Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

Question

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not asking a "should" question here. I know patient-doctor communications should be encrypted. I know that the meaningful use requirements now in draft reward for Direct Project based communications.

What want to know is, definitively, can healthcare providers have patients sign waivers that allow the doctors to legally email in plain text with them? People seem to read the different HIPAA-HITECH act regulations very differently. Vendors of secure products always say that secure email is legally required. Yet I know several healthcare providers who communicate PHI using plain-text email with their patients, by having their patients sign something that says that the patient understands the issues with plain text email and still considers it "protected" under HIPAA.

So there at least some people who argue that it is illegal (vendors) and some who argue that it is legal and actively send plain text emails.

I am not asking this because I do not have an opinion on this myself. I am asking for someone to make an assertion regarding this issue, and back it up with quotes and corresponding links to the various sections of the laws and federal rules in question. Obviously all of the relevant national level rules and laws should be referenced in an accepted answer.

Because this can be a bit of work, I am putting a bounty on this one.

Answer 1

The Office of Civil Rights is responsible for enforcing HIPAA regulations.

They released a document that addresses your question directly. Here is the link to that document - Safeguards.pdf. Read the answer to Question 3.

Note, in particular, this paragraph:

Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual. If the provider feels the patient may not be aware of the possible risks of using unencrypted e-mail, or has concerns about potential liability, the provider can alert the patient of those risks, and let the patient decide whether to continue e-mail communications.

Additional HIPAA information is available at: http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/.

Hope this helps.

Answer 2

There is one issue that you would have to cover to get a valid answer to this question, which facility... HIPAA was written so that each facility could interpret it's requirements to best fit their needs, so the way that one facility interprets the requirement could be entirely different than the way another does.

With that said, the way we handled it at my previous hospital is that the e-mail did not need to be encrypted as long as it didn't include privacy act information (SSN, Address, etc). Beyond that, supplying a valid e-mail was stated on the patient information form as permission to initiate e-mail communications until the patient put in a request in writing to desist e-mailing them.

For instance, this document from Health and Human Services says in its FAQ:

Q3: Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?

A3: Yes. The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so. See 45 C.F.R. § 164.530(c). For example, certain precautions may need to be taken when using e-mail to avoid unintentional disclosures, such as checking the e-mail address for accuracy before sending, or sending an e-mail alert to the patient for address confirmation prior to sending the message. Further, while the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications between health care providers and patients, other safeguards should be applied to reasonably protect privacy, such as limiting the amount or type of information disclosed through the unencrypted e-mail. In addition, covered entities will want to ensure that any transmission of electronic protected health information is in compliance with the HIPAA Security Rule requirements at 45 C.F.R. Part 164, Subpart C. [...]

Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual. If the provider feels the patient may not be aware of the possible risks of using unencrypted e-mail, or has concerns about potential liability, the provider can alert the patient of those risks, and let the patient decide whether to continue e-mail communications.