Security in Emailing Results

When it comes to healthcare apps, protecting sensitive patient information is paramount. After downloading results of an application to PDF or copying results text into another format, you will want to consider these detailed security precautions if/when email out results in order to comply with HIPAA (Health Insurance Portability and Accountability Act) requirements for safeguarding protected health information (PHI).

Use Encrypted Email Services

End-to-End Encryption: Use email services that provide end-to-end encryption to protect PHI during transmission. HIPAA requires that PHI be encrypted whenever it is transmitted electronically.
HIPAA-Compliant Services: Use email services that are specifically designed to be HIPAA-compliant, such as Hushmail for Healthcare or Virtru.

Encrypt Attachments

File Encryption: Encrypt any attachments containing PHI using HIPAA-compliant encryption standards (e.g., AES-256). Use tools like VeraCrypt, 7-Zip (with encryption), or built-in OS encryption features.
Password Protection: Protect encrypted files with strong, unique passwords. Do not send the password in the same email; instead, communicate it via a different secure channel, such as a phone call or a secure messaging app.

Use Secure File Transfer Services

HIPAA-Compliant File Transfer: Instead of attaching files directly to emails, use HIPAA-compliant secure file transfer services (e.g., ShareFile, Box for Healthcare) that offer encrypted links to download the files.
Expiration Dates: Set expiration dates for download links to limit the time they are accessible, reducing the risk of unauthorized access.

Verify Recipient Information

Double-Check Email Addresses: Ensure the accuracy of the recipient's email address to prevent sending PHI to unintended recipients.
Recipient Verification: Verify the recipient’s identity through a secondary method (e.g., phone call, secure messaging) before sending sensitive information.

Include a Confidentiality Notice

Legal Disclaimer: Include a HIPAA-compliant confidentiality notice in the email body that emphasizes the sensitivity of the information and provides instructions for handling the email if received in error.

Limit Information in Email Body

Minimal Details: Avoid including PHI in the email body. Use the email to inform the recipient that the results are attached or available via a secure link.
Generic Language: Use generic language in the email body to avoid revealing any specific patient information.

Regularly Update Security Practices

Stay Informed: Keep users informed about the latest security practices and HIPAA updates through periodic communications or training sessions.
HIPAA Compliance: Ensure that all practices align with HIPAA requirements, including regular security risk assessments and updates to security protocols.

Encourage the Use of Secure Communication Channels

Alternative Communication Methods: Suggest using HIPAA-compliant secure messaging apps or patient portals designed for healthcare communications (e.g., MyChart, Epic).
Secure Follow-Ups: Encourage recipients to use secure methods for follow-up communications or queries regarding the emailed results.

Email Settings and Security Features

Enable Two-Factor Authentication (2FA): Recommend that users enable 2FA on their email accounts for an additional layer of security, which is a best practice for HIPAA compliance.
Secure Email Clients: Advise using email clients with strong security features and configure them for maximum security (e.g., enabling SSL/TLS).

Audit and Monitoring

Audit Trails: Maintain an audit trail of sent emails and access logs to monitor who accessed the PHI. HIPAA requires covered entities to keep records of all disclosures of PHI.
Incident Response: Provide instructions on what steps to take if there is a suspected security breach or if PHI is sent to the wrong recipient. HIPAA requires covered entities to have a breach notification plan in place.
HIPAA-Specific Recommendations
Business Associate Agreements (BAAs): Ensure that any third-party service providers (e.g., email services, file transfer services) sign a Business Associate Agreement, which is a HIPAA requirement for handling PHI.
Data Minimization: Only include the minimum necessary information to achieve the intended purpose of the email, as required by the HIPAA Privacy Rule.
Access Control: Implement strict access controls to ensure that only authorized personnel can access PHI. This includes both technical controls (e.g., user authentication) and administrative controls (e.g., training and policies).

By following these precautions, PHI will be handled in a manner that complies with HIPAA regulations, thereby protecting patient confidentiality and maintaining the integrity of sensitive healthcare information.