What is HIPAA Law: Rules, Email Compliance, & Violation Fines

The healthcare information of every patient is sensitive. A patient's health details often contain their family medical history and financial information, making it all the more crucial to secure and safeguard it. This is why the Health Insurance Portability and Accountability Act (HIPAA) was introduced. This guide will discuss HIPAA and its implications for email marketers in deep detail.

Table of contents

• What is HIPAA?

• What are the objectives of HIPAA?

• What are the titles of HIPAA?

  • Title I: HIPAA Health Insurance Reform
  • Title II: HIPAA Administrative Simplification
  • Title III: HIPAA Tax-Related Health Provisions
  • Title IV: Application and Enforcement of Group Health Plan Requirements
  • Title V: Revenue Offsets

• Entities affected by HIPAA

• The HIPAA privacy and security rules

  • 1. The Privacy rule
  • 2. The Security rule

• What are HIPAA-compliant emails?

• Encryption requirements for a HIPAA-compliant email

• How to secure emails for HIPAA-compliance

  • 1. Cloud-based servers
  • 2. Encryption
  • 3. Secure message portals
  • 4. Passwords and two-factor authentication
  • 5. Email disclaimers

• How to find the best HIPAA-compliant email provider?

• Popular HIPAA-compliant email providers

• How to send HIPAA compliant emails?

• Penalties for HIPAA violation

• Effects of HIPAA

• Conclusion

What is HIPAA?

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law passed by the Department of Health & Human Services in 1996. It is aimed at protecting the personal data of patients from public access. The mandatory compliance of HIPAA helps in preventing the misuse of this information.

Furthermore, amendments have been made to the HIPAA since the law was first made.

What are the objectives of HIPAA?

The critical goals and objectives around which HIPAA revolves are as follows:

1. Privacy of health information

2. Security of electronic records

3. Administrative simplification

4. Insurance portability

What are the titles of HIPAA?

HIPAA is divided into the following five titles:

Title I: HIPAA Health Insurance Reform

Health insurance coverage is protected under Title I for people who lose or change jobs. It also forbids corporate health plans from rejecting coverage to those with certain diseases or preexisting conditions, as well as putting lifetime coverage restrictions in place.

Title II: HIPAA Administrative Simplification

Title II of the bill instructs the US Department of Health and Human Services to develop national standards for the processing of electronic healthcare transactions. It also mandates that healthcare organizations implement secure electronic access to health data and adhere to HHS privacy laws.

Title III: HIPAA Tax-Related Health Provisions

Title III contains tax-related provisions as well as medical-care guidelines.

Title IV: Application and Enforcement of Group Health Plan Requirements

Title IV defines health-care reform in further detail, including provisions for people with pre-existing diseases and those who want to keep their current coverage.

Title V: Revenue Offsets

Title V covers things like company-owned life insurance and how people who lose their US citizenship are taxed.

Entities affected by HIPAA

The entities that give out healthcare information to make particular transactions for which the U.S. Department of Health and Human Services has adopted standards come under HIPAA.

These providers include, but are not limited to:

• Doctors

• Clinicians

• Psychologists

• Dentists

• Chiropractors

• Nursing homes’ owners

• Pharmacy service providers

These transactions may be healthcare claims, advice regarding payment and remittance, healthcare status, coordination of benefits, enrollment, eligibility checks, transfers of electronic healthcare funds, referral certifications, and authorization.

The HIPAA privacy and security rules

There are two main elements in HIPAA as follows.

1. The Privacy rule

This rule protects the privacy of the personal health information of an individual. It sets limits and conditions on the further uses and disclosures of such information without the patient’s authorization.

2. The Security rule

According to this, appropriate administrative, physical, and technical measures should be adopted to ensure the confidentiality, integrity, and security of the patients’ health information.

The covered entities and business associates dealing with this protected health information (PHI) must comply with these rules.

What are HIPAA-compliant emails?

A HIPAA-compliant email ensures that any email with protected health information is delivered securely to the recipient’s inbox. An entity abiding by the Privacy Rule and the Security Rule is said to be HIPAA compliant. However, the usual email providers of Google and Yahoo aren’t usually HIPAA compliant. They require a specific configuration.

Therefore, most of the entities refer to a third party, precisely a HIPAA compliant email provider, to work on HIPAA standards.

Encryption requirements for a HIPAA-compliant email

Following are the regulations that must be complied with in a HIPAA-compliant email:

1. A HIPAA-compliant email must be encrypted as it makes the data unreadable during the transmission and at rest.

   • As per the HIPAA email rules, the messages in transit containing the ePHI have to meet the encryption requirements. It helps secure the emails that users are sending outside a protected email network.

   • Emails having PHI shouldn’t be sent unless they are encrypted with a third-party program or with 3DES, AES, or similar algorithms. If the PHI is in the form of text, the message must be encrypted. Otherwise, the attachment having the PHI can be encrypted.

   • Though encryption is merely an element of HIPAA email compliance, however, it is essential. During the interception of a message, the encryption makes the content unreadable and, thus, more secure by preventing any impermissible disclosure of ePHI.

2. A covered entity may go for a risk analysis to understand the level of risk and decide whether encryption will be required or use another option. The OCR requires complete documents explaining why the encryption has not been chosen and how safe it is to use the other option.

3. An entity can choose any appropriate encryption method, but it should be on par with the latest technological advances.

4. HIPAA-covered entities can ensure better security by obtaining up-to-date encryption guidance from the National Institute of Standards and Technology. It recommends using Advanced Encryption Standard 128, 192, or 256-bit encryption at the time of writing. However, these standards tend to change from time to time, so one needs to check NIST’s latest guidance before implementing email encryption.

Related guide: Everything You Need To Know About Email Security

How to secure emails for HIPAA-compliance

An entity or business associate can secure the emails by complying with HIPAA standards. One can also use the following ways to keep the emails secure:

1. Cloud-based servers

A secure cloud-based email platform hosting a HIPAA compliant server is an excellent option to ensure the security of emails. However, you should connect via an HTTPS server to ensure an encrypted connection between you and your email server. Unfortunately, there is no guarantee of the email transmission from the cloud server to the recipient’s server or workstation. It works when all the senders and recipients have accounts on the same cloud-based email service.

2. Encryption

As previously mentioned, encryption is a non-negligible element of HIPAA.

Many email service providers encrypt the message during the transmission from your workstation to the recipient’s server. The recipient gets a notification in case the person is not a client of that email service provider. After establishing a secure connection, the recipient can then retrieve the message.

3. Secure message portals

Some EMR/EHR systems provide a secure portal of messages for the patients to store the patient’s information and retrieve it as per their requirements. You’ll get an email notification whenever the recipient gets a message on the portal. The patients can log in and securely receive the message. If there’s no such portal, you can also avail of these portal services from other providers such as eDossea and BrightSquid.

4. Passwords and two-factor authentication

A strong password/passphrase and multi-factor authentication help limit access, thereby protecting the email account.

5. Email disclaimers

While sending emails, the personnel can use email disclaimers and confidentiality notices to inform the patients and recipients that the information is PHI, and they should use it accordingly.

Nevertheless, you should encrypt the emails securing them from your end. No disclaimer can alleviate the entity’s responsibility to send ePHI securely.

How to find the best HIPAA-compliant email provider?

There are various HIPAA-compliant email providers. It’s’ important to keep the following points in mind during the selection of the best HIPAA compliant email provider for you:

• The HIPAA-compliant email provider should have a attentive and good customer service team. Also, the provider must be willing to sign a business associate agreement.

• The provider should provide encryption for every email, including the non-PHI emails as well.

• The encryption service needs to be effective. It should be well-integrated with any device, any browser, and any email provider.

Popular HIPAA-compliant email providers

Some of the popular HIPAA-compliant email providers are

• Virtru

• Paubox

• NeoCertified

• HIPAA Vault

• Aspida Mail

• Protected Trust

You can choose any of the above as per your needs and requirements.

How to send HIPAA compliant emails?

To send HIPAA compliant emails, the sender drafts an email on their workstation, which is then transmitted to the sender's email server. Then, the sender's email server sends an email to the recipient's email server, which is retrieved by the recipient.

Along the way, there are unarguably chances of data breach or non-compliance. Hence, you should consider the following things to send HIPAA compliant emails.

• Have end-to-end encryption

The Data Encryption Standard (DES) was once thought to be secure, but this is no longer the case. For assistance on appropriate encryption standards, you should contact the National Institute of Standards and Technology. AES 192 or 256-bit encryption are encryptions you may consider as an alternative to DES.

The communication must be encrypted if the PHI is in the body text. If it's part of an attachment, you can encrypt the attachment instead.

• Sign a Business Associate Agreement

If you use a third-party email provider to send electronic protected health information (ePHI), you should get a business associate agreement before using the service. The business associate agreement explains the service provider's responsibilities and specifies that physical, technical and administrative measures would be implemented to preserve the confidentiality of ePHI.

In general, free internet-based mail services like Gmail and Hotmail are not secure for transmitting personal information. If you insist on using an internet-based email provider, make sure you have them sign a Business Associate Agreement (BAA).

• Ensure your email is configured

Using a BAA-protected email service does not automatically make your email HIPAA-compliant.

If G Suite is used in conjunction with a business domain, email can be made HIPAA compliant. Even if you wish to use G Suite, you must configure the service carefully to assure end-to-end encryption.

It's important to note that G Suite isn't the same as Gmail. Gmail isn't designed for corporate use, and it can't be configured to comply with HIPAA. Google only signs a BAA for its premium services, not for its free ones.

Penalties for HIPAA violation

According to HIPAA, it’s mandatory for the covered entities and other business associates that have signed a business associate agreement to comply with HIPAA Rules. Failure to comply with these rules may lead to inevitable consequences.

HIPAA violation could result in financial penalties ranging from a minimum of $50,000 per incident to a maximum of $1.5 million, per violation category, per year.

Multi-million-dollar fines are possible if the violation persists for more than one year or if multiple violations of HIPAA rules have been there. Certain HIPAA violations also have criminal penalties.

Effects of HIPAA

HIPAA is incredibly important for improving the privacy of healthcare details. Apart from these the major implications of HIPAA are as follows:

1. It increases personal privacy in terms of the healthcare information of the patients.

2. It prevents discrimination.

3. It secures the process of sharing confidential health information.

4. It streamlines different administrative healthcare functions and improves the efficiency of the whole healthcare industry.

5. It ensures all the covered entities use the same code sets and nationally recognized identifiers.

6. It requires the covered entities to implement multiple defenses to protect sensitive personal and health information.

7. It mandates the use of strong passwords and also that the providers should have a data backup plan in place.

8. It reduces medical errors and further leads to regular auditing of the system.

Conclusion

HIPAA is a landmark regulation that secures the exchange of confidential personal data associated with medical and healthcare streams. Understanding HIPAA and ensuring your emails are HIPAA compliant is essential for your marketing campaigns.