What We Call “Quasi-HIPAA-Compliance”
Thursday, March 26th, 2020Are your organization’s service providers HIPAA compliant, or are they only quasi-HIPAA compliant?
What do we mean? Okay, we’ll be honest – quasi-HIPAA compliant isn’t an accepted term yet – but it should be.
When we talk about quasi-compliance, we’re referring to setups and services that look HIPAA-compliant and share some of the features; however, they may not be entirely in line with HIPAA requirements if you actually use them in the way that you want.
Quasi-HIPAA compliance is common, particularly in popular services. It can also be hazardous for businesses because quasi-HIPAA compliance can lead organizations into a false sense of security while they may be violating the regulations unwittingly, especially around HIPAA compliant email and HIPAA compliant email marketing.
What Is Quasi-HIPAA Compliance?
The best way to explain the concept of quasi-HIPAA compliance is through example. A quasi-HIPAA compliant service could come from an email-hosting provider, web hosting provider, or an organization that offers a range of other solutions.
If these providers are quasi-HIPAA compliant, they will include elements of HIPAA compliance. Still, the services may not be appropriately tailored to keep their clients within the lines of the regulations when used in various ways. A provider may be willing to sign a HIPAA business associates agreement (BAA) with your company, but its services may not include the appropriate protections for compliance.
As a good example: Google is willing to sign a BAA with customers using its Google Workspace service. However, Google does not actually provide HIPAA-compliant email encryption — so using Google Workspace email in a HIPAA context can immediately leave you in non-compliance and subject to breach. This is quasi-HIPAA compliance. You assume that by signing a BAA, you can use the services as you like and be “all set.” In truth, you need to understand what is allowed and what is not allowed. You need to either (a) avoid performing non-compliant actions or (b) add additional measures to fill those gaps.
Business Associates Agreements & Quasi-HIPAA Compliance
A BAA is essential for HIPAA compliance. Your company can’t be completely HIPAA-compliant if it uses the services of another entity without a BAA in place. It doesn’t matter if the entity’s services are technically HIPAA-compliant; you will fall afoul of the regulations unless a BAA exists between the two parties.
Even if you have a BAA with your provider, that alone may not be enough to keep your organization on the right side of HIPAA. The provider may not have the security measures your organization needs and instead have a carefully worded BAA that will leave you vulnerable.
Let’s say your email marketing service provider is a quasi-HIPAA compliant provider. It may not offer email encryption, or the necessary access control measures your organization needs to send ePHI and other sensitive information safely. The “HIPAA Compliance” may be limited only to data stored at rest on their servers. You may be stunned to learn that an email marketing company offering “HIPAA compliance” does not recommend sending any sensitive data over email!
The BAA offered by a company may be carefully worded to say that the service is technically HIPAA-compliant, but only if you don’t use it to send ePHI. This is legal, and the provider isn’t necessarily doing anything wrong by offering such a service, as long as this is clearly stated in the agreement. Without understanding clearly what is actually “covered,” you leave yourself at risk.
The compliance and breach danger comes when organizations use quasi-HIPAA compliant services without completely understanding them. If they don’t take the time to do their research or thoroughly read the agreement, they could use the service in a way that isn’t covered under the BAA.
Dangers of Quasi-HIPAA Compliance
In our example, an organization might subscribe to a quasi-HIPAA compliant service and use it to send ePHI. Suppose ePHI isn’t allowed to be sent via email or text under the BAA, and it’s sent without encryption and other security measures in place. In that case, the messages will violate HIPAA regulations.
This is an easy trap to fall into for several significant reasons.
- BAAs can be complex and need to be studied carefully.
- People make assumptions about what is covered by an organization’s “HIPAA compliance.”
- It’s very easy to send ePHI in an email accidentally. The definition of ePHI is broad, so employees can include ePHI in messages without even realizing it.
Even if your organization specifies that ePHI shouldn’t be sent through a particular service, all it takes is one mistake, and your company will have a costly HIPAA violation on its hands. Suppose your organization does use an email marketing service that’s only quasi-HIPAA compliant. In that case, the restrictions on ePHI will prevent your organization from being able to market effectively and communicate appropriately with its clients.
How Your Organization Can Avoid Quasi-HIPAA Compliance
The most important way to protect your organization is to do your research beforehand and ensure that any prospective provider will cover your intended uses. This means that you need to read through their BAAs to ensure that they align with your business’s requirements.
To save you some time, services like Google Workspace and the vast majority of email marketing services can be seen as quasi-HIPAA compliant. Only providers that specialize in HIPAA-compliant services will be able to deliver the solutions that healthcare organizations and those that process ePHI require.
If your company needs proper HIPAA compliance, then a provider like LuxSci is the best way to stay on the ride side of the regulations. We have been providing HIPAA-compliant secure email since 2005. Not only are our solutions tailored to abide by HIPAA, but we have also developed the services you need to conduct essential business tasks.
We provide HIPAA-compliant bulk email solutions for clients that need to send at scale. These services are set up over our secure infrastructure, and we provide dedicated servers for clients.
LuxSci focuses on both compliance and ease of use, so we have developed secure email hosting, email marketing, and transactional email solutions among our offerings. Our services help your organization comfortably market itself and conduct business while staying in line with HIPAA compliance.
