What Is HIPAA and Why Is It Important

The healthcare information of a patient is sensitive, and thus, it becomes necessary to safeguard it. In addition, patients’ personal details contain their family medical history and financial information, making it all the more crucial to secure it. This is why the Health Insurance Portability and Accountability Act (HIPAA) was introduced.

This guide will discuss HIPAA and its implications for email marketers.

Table of contents

• What is HIPAA?
• What are the objectives of HIPAA?
• Entities affected by HIPAA
• The HIPAA Privacy and Security Rules
• What are HIPAA-compliant emails?
• Encryption requirements for a HIPAA-compliant email
• How to secure emails for HIPAA-compliance
• How to find the best HIPAA compliant email provider?
• Popular HIPAA-compliant email providers
• Penalties for non-compliance
• Effects of HIPAA
• Conclusion

What is HIPAA?

The U.S. Department of Health & Human Services established the Health Insurance Portability and Accountability Act, HIPAA, in 1996. This act aimed to ensure the protection of a patient’s healthcare information from public access.

The mandatory compliance of HIPAA helps in preventing the misuse of this information. Furthermore, amendments have been made to the HIPAA since the law was first made.

What are the objectives of HIPAA?

The critical goals and objectives around which HIPAA revolves are as follows:

1. Privacy of health information.

2. Security of electronic records.

3. Administrative simplification.

4. Insurance portability.

Entities affected by HIPAA

The entities that give out healthcare information to make particular transactions for which the U.S. Department of Health and Human Services has adopted standards come under HIPAA.

These providers include, but are not limited to:

• Doctors

• Clinicians

• Psychologists

• Dentists

• Chiropractors

• Nursing homes’ owners

• Pharmacy service providers

These transactions may be healthcare claims, advice regarding payment and remittance, healthcare status, coordination of benefits, enrollment, eligibility checks, transfers of electronic healthcare funds, referral certifications, and authorization.

The HIPAA Privacy and Security Rules

There are two main elements in HIPAA as follows.

1. The Privacy rule

This rule protects the privacy of the personal health information of an individual. It sets limits and conditions on the further uses and disclosures of such information without the patient’s authorization.

2. The Security rule

According to this, appropriate administrative, physical, and technical measures should be adopted to ensure the confidentiality, integrity, and security of the patients’ health information.

The covered entities and business associates dealing with this protected health information (PHI) must comply with these rules.

What are HIPAA-compliant emails?

A HIPAA-compliant email ensures that any email with protected health information is delivered securely to the recipient’s inbox. An entity abiding by the Privacy Rule and the Security Rule is said to be HIPAA compliant. However, the usual email providers of Google and Yahoo aren’t usually HIPAA compliant. They require a specific configuration.

Therefore, most of the entities refer to a third party, precisely a HIPAA compliant email provider, to work on HIPAA standards.

Encryption requirements for a HIPAA-compliant email

Following are the regulations that must be complied with in a HIPAA-compliant email:

1. A HIPAA-compliant email must be encrypted as it makes the data unreadable during the transmission and at rest.

   • As per the HIPAA email rules, the messages in transit containing the ePHI have to meet the encryption requirements. It helps secure the emails that users are sending outside a protected email network.

   • Emails having PHI shouldn’t be sent unless they are encrypted with a third-party program or with 3DES, AES, or similar algorithms. If the PHI is in the form of text, the message must be encrypted. Otherwise, the attachment having the PHI can be encrypted.

   • Though encryption is merely an element of HIPAA email compliance, however, it is essential. During the interception of a message, the encryption makes the content unreadable and, thus, more secure by preventing any impermissible disclosure of ePHI.

2. A covered entity may go for a risk analysis to understand the level of risk and decide whether encryption will be required or use another option. The OCR requires complete documents explaining why the encryption has not been chosen and how safe it is to use the other option.

3. An entity can choose any appropriate encryption method, but it should be on par with the latest technological advances.

4. HIPAA-covered entities can ensure better security by obtaining up-to-date encryption guidance from the National Institute of Standards and Technology. It recommends using Advanced Encryption Standard 128, 192, or 256-bit encryption at the time of writing. However, these standards tend to change from time to time, so one needs to check NIST’s latest guidance before implementing email encryption.

Related guide: Everything You Need To Know About Email Security

How to secure emails for HIPAA-compliance

An entity or business associate can secure the emails by complying with HIPAA standards. One can also use the following ways to keep the emails secure:

1. Cloud-based servers

A secure cloud-based email platform hosting a HIPAA compliant server is an excellent option to ensure the security of emails. However, you should connect via an HTTPS server to ensure an encrypted connection between you and your email server. Unfortunately, there is no guarantee of the email transmission from the cloud server to the recipient’s server or workstation. It works when all the senders and recipients have accounts on the same cloud-based email service.

2. Encryption

As previously mentioned, encryption is a non-negligible element of HIPAA.

Many email service providers encrypt the message during the transmission from your workstation to the recipient’s server. The recipient gets a notification in case the person is not a client of that email service provider. After establishing a secure connection, the recipient can then retrieve the message.

3. Secure message portals

Some EMR/EHR systems provide a secure portal of messages for the patients to store the patient’s information and retrieve it as per their requirements. You’ll get an email notification whenever the recipient gets a message on the portal. The patients can log in and securely receive the message. If there’s no such portal, you can also avail of these portal services from other providers such as eDossea and BrightSquid.

4. Passwords and two-factor authentication

A strong password/passphrase and multi-factor authentication help limit access, thereby protecting the email account.

5. Email disclaimers

While sending emails, the personnel can use email disclaimers and confidentiality notices to inform the patients and recipients that the information is PHI, and they should use it accordingly.

Nevertheless, you should encrypt the emails securing them from your end. No disclaimer can alleviate the entity’s responsibility to send ePHI securely.

How to find the best HIPAA compliant email provider?

There are various HIPAA-compliant email providers. It’s’ important to keep the following points in mind during the selection of the best HIPAA compliant email provider for you:

• The HIPAA-compliant email provider should have a good and attentive customer service team. Also, the provider must be willing to sign a business associate agreement.

• The provider should provide encryption for every email, including the non-PHI emails as well.

• The encryption service needs to be effective. It should be well-integrated with any device, any browser, and any email provider.

Popular HIPAA-compliant email providers

Some of the popular HIPAA-compliant email providers are

• Virtru

• Paubox

• NeoCertified

• HIPAA Vault

• Aspida Mail

• Protected Trust

You can choose any of the above as per your needs and requirements.

Penalties for non-compliance

According to HIPAA, it’s mandatory for the covered entities and other business associates that have signed a business associate agreement to comply with HIPAA Rules. Failure to comply with these rules may lead to inevitable consequences.

HIPAA violation could result in financial penalties ranging from a minimum of $50,000 per incident to a maximum of $1.5 million, per violation category, per year.

Multi-million-dollar fines are possible if the violation persists for more than one year or if multiple violations of HIPAA rules have been there. Certain HIPAA violations also have criminal penalties.

Effects of HIPAA

HIPAA is incredibly important for improving the privacy of healthcare details. Apart from these the major implications of HIPAA are as follows:

1. It increases personal privacy in terms of the healthcare information of the patients.

2. It prevents discrimination.

3. It secures the process of sharing confidential health information.

4. It streamlines different administrative healthcare functions and improves the efficiency of the whole healthcare industry.

5. It ensures all the covered entities use the same code sets and nationally recognized identifiers.

6. It requires the covered entities to implement multiple defenses to protect sensitive personal and health information.

7. It mandates the use of strong passwords and also that the providers should have a data backup plan in place.

8. It reduces medical errors and further leads to regular auditing of the system.

Conclusion

HIPAA is a landmark regulation that secures the exchange of confidential personal data associated with medical and healthcare streams. Understanding HIPAA and ensuring your emails are HIPAA compliant is essential for your marketing campaigns.