Understanding the HIPAA Requirements for Email Encryption

If you are in the healthcare field, you may have wondered what HIPAA’s exact requirements are regarding email encryption. Understandably, not many people are willing to read the 115 pages of the simplified regulation text, so the question often goes unanswered.

The good news is that we have parsed them for you. We’ve trawled through the long and arduous document to identify the HIPAA regulations concerning email encryption. We also conducted some analysis to help you figure out just how your organization can comply with these requirements.

What Does HIPAA Say About Email Encryption?

There are a few different segments of the HIPAA Security Rule that apply to email encryption. The first one we will discuss is section 164.306 Security Standards.

Security Standards for HIPAA Email Encryption

The general requirements state that covered entities and business associates must do the following:

1. Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.
2. Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
3. Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.
4. Ensure compliance with this subpart by its workforce.

Let’s unpack some of these terms to understand how they apply to your obligations under HIPAA.

• Covered entity – As a simplification, a covered entity is any healthcare-related organization dealing with protected health data.
• Business associate – A business associate (BA) is a person or organization with which a covered entity shares electronic protected health information (ePHI). This relationship is governed by a business associates agreement (BAA).
• Electronic protected health information (ePHI) – This is basically any digital information that is both “individually identifying” and contains “protected health information.” Individually identifying information includes names, contact details, social security numbers, and more. Protected health information relates to a patient’s health, treatments, or payments. Check out our article on ePHI for the specifics.

To summarize: Under the Security Rule, healthcare organizations and those dealing with their protected health information are obligated to protect that data. Encryption is just one way that data can be protected when stored or transmitted electronically, like through an email account.

HIPAA Technical Safeguards and Email Encryption

The next place to find information about email encryption is in section 164.312 Technical Safeguards. The rule states:

“Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.”

Notice how it says “addressable”? HIPAA has two different specifications regarding implementation, “required” and “addressable.” Required means that a particular mechanism must be in place for compliance.

On the other hand, addressable means that there is flexibility in the mechanisms that can be used. HIPAA is intentionally vague and technologically agnostic on purpose. This gives organizations the flexibility to develop the best security measures for their unique situation. It is not an excuse to be lax about security. Some addressable standards may not apply to an organization because of the structure or technologies used. Whether or not you need to meet the standard is a question for your legal and compliance teams. 

Does HIPAA Require Encryption and Decryption?

At this stage, you may assume that since encryption is an addressable standard, it’s optional, and you do not have to utilize it. This assumption is almost correct– nowhere in the HIPAA documentation does it specify that encryption and decryption must be used.

But unfortunately, things aren’t that simple. Let’s return to the Security Standards of section 164.306, where it states that covered entities and business associates must:

“Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.”

This time, we’ve put different terms in bold. So, while HIPAA does not state that covered entities have to use encryption, it does say that they need to ensure the confidentiality of any ePHI that is created, received, maintained, or transmitted.

The big question is, “If you aren’t going to use encryption, what techniques will you use to guarantee confidentiality instead?” Will you put all electronic data on flash drives and lock them in metal boxes for storage and transit?

The text doesn’t say that you have to use encryption. Still, given the other requirements in the HIPAA documentation, encryption is the only reasonable solution if you want to communicate electronically about patients and their health conditions.

Is Email Encryption Required for HIPAA?

As stated above, HIPAA does not require the use of email encryption. However, if you plan to communicate PHI via email, you must take steps to secure that data. Without other suitable technologies, encryption is the easiest way to protect patient data in emails. 

So what can you do? The HIPAA text doesn’t include specific encryption requirements, so the documentation isn’t particularly helpful for organizations looking for ways to be compliant and secure. Thankfully, the National Institute of Standards and Technology (NIST), another government agency, has released its own guidelines for email and how to keep it secure.

The guide is extensive, but some of the key takeaways are:

• Appropriate authentication and access control measures need to be in place.
• TLS should be used to connect to the email server.
• Mechanisms such as PGP or S/MIME should be used to encrypt sensitive data (such as ePHI).

If you don’t feel like reading such an exhausting document, you can turn to a HIPAA compliance specialist like LuxSci instead. Our HIPAA-Compliant Email includes email encryption as well as other features to help your organization stay both secure and compliant.