‘reasonable safeguards when emailing PHI,’ comply with ‘the minimum necessary standard,’ and strictly adhere to the HIPAA Security and Privacy Rule, among other things, to stay HIPAA compliant. 

Under the Privacy Rule, the HHS clearly stipulates the need for a Business Associate Agreement (BAA) whenever PHI is involved. However, due to the fact that it is not always possible to enter into a BAA with the email provider of the recipient, the HIPAA Email policies do not explicitly talk about entering into a BAA with an email service provider.

There are also several preemptions and exclusions to HIPAA email compliance, especially when it comes to patient consent. For example, a guidance issued by the HHS in 2008 stated that, 

“Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume that e-mail communications are acceptable to the individual.”

However, not all states follow these guidelines, and some states have subsequently passed laws that require healthcare providers and business associates to get clear consent from patients before using email channels for communicating with them.

The HIPAA requirements and regulations for email communication can be complex and vary from state to state. For this reason, it is important to get proper advice from HIPAA Email Compliance Experts before choosing email providers or communication systems. 

Below, we have compiled a list of HIPAA requirements for email under the Privacy Rule, Security Rule, and Breach Notification Rule. These are part of HIPAA’s federal guidelines.

HIPAA Privacy, Security, and Breach Notification Rules Overview

1. Get Patient Consent: 

Under the Privacy Rule, the HHS mandates that all healthcare professionals get patient consent before disclosing PHI.

2. Inform Them About The Risks: 

Healthcare providers are obligated to inform patients about their rights to PHI under the HIPAA Privacy Rule. This also includes fully educating them about all the risks associated with using generic and unsecured email platforms for healthcare communications. 

3. Minimum Necessary Information Only: 

Healthcare providers must share only the minimum necessary information that is required to provide the care service, even while using email platforms. 

 4. Set Up Access Controls: 

Covered entities and business associates must ensure that the email environment containing PHI can be accessed by authorized personnel only.

5. Enable Audit Trail: 

All email activities must be closely monitored and regularly audited to detect any unauthorized access, unusual activities or disclosures.

6. Email Encryption: 

HHS recommends strong email encryption, especially during transit, before sharing PHI.

7. Conduct Risk Assessments: 

Healthcare providers and other businesses that handle PHI must also conduct regular risk assessments to determine if encryption is necessary based on potential risks.

8. Establish Breach Protocols: 

All covered entities and businesses should establish clear protocols to notify affected individuals promptly in the event of a breach via email.

HIPAA Compliant Email: What Makes an Email “Secure”? 

According to the Verizon Data Breach report of 2023, almost 61% of breaches contained email addresses among other personal information like phone numbers and passwords, making it the most common type of data that is compromised during breaches. This makes email an obvious attack vector and reinforces the need for secure email providers who meet HIPAA standards.