ePHI Archives - LuxSci

Posts Tagged ‘ePHI’

What exactly does HIPAA say about Email Security?

Wednesday, February 26th, 2025

Performing daily business transactions and communications through electronic technologies is accepted, reliable, and necessary across the nation’s healthcare providers, payers and suppliers. As a result, email has become a standard in the healthcare industry as a way to conduct business activities that commonly include:

Interacting with patients
Real time authorizations for medical services
Transcribing, accessing and storing health records
Appointment scheduling
Referring patients
Explanation of benefits
Marketing offers
Submitting claims to health plan payers for payment of the services provided

Collaborative efforts amongst healthcare providers have improved the delivery of quality care to patients in addition to the recognized increase in administrative efficiency through effective use of email and other types of digital communication. Patients are becoming more and more comfortable with emailing their physician’s office to schedule an appointment, discuss laboratory results, or request refills on medication. Medicare and some other insurance payers also recognize and pay for virtual care where the health provider and patient interact over video (telemedicine).

Using digital communications, undoubtedly, poses concerns about the privacy and security of an individual’s information. In healthcare, the confidentiality of a patient’s information has been sacred since the days of the Hippocratic Oath (Hippocrates – the Father of Medicine, 400 B.C.). Today, merely taking an oath to respect one’s privacy has been overshadowed by regulations that govern how certain healthcare establishments must handle an individual’s health information. So, if a healthcare organization employs email as a means of communicating medical and/or mental health data to appropriate parties, including patients and customers, they must also ensure that information is well safeguarded.

This article addresses the specific issues that healthcare provider, payers and suppliers must address in order to be in compliance with HIPAA and HITECH certified. It will also lay out how LuxSci enables healthcare organizations to meet these requirements though HIPAA compliant email outsourcing.

Overview of HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) implemented new rules for the healthcare world. Mandating compliance with its Privacy and Security Rules, the federal government is committed to enforcing patients’ rights. Industry professionals – financial, administrative and clinical – are no strangers to the regulatory compliance culture. HIPAA laws apply to a covered entity; i.e. healthcare providers, suppliers, clearinghouses and health plan payers that meet certain conditions. In essence, most providers are covered entities if they employ digital communications, meaning they function by storing and exchanging data via computers through intranets, Internet, dial up modems, DSL lines, T-1, etc. Additionally, HITECH extends the requirements of HIPAA to any business associate of a covered entity and to all business associates of business associates (all the way down the line) who may come into contact with Protected Health Information originating from a covered entity.

HIPAA email security applies specifically to protected health information, not just personal information. Protected Health Information (PHI), as defined in HIPAA language, is health information of an identifiable individual that is transmitted by electronic media; maintained in any electronic medium; or transmitted or maintained in any other form or medium. For example, all administrative, financial, and clinical information on a patient is considered PHI and must abide by the following standards:

Privacy Standards: The HIPAA Privacy Rule sets standards for protecting the rights of individuals (patients). Covered entities must follow the laws that grant every individual the right to the privacy and confidentiality of their health information. Protected Health Information is subject to an individual’s rights on how such information is used or disclosed.
Privacy Standard Key Point: Controlling the use and disclosure of oral, written and electronic protected health information (any form).
Security Standards: Taking the Privacy Rule a step further, HIPAA implemented the Security Rule to cover electronic PHI (ePHI). To this end, more secure and reliable information systems help protect health data from being “lost” or accessed by unauthorized users.
Security Standard Key Point: Controlling the access to electronic forms of protected health information (not specific to oral or written).

The Privacy and Security Rules focus on information safeguards and require covered entities and their business associates to implement the necessary and appropriate means to secure and protect health data. Specifically, the regulations call for organizational and administrative requirements along with technical and physical safeguards.

Provisions of the HIPAA Email Security Rule

The HIPAA language uses the terms required and addressable. Required means that complying with the given standard is mandatory and, therefore, must be complied with. Addressable means that the given standards must be implemented by the organization unless assessments and in depth risk analysis conclude that implementation is not reasonable and appropriate specific to a given business setting. Important Note: Addressable does not mean optional.

With regard to addressable, an organization should read and decipher each Security standard separately and deal with each piece independently in order to determine an approach that meets the needs of the organization.

The General Rules of the Security Standards reflect a “technology-neutral” approach. This means that there are no specific technological systems that must be employed and no specific recommendations, just so long as the requirements for protecting the data are met.

Organizational requirements refer to specific functions a covered entity must perform, including the use of business associate contracts and the development, documentation and implementation of policies and procedures.

Administrative requirements guide personnel training and staff management in regard to PHI and require the organization to reasonably safeguard (administrative, technical and physical) information and electronic systems.

Physical safeguards are implemented to protect computer servers, systems and connections, including the individual workstations. This section covers security concerns related to physical access to buildings, access to workstations, data back up, storage and obsolete data destruction.

Technical safeguards affect PHI that is maintained or transmitted by any electronic media. This section addresses issues involving authentication of users, audit logs, checking data integrity, and ensuring data transmission security.

Risk Analysis

Risks are inherent to any business and, therefore, with regard to HIPAA, each organization must take into consideration the potential for violating an individual’s right to privacy of their health information. HIPAA allows for scalability and flexibility so that decisions can be made according to the organization’s approach in protecting data. Covered entities and their Business Associates must adopt certain measures to safeguard PHI from any “reasonably anticipated” hazards or threats. After a thorough yearly risk analysis, a yearly assessment of the organization’s current security measures should be performed. Additionally, a cost analysis will add another important component to the entire compliance picture. A plan to implement secure electronic communications starts with reviewing the Security Rule and relating its requirements to the available solution and your business needs.

HIPAA Administrative and Physical Safeguards

Below are the administrative and physical safeguards as outlined in the Federal Register. These requirements are items that must generally be addressed internally, even if you are outsourcing your email or other services. We will discuss these safeguards in more detail below.

Standard: ADMINISTRATIVE SAFEGUARDS	Sections	Implementation Specification	Required or Addressable
Security Management Process	164.308(a)(1)	Risk Analysis	R
		Risk Management	R
		Sanction Policy	R
		Information System Activity Review	R
Assigned Security Responsibility	164.308(a)(2)		R
Workforce Security	164.308(a)(3)	Authorization and/or Supervision	A
		Workforce Clearance Procedures	R
		Termination Procedures	A
Information Access Management	164.308(a)(4)	Isolating Health Care Clearinghouse Function	R
		Access Authorization	A
		Access Establishment and Modification	A
Security Awareness and Training	164.310(a)(5)	Security Reminders	A
		Protection from Malicious Software	A
		Log-in Monitoring	A
		Password Management	A
Security Incident Procedures	164.308(a)(6)	Response and Reporting	R
Contingency Plan	164.308(a)(7)	Data Backup Plan	R
		Disaster Recovery Plan	R
		Emergency Mode Operation Plan	R
		Testing and Revision Procedure	A
		Applications and Data Criticality Analysis	A
Evaluation	164.308(a)(8)		R
Business Associates Contracts and Other Arrangement.	164.308(b)(1)	Written Contract or Other Arrangement	R
Standard: PHYSICAL SAFEGUARDS	Sections	Implementation Specification	Required or Addressable
Facility Access Controls	164.310(a)(1)	Contingency Operations	A
		Facility Security Plan	A
		Access Control and Validation Procedures	A
		Maintenance Records	A
Audit Controls	164.312(b)		R
Integrity	164.312(c)(1)	Mechanism to Authenticate EPHI	A
Workstation Use	164.310(b)		R
Workstation Security	164.310(c)		R
Device and Media Controls	164.310(d)	Disposal	R
		Media Re-use	R
		Accountability	A
		Data Backup and Storage	A

Importance of Encryption for Email Communication

The security risks for email commonly include unauthorized interception of messages en route to recipient, messages being delivered to unauthorized recipients, and messages being accessed inappropriately when in storage. These risks are addressed in the Security Rule’s technical safeguards section, particularly:

Person or Entity Authentication – required procedures must be implemented for identification verification of every person or system requesting access to PHI. This means the identity of the person seeking information must be confirmed within the information system being utilized. It also means that shared logins are not permitted.
Transmission Security – addressable data integrity controls and encryption reasonable and appropriate safeguards.
Business Associates – if you outsource your email services to another company and your email may contain ePHI in any form, then that company must be HIPAA compliant, sign a Business Associate Agreement with you, and actively safeguard your ePHI.

Each healthcare organization using email services must determine, based on technologies used for electronic transmission of protected health information, how the Security standards are met.

Addressable specifications include automatic log off, encryption, and decryption. Covered entities must also assess organizational risks to determine if the implementation of transmission security which includes integrity controls to ensure electronically-transmitted PHI is not improperly modified without detection is applicable. E.g. it is applicable for any ePHI going over the public Internet; it may not be necessary for information flowing between servers in your own isolated office infrastructure. Encryption of ePHI at rest (as it is stored on disk) is also addressable and not a requirement under HIPAA regulations; however, a heightened emphasis has been placed on encryption due to the risks and vulnerabilities of the Internet.

Ultimately, according to the Department of Health and Human Services, covered entities and their business associates can exercise one of the following options in regard to addressable specifications:

Implement the specified standard;
Develop and implement an effective security measure to accomplish the purpose of the stated standard; or
If the specification is deemed not reasonable and appropriate for the organization but the standard can still be met, then do not implement anything.

Reasonable and appropriate relate to each organization’s technical environment and the security measures already in place.

Questions to Consider When Choosing an Email Service Provider

When your organization is responsible for critical data such as protected health information, choosing an email provider is more than a matter of trust. Does the email service provider build on the administrative, physical and technical safeguards while delivering to its customers:

Signed Business Associate Agreement
Awareness of their responsibilities under HITECH and Omnibus
Solutions that meet or exceed HIPAA’s Security Standards
Willingness to work with you and advise you on your security and privacy choices
Protect data integrity
Flexible, scalable services – no account is too small
Administrative access to assign or change a user’s password
Controls to validate a user’s access
Audit controls to track user access and file access
Allow access to users based on role or function
Automatic log off after specified time of inactivity
Data transmission security
Unlimited document or email transfer
Ability for encryption
Emergency access for data recovery
Minimal server downtime
Secure data back up and storage
Secure data disposal
User friendly, web-based access without the necessity of third party software
Privacy in not selling or sharing its client contact information

A Scalable, Flexible, HIPAA-Compliant Email Services

LuxSci offers secure, premium email services including extensive security features, Spam and virus filtering, robustness, and superior customer service. The offerings are scalable to any size healthcare organization.

In addition to LuxSci itself protecting your ePHI by following the HIPAA Security and Privacy Rules as required by the HITECH amendment to HIPAA, LuxSci also provides a clean set of guidelines for using its services that enable your ePHI to be safeguarded; these guidelines are automatically enforced by the use of any “HIPAA Compliant” account. If you follow these guidelines and sign LuxSci’s Business Associate Agreements, LuxSci will certify your account as HIPAA compliant and give you a HIPAA Compliance Seal.

Take a look at the table below to see examples of how LuxSci enables you to meet HIPAA’s requirements for protecting electronic communications in your organization.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
Access Control	164.312(a)(1)	Unique User Identification	R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Assign a unique name and/or number for identifying and tracking user identity.” Solution: Use of unique usernames and passwords for all distinct user accounts. No shared logins; but sharing of things like email folders between users is permitted.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
		Emergency Access Procedure	R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency” Solution: PHI in email communications can be accessed from any location via the Internet. There are also mechanisms for authorized administrative access to account data. Optional Email Archival and Disaster Recovery services provide enhanced access to email in case of emergency.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
		Automatic Logoff	A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.” Solution: An organization can set screen savers on their desktops to log users out. Additionally, WebMail and other email access services (e.g. POP, IMAP, and Mobile) automatically log off all users after a predetermined amount of time; the WebMail session time is user- and account-configurable.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
		Encryption and Decryption	A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: Implement a mechanism to encrypt and decrypt electronic protected health information. Solution: All usernames, passwords, and all other authentication data are be encrypted during transmission to and from LuxSci’s servers and our clients using SSL/TLS. Additionally, SecureLine permits end-to-end encrypted email communications with anyone on the Internet, SecureForm enables end-to-end encryption of submitted web site form data, and WebAides permit encryption of sensitive documents, passwords databases, and internal blogs.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
Audit Controls	164.312(b)		R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.” Solution: Detailed audit trails of logins to all POP, IMAP, SMTP, LDAP, SecureLine,and WebMail services are available to users and administrators. These include the dates, times, and the IP addresses from which the logins were made. Auditing of all sent and received email messages is also available. SecureLine also permits auditing of when messages have been read.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
Integrity	164.312(c)(1)	Mechanism to Authenticate ePHI	A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.” “Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.” Solution: To prevent unauthorized alteration or destruction of PHI, the use of SSL, TLS, PGP, and SecureLine will verify message and data integrity.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
Person or Entity Authentication	164.312(d)		R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.” Solution: Username and Password are used for access control (Two-factor verification is also available); strict control is given over who can access user’s accounts. LuxSci’s privacy policy strictly forbids any access of email data without explicit permission of the user (unless there are extenuating circumstances). Also, use of SecureLine end-to-end encryption in email and document storage ensures that only the intended recipient(s) of messages or stored documents can ever access them.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
Transmission Security	164.312(e)(1)	Integrity Controls	A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.” “Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.” Solution: SSL-based encryption during the transmission of data to/from our clients for WebMail, POP, IMAP, SMTP, and document storage services is provided. SMTP TLS-based encryption of inbound email at LuxSci ensures that all email sent internally at LuxSci meets “Transmission Security” guidelines and allows you to securely receive email from other companies whose servers also support TLS. LuxSci also provides SecureLine for true end-to-end encryption of messages to/from non-clients.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
		Encryption	A
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.” Solution: SSL encryption for WebMail, POP, IMAP and SMTP services is provided. Additionally, encrypted document and data storage is available and use of SecureLine for end-to-end security is enforced.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
Device and Media Controls	164.310(d)	Data Backup and Storage	R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.”Solution: Daily on-site and weekly off-site backups ensure exact copies of all ePHI are included. Live data is stored on redundant RAID disk arrays for added protection. Furthermore, Premium Email Archival provides permanent, immutable storage on servers in multiple geographic locations.

Standard: TECHNICAL SAFEGUARDS	Sections	Implementation Specification	R/A?
		Data Disposal	R
HIPAA COMPLIANT SOLUTION from LuxSci
The Rule States: “Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.”Solution: Clients can delete their data whenever desired. Additional security comes in automatic expiration of data backups (cease to exist after 1 month). Alternate expiration plans are available for large clients.

Healthcare staff using LuxSci can send and receive email from anywhere in the world using existing or new email clients or web browsers. A comprehensive solution for a complex law – managed by your account administrators in-house or remotely by our company. Risk assessments for potential HIPAA violations can be performed by administrators through the use of audit trails. Reliability and cost effective solutions are the backbone of LuxSci – even for extremely large client organizations. And, count on the physical security of our servers.

Chart of LuxSci Services and the HIPAA Rules they Satisfy

If you are interested in specific services at LuxSci and would like to know exactly which of the HIPAA rules each service meets, the following charts will assist you. Please contact LuxSci for more information.

HIPAA Rule	1. View Email: Secure WebMail, POP, IMAP, or Mobile Sync	2. Send Email: Secure WebMail, SMTP, or Mobile Sync	3. Encryption with SecureLine combined with 1 and 2	4. Secure Collaboration (WebAides)
Access Control – Unique User Identification
Access Control – Emergency Access			(a)	(a)
Access Control – Automatic Logoff
Audit Controls
Integrity			(b)	(b)
Person or Entity Authentication			(b)	(b)
Transmission Security > Integrity Controls	(c)	(c)
Transmission Security > Encryption	(c)	(c)
Device and Media Controls > Data Backups
Device and Media Controls > Data Disposal

(a) Our secure document storage service and use of SecureLine for communications may assume that the recipients have special passwords for their “Secure data access certificates” (PGP or S/MIME). These passwords are may be stored in a “Password Escrow” (a special secure password database) if the users so choose. In these cases, passwords to security keys can be retrieved in case of emergency or in case of loss.

(b) Our secure document storage service and use of SecureLine for communications encrypts data so that only the intended recipient(s) can ever view the data. The encryption process also allows the recipient(s) to verify that the data was not altered since it was sent or stored using digital signatures.

(c) SSL/TLS solutions encrypt the message during transport to and from LuxSci’s servers and your personal computer. Email sent from LuxSci to external addresses is secured with the use of SecureLine.

LuxSci provides complete transport layer and end-to-end email security compatible with any email user anywhere, no matter what software they may have.

Tags: access control, addressable, audit controls, authentication, covered entities, email security, email security rule, encryption, ePHI, Health Insurance Portability and Accountability Act, heathhealthcare, hipaa, hitech, integrity, omnibus, phi, privacy, protected health information
Posted in AAA Featured Articles, LuxSci Library: HIPAA
9 Comments »

6 Email Marketing Best Practices for Healthcare

Friday, February 14th, 2025

Email marketing can be a powerful tool for healthcare organizations, but it requires careful planning and execution because of compliance requirements for HIPAA marketing. In this blog post, we will discuss email marketing best practices to help healthcare marketers achieve their goals.

1. Define Your Campaign Goals

The success of any email marketing campaign depends on the goals you want to achieve. However, because healthcare organizations are often not selling products to their patients, marketers can be confused about how to set measurable goals for their campaigns that aren’t tied to revenue generation.

Healthcare marketers can use email marketing campaigns for various purposes, including patient engagement, education, new product or service offerings, and retention. Some possible objectives of your campaigns could be:

New patient acquisition
Re-engaging lapsed patients
Spreading awareness about vaccines, treatments, or medical conditions
Increasing treatment or medication adherence
Collecting survey responses or patient-reported outcomes

All of these campaign objectives will correlate with different metrics. Identifying the campaign goal and the corresponding metrics you need to track is critical before selecting the audience and crafting the content.

2. Select Your Audience

Gone are the days of sending giant email blasts to your entire contact list. The best email marketers are creating highly targeted campaigns for specific audiences. Healthcare marketers using patient data in their audience targeting efforts are at an advantage. They can use patient information to create distinct audience segments. Targeting a patient population with common attributes makes it easier to craft a relevant message to drive clear results. For example, marketers can create more relevant campaigns when they can divide their patient population into subgroups based on shared characteristics like diagnoses, risk factors, and demographic data.

3. Personalize Your Content

Once you have clearly defined your goal and your audience, it’s essential to use personalization techniques to craft relevant messaging. Healthcare consumers expect more personalization from their providers and want to receive messages that tie into their past experiences. Generic, irrelevant messaging is more likely to annoy patients than get them to act. Healthcare marketers are lucky to have a wealth of data points to use in their messaging, but they must be aware of patient privacy and take steps to secure PHI in their messaging. When you have taken the appropriate steps to secure patient data, including protected health information in email messages is possible. This improves the patient experience and makes it easier for healthcare marketers to achieve their objectives.

4. Use A Clear Call-to-Action

Your emails should include a clear call-to-action (CTA) that encourages your audience to take the desired action. These actions may include scheduling an appointment, downloading a resource, logging into a patient portal, filling out a survey, or contacting your organization. Ensure that your CTA is prominent, stands out from the rest of your content, and ties back to the goal of your campaign. Most importantly, implement appropriate tracking technologies so you can see how many email recipients followed through on the CTA.

Don’t include too many calls to action in one message! Including multiple prompts may confuse the recipient and make it more difficult for your team to understand how the campaign performed.

5. Review Your Data

Finally, it’s essential to monitor your email metrics to evaluate the success of your campaigns. Some key metrics may include open rates, click-through rates, deliverability, surveys completed, successful logins, appointments scheduled, and other relevant metrics that tie back to your goals. Use this data to refine your email marketing strategy, trigger follow-up campaigns and marketing activity, and optimize future campaigns. Use APIs or webhooks to ensure your email campaign statistics are tied into marketing dashboards to get a holistic view of how your campaigns are performing.

6. Choose an Email Marketing Solution Designed for Healthcare

Finally, to use the tactics recommended above, it’s necessary to use a HIPAA-compliant email marketing solution. Segmenting audiences and personalizing content requires the use of protected health information. Therefore, it must be secured in compliance with HIPAA requirements. Also, make sure you select a platform that can protect data both at rest and in transit to utilize the power of your data fully.

LuxSci’s HIPAA compliant email marketing solution was designed to meet the needs of healthcare marketers and enables the use of PHI at scale. Contact our sales team to learn more about our capabilities and email marketing best practices.

Tags: email analytics, email marketing, ePHI, hipaa, hipaa compliance, patient engagement, personalization, phi, secure email, segmentation
Posted in HIPAA Marketing
Comments Off on 6 Email Marketing Best Practices for Healthcare

What exactly is ePHI? Who has to worry about it? Where can it be safely located?

Wednesday, January 15th, 2025

There is often a great deal of confusion and misinformation about what constitutes ePHI (electronic protected health information) and how to protect it under HIPAA requirements. Even once you understand ePHI and how it applies to you, the next question becomes, where is ePHI permitted? What is secure and what is not?

In this post, we will answer the “what is ePHI” question in general and the “where can I put it” question regarding HIPAA compliant email, email hosting, and secure form processing with LuxSci.

What constitutes electronic Protected Health Information?

ePHI is individually identifiable protected health information that is sent or stored electronically. Protected health information refers specifically to three classes of data:

An individual’s past, present, or future physical or mental health or condition
The past, present, or future provisioning of health care to an individual
The past, present, or future payment-related information for the provisioning of health care to an individual

“Individually identifiable” means information that can be somehow linked to a specific individual (even if this is very indirect). There are 18 types of identifiers for an individual (listed below). Any one of these identifiers, combined with “protected health information” (e.g., an appointment with a particular doctor), would constitute ePHI.

Name
Address (all geographic subdivisions smaller than a state, including street address, city, county, zip code)
All elements (except years) of dates related to an individual (including birth date, admission date, discharge date, date of death, and exact age if over 89)
Telephone number
Fax number
Email address
Social Security number
Medical record number
Health plan beneficiary number
Account number
Certificate/license number
Any vehicle or other device serial number
Device identifiers or serial numbers
Web URL
Internet Protocol (IP) address numbers
Finger or voiceprints
Photographic images
Any other characteristic that could uniquely identify the individual

An email message sent to an individual that says “your appointment with Dr. Shaw will be at 4pm on Friday” will be ePHI because the appointment with Dr. Shaw is “protected health information,” and the email address itself makes it identifiable. The fact that it is email makes it “electronic” (as opposed to a letter mailed the old-fashioned way).

ePHI Examples

The definition of ePHI seems very straightforward, but confusion arises when you start examining particular cases. Here are some examples:

I’m sending an email to someone whose email address is clearly not identifiable, e.g., “kjhw45376@gmail.com”…. therefore the message is not ePHI, right?

The definition of ePHI states that all email addresses, no matter what, are identifiable. Beyond that, at least people at gmail (in this case) will be able to match back the address to the actual person and thus identify the individual.

If it’s possible for anyone to identify the individual somehow, though some database or technique or association (even if you could never do it yourself … someone could), then the information is identifiable.

I am sending a newsletter with health care tips to a list of people that does not seem to be ePHI, right?

Here is a good example of a HIPAA marketing case where the answer is “it depends.” Is the information in the newsletter about the person’s past/present/future medical care or billing? Maybe, if this is a letter of tips on how to best recover from knee surgery, for example. If you are a doctor’s office and perform surgeries and send out this letter, that could be construed as ePHI. If, however, you are a general information web site where people can receive information about many different topics and you have no connection to the subscriber’s particular medical care, then this is not ePHI.

Who needs to worry about ePHI?

This has been a moving target over the years. It is especially important to know if you intend to do HIPAA compliant email marketing.

Currently, you have to protect all ePHI that you generate or come into contact (i.e., are given from patients) with per the HIPAA Security Rule if:

You are a HIPAA Covered Entity:
1. Care: You provide services or supplies related to an individual’s physical or mental health care. This includes (1) preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure concerning the physical or mental condition or functional status of an individual that affects the structure or function of the body; and (2) sale or dispensing of a drug, device, equipment, or another item following a prescription.
2. Provider: A provider of services (as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the ordinary course of business.
3. Clearinghouse: A public or private entity, including a billing service, repricing company, community health management information system or community health information system, and “value added” networks and switches that either process or facilitate the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction, or receive a standard transaction from another entity and process or facilitate the processing of health information into a nonstandard format or nonstandard data content for the receiving entity.
4. Plan: With certain exceptions, an individual or group plan that provides or pays the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)). The law specifically includes many organizations and government programs as health plans.
You are the Business Associate of a HIPAA Covered Entity. E.g., you perform services for such an entity and [may] come into contact with ePHI as part of your business with them.
You are a Business Associate of a Business Associate. If you do business with any company that is itself a HIPAA Business Associate and, as a result, may come into contact with ePHI, then you must also be a Business Associate and protect that PHI.

The HIPAA Omnibus rule defines this transitive chain of possession such that all businesses that may come into contact with ePHI are responsible for that information’s privacy and security. This includes many companies that previously had no idea they had to be HIPAA-compliant and technically excludes them from doing business with the medical community until they are.

Who does not have to protect ePHI?

Anyone who is not a “Covered Entity” or “Business Associate” per HIPAA does not have to worry about ePHI … at least in terms of violating HIPAA. Everyone should be sensitive about protecting this information, anyway.

The patient is the most notable example of someone who does not have to abide by HIPAA and protect ePHI. The patient (in most cases) is an individual and does not fall under the umbrella of HIPAA. The patient can send whatever sensitive, private, identifiable, protected health information (about themselves) to anyone (their doctor included) without encryption, security, or any other trappings to ensure privacy. While such is not a good idea, no one will be “in trouble with HIPAA” for that action.

So, what if your patient sent you an insecure email from @gmail.com with their complete medical history?

You did not violate HIPAA by receiving it.
They did not violate HIPAA by sending it.
As this is ePHI and HIPAA covers you, you are now responsible for protecting this information with all the security and privacy due per HIPAA.

This means that from the moment that patient’s email hits your account, you must take all reasonable measures to safeguard it. This could mean:

Immediately delete it if it was sent to a non-compliant account of yours. You might want to report this to HHS that ePHI was present in your insecure account and why. This is a reporting requirement and not necessarily a breach.
Ensure that patients only know your HIPAA-compliant email address, so any messages they send to you are protected as soon as they arrive.
Providing patients with an easy online mechanism to send you secure, HIPAA-compliant messages so that they are less likely to use their own insecure email systems.

Where can I put ePHI when sending an email?

When sending an email, you automatically include “identifiable” information: the recipient’s email address. Where can you put the “protected health information” so that the to-be-encrypted email is adequately secured and compliant? There are generally (and specifically with LuxSci and most email providers) only two places:

The message body
Any attachments

The content in the email message headers, including the Subject line, will not be encrypted (it will during transport only if TLS is used) and can be logged by various servers on the internet. Many of those logs are not likely to be HIPAA-compliant. Protected health information should thus never be present in the subject of email messages — always put it in the body.*

*LuxSci has a feature in its secure email where you can hide email subjects until the recipient actually comes to the LuxSci portal and opens the message. Until then the subject they see is just something like “You have received a secure message”. This feature allows medical information to be in the subject and protects you from the risk of such information being accidentally breached by being included in the subject when the subject could be delivered insecurely.

Where else can I put ePHI with LuxSci?

HIPAA-compliant LuxSci customers can also store ePHI:

In any App (e.g., calendar, address book, task list, blog, file storage, password storage, etc.)
In any hosted Database.
In Widgets (except custom ones that send data to 3rd parties).
In files on dedicated web/file servers.
In secue video sessions
In secure text messages

* On dedicated servers, the files do not have to be encrypted on disk, but these files should not be publicly accessible over the web, and any website should be designed with HIPAA compliance in mind.

Still have some questions? Contact us today.

Tags: business as, covered entity, email, ePHI, hipaa, omnibus, protected health information
Posted in LuxSci Library: HIPAA, Popular Posts
No comments »

Healthcare Marketing And HIPAA: Are You In Compliance?

Tuesday, January 14th, 2025

Healthcare marketing is essential to growing your business successfully, but when you work in regulated spaces, there are serious compliance considerations. Whether responding to an online patient review or trying to increase patient engagement through marketing campaigns, misunderstandings in marketing best practices can lead to patient privacy breaches.

The Health Insurance Portability and Accountability Act (HIPAA), which controls what and when patient information may be shared for marketing purposes, was enacted before the electronic age. As a result, it can be challenging to find information regarding appropriate marketing practices using modern social and software technologies.

HIPAA and Healthcare Marketing

A large part of HIPAA regulates what is appropriate for the use or disclosure of patient information. There are certain instances where the use and disclosure of protected health information (PHI) is allowed without patient consent. These instances include sharing PHI for treatment, payment, or healthcare operations.

However, before you can use patient information for marketing efforts, you need to receive explicit written consent from the patient. The consent form must be specific to the marketing efforts you will use the patient’s PHI in. For instance, if you would like to share patient testimonials, photos, or videos on your website or social media accounts, the patient must sign a consent form stating that you will use their information in this way.

HIPAA-compliant marketing also largely depends on an employee’s understanding of the law. Employees responsible for handling PHI must be trained to use and disclose PHI within the scope of their job role. Improperly trained employees can expose your practice to HIPAA violations and costly fines.

8 Common Misunderstandings of Marketing and HIPAA

1. As long as patient consent is obtained, HIPAA doesn’t matter
Some organizations think they can use any marketing tool with a signed patient consent form. Still, the tool has to be HIPAA-compliant. Even if patients agree, it does not remove the organization’s obligations to secure PHI under the law. If protected health information is improperly accessed, it is still a breach and can lead to severe financial and reputational consequences.

2. Marketing emails do not need encryption
Many marketing emails imply a relationship between patients and providers and, as such, can often be classified as protected health information. PHI must be encrypted in transit and at rest to comply with HIPAA.

3. Personalizing marketing emails is a HIPAA violation
Marketing emails can be personalized as long as the proper safeguards and precautions are in place to protect patient privacy and meet compliance requirements.

4. Marketing companies do not need to sign Business Associates Agreements
As of 2013, the HIPAA Omnibus rule expanded HIPAA obligations to include business associates and subcontractors. Marketing agencies and vendors that process PHI on behalf of a covered entity must comply with HIPAA regulations, which include signing a BAA.

5. The only way to protect PHI is to use patient portals
TLS encryption meets HIPAA transport encryption requirements and provides a better user experience. Marketing emails sent with TLS encryption are more likely to be opened than those sent to a patient portal.

6. Using BCC is enough to keep patient identities private
BCC is NOT enough to protect patient identities. Although the end recipient cannot tell who else received the message, the entire list is visible as the messages are transmitted from server to server. The messages can be eavesdropped on by someone with technical abilities.

7. Always respond to social media reviews
Be extremely careful when responding to online reviews. Publicly confirming information about a patient’s health or treatment status is a HIPAA violation.

8. Healthcare marketing isn’t necessary or worth the hassle
Healthcare consumerism is rising, and patients are willing to change providers if they are unsatisfied with their experience. Educating and informing current and potential patients about your services is essential to improve new customer acquisition and retention.

How to be HIPAA-Compliant

The most crucial step is vetting marketing vendors and HIPAA compliance tools. Any vendor that handles PHI on behalf of a healthcare entity needs to sign a Business Associate Agreement that outlines how patient data will be stored, transmitted, and disposed of. Don’t choose a vendor who is unfamiliar with HIPAA’s stringent requirements. Also, watch out for quasi-compliance. Some self-identified “HIPAA-compliant” vendors can protect data at rest but not in transmission or require patient waivers to achieve compliance.

Next, always use encryption and default to security. Identifying PHI is often tricky, and the legal burden should not fall on the marketing team. By selecting technology that encrypts every marketing email, you can rest assured that messages are secure and compliant. A bonus tip- do not send marketing messages to an encrypted patient portal. Instead, send marketing messages with TLS encryption directly to patients’ inboxes. You will see much higher response rates and engagement.

Finally, to create the most effective marketing campaigns, use PHI to create segmented audiences and send them personalized content. These tactics are widely used outside the healthcare industry because they deliver results. *Remember that any tool you put PHI into must be HIPAA-compliant.

How LuxSci Can Help

LuxSci’s Secure Marketing tool is an email marketing platform designed to meet HIPAA requirements. It allows marketing teams to segment audiences and personalizes emails to engage patients and improve marketing ROI. If you are already using a third-party email marketing platform, no worries, we got you covered. LuxSci’s Secure High Volume Email solution can integrate with any third-party platform to make sure those emails are also HIPAA-compliant.

Tags: business associate, business associate agreement, email encryption, email marketing, ePHI, healthcare marketing, mutual consent, patient consent, personalization, social media
Posted in HIPAA Marketing
Comments Off on Healthcare Marketing And HIPAA: Are You In Compliance?

HIPAA Compliance Checklist

Saturday, January 11th, 2025

Our HIPAA compliance checklist was designed to help organizations understand their obligations under the law. The checklist items are not a complete list, just a starting point for your compliance program. HIPAA requires a yearly risk analysis to identify new vulnerabilities. Any business process change or new technology usage introduces new risk into an organization’s security program, so it’s important to review the standards regularly.

Read the rest of this post »

Tags: addressable, compliant, encryption, ePHI, hipaa, hipaa checklist, hipaa compliance, hitech, omnibus, phi, protected health information, security
Posted in LuxSci Library: HIPAA
No comments »