So – you’ve just been told that your email marketing program is putting your company at risk of violating HIPAA.
Ok. What now?
If you want to continue your email-based patient engagement efforts – without the risk of the financial, operational, and reputational risk that accompanies the exposure of sensitive patient data, you must implement HIPAA compliant email marketing practices.
This is comprised of two components: becoming HIPAA-compliant, setting up the required systems and procedures to ensure your PHI (PHI) and EPHI (EPHI) are protected, and your marketing objectives, who you want to reach and what to communicate.
However, you don’t have to let your marketing objectives suffer for the sake of security.
Implementing a HIPAA-compliant marketing program can actually help you achieve better marketing results.
Asking yourself these 12 questions ensures your email marketing campaigns align with your business goals and are HIPAA-compliant.
———
HIPAA-Compliant Marketing Emails
1. Do you have security controls to protect access to your email marketing system?
2. Do you have a documented procedure to guide you HIPAA-compliant email marketing?
3. Can you send encrypted emails?
4. Do you have a complete understanding of your organization’s PHI and ePHI?
5. Do you have a required training process for anyone sending HIPAA-compliant marketing emails?
6. Do you have effective protection against malware?
7. Do you have valid Business Associate Agreements (BAA) in place?
8. Why am I sending this email?
9. Is my email’s subject line standing out?
10. What is the recipient’s brand and product awareness level?
11. Have I tested my message for readability?
12. Have I sent my message to a test email account?
HIPAA-Compliant Marketing Emails
If your organization requires HIPAA-compliant email, start by using these questions to inspect your email marketing for compliance. Note that while we can’t provide legal advice, the below questions will help you identify some of the most common points of vulnerability and non-compliance.
1. Do you have security controls to protect access to your email marketing system?
Email security is an essential component of being HIPAA-compliant. As a starting point, check your internal security processes for access restrictions. This includes:
- A robust password policy, i.e., changed frequently (e.g., 30 days), has to contain a mixture of characters, etc.
- Multi-factor authentication (MFA), i.e., users verifying their identity in multiple ways, e.g., username/password and sent number codes (text, email, key fob, etc.), biometrics, etc.
- Role-based access controls, i.e., granting access to individuals based on the responsibilities of their job role.
- Zero Trust Architecture (ZTA), i.e., “never trust, always verify” – where users are required to reconfirm their identity on a case-by-case basis, as opposed to once when logging on, which mitigates session hijacking and similar threats.
2. Do you have a documented procedure to guide you HIPAA-compliant email marketing?
“Winging it” simply doesn’t cut it when it comes to HIPAA-compliant email marketing; you must develop a comprehensive documented process detailing how you intend to safeguard PHI throughout your email marketing campaigns.
This should include:
- Specifying the HIPAA-compliant email delivery service you’ll use to execute your marketing campaigns
- The processes and controls you’ll use to encrypt data for ePHI at rest and in transit
- The access and authentication controls you have in place
- How you’ll implement data minimization: only using the minimum necessary PHI in communications – and not including sensitive PHI unless it’s essential.
- How you’ll securely dispose of data: Implement a process for securely deleting emails containing ePHI once they’re no longer needed, to comply with retention policies.
- Staff training: educating employees involved in email marketing on how to securely handle PHI and other HIPAA requirements.
- Incident response plan, i.e., an additional documented plan for how you’ll respond to data breaches and other cyber attacks; this also includes notifying any affected parties as mandated by HIPAA.
If you’re starting from scratch, the information contained in the answers to the questions in this article provides a useful starting point for creating your first procedure.
3. Can you send encrypted emails?
If you are sending highly sensitive data or PHI in your emails, be aware that HIPAA requires the data to be encrypted a rest, i.e., the storage medium where it resides, and in transit, when being sent to recipients.
To the surprise of many healthcare organizations, most major email marketing providers, such as Mailchimp and Constant Contact are unable to provide encryption for data in transit and only protect data in their systems. To avoid falling foul of HIPAA regulations, ensure that the email delivery platform you use to transmit messages containing PHI offers end-to-end encryption.
4. Do you have a complete understanding of your organization’s PHI and ePHI?
Much of the time, when we, as well as healthcare providers, talk about PHI, we’re actually referring to electronic protected health information (EPHI). While PHI is a catch-all term to account for all sensitive health information, in truth, in the digital age, the vast majority is stored electronically in data centers – and the patient data handled is EPHI.
You can discover “PHI” and “ePHI” within the context of your organization’s context by identifying and categorizing the PHI and ePHI typically handled in your business. It’s an absolutely crucial tenet of data protection that you simply can’t protect what you’re not aware of.
Comprehensive PHI categorization will help your staff navigate HIPAA-compliant email requirements.
5. Do you have a required training process in place for anyone sending HIPAA-compliant marketing emails?
Your HIPAA compliance program, as with your company’s overall cybersecurity posture, is only as strong as your weakest link. In light of this, it’s essential to educate the staff within your company who are involved in your healthcare engagement campaigns on the secure use of ePHI and HIPAA-compliant marketing practices.
Additionally, this needs to be reflected in your onboarding process, so new hires are made familiar with HIPAA regulations, should their role require it.
6. Do you have effective protection against malware?
In the unlikely event you need any further encouragement to revisit your company’s anti-malware (viruses, ransomware, Trojans, etc.) measures, there are always HIPAA compliance requirements!
To better protect your sensitive customer data against a slew of increasingly sophisticated cyber threats, start with these three key considerations:
- Do you have anti-malware protection running on all of your organization’s devices? Additionally, does this extend to your employee’s personal devices on which they handle PHI?
- How frequently do you update your anti-malware solution?
- Does your email marketing provider have sufficient protection malware mitigation measures in place, as per HIPAA requirements?
7. Do you have valid Business Associate Agreements (BAA) in place?
It’s normal to outsource activities like email marketing to a third party, but for the service they provide to be HIPAA-compliant, you must have a business associate agreement (BAA) in place.
A BAA documents how two organizations will share PHI and under what circumstances. A BAA also details the legal responsibilities of each party in the event of a serious issue. With a BAA being a core component of HIPAA compliance, failure to have one in place with your email service provider is an immediate HIPAA violation – and one that can result in serious consequences for a healthcare company.
Getting Better Results from HIPAA-Compliant Email Marketing
Now that you’ve confirmed your systems are HIPAA-compliant, let’s move on to making sure your email marketing strategy aligns with your overall business objectives.
In pursuit of this, the following questions serve as a handy “monthly review” for refining the effectiveness of your email-based patient outreach efforts .
8. Why am I sending this email?
First and foremost, for the best results, each email you send should have a single, clearly defined purpose.
I know what you’re thinking – “my customers and patients are smart, they can handle multiple points in a single message.” And while that’s true, at whatever point your email reaches a recipient, they’re already juggling several different priorities at once. While they’re capable of juggling multiple points in a message – they’re unlikely to want to; when it comes to email marketing, a single goal is the best way to go.
Similarly, it’s important to remember that your email is one of dozens – or hundreds – received by your patient that day. So, if your message is long and overly complicated, the reader will likely skip over or delete it.
9. Is my email’s subject line standing out?
Following on the above point, is your email subject line impactful enough to stand out amidst the pile of messages that will land in the patient’s inbox that day? The email subject line is the most important part of your email because it’s responsible for persuading the reader to open your message.
Despite this, many marketers still use terrible, ineffective subject lines and wonder why their emails are failing to produce results!
For the best results, write up three to ten subject lines for your next email, step away for 5-10 minutes, and then choose the headline you determine as best.
Consider these examples to check your understanding:
Ineffective Email Subject Lines
- Blank (no subject): writing nothing in the subject line
- Clinic Newsletter (tell them more, e.g., the subject or theme for the month)
- Overusing exclamation marks!!!
Effective Email Subject Lines (examples based on a dental practice)
- BRAND-NEW Dental Product Released Today
- How to Cut Down on Your Health Insurance Paperwork
- [Case Study] How We Helped 3 Ex-Smokers Get White Teeth
10. What is the recipient’s brand and product awareness level?
Whether promoting medical devices, new digital solutions technology, or any healthcare product or service, understanding the prospect’s awareness level is essential.
If your email is designed to introduce a brand-new product, stick to high-level features and benefits while avoiding technical jargon and granular product details. Conversely, if you’re writing an email to experienced, highly knowledgeable readers, going into greater depth makes sense.
Advanced list management and segmentation tools, as offered by Luxsci Secure Marketing, are key for ensuring the communications you send match the reader’s awareness level.
11. Have I tested my message for readability?
Do you know one of the reasons that Hemingway was popular? He was skilled at writing short phrases and phrases. Consequently, his writing was easy to understand and appealed to a wide variety of people. When in doubt, keep your writing short and free of jargon, abbreviations and “insider” terms.
When you’re deeply involved in the details of your business, it’s so easy to overlook just how much specialized jargon and language you frequently use. However, if you want your communications to engage with patients and customers, they need to be as accessible as possible.
Fortunately, there are simple solutions to this, with tools like the Text Readability Calculator that are designed to quickly enhance the readability of your emails.
12. Have I sent my message to a test email account?
Finally, if you’ve followed all of the above advice, you’re almost ready to hit SEND…there’s just one more thing you need to check.
Determine how your email will look to recipients, including its clarity, and readability by simply sending a test email to one of your own email accounts once it is received.
In particular, pay attention to how the subject line looks and test all the links in the email to ensure they take the reader through to the intended destination, such as a product or service page. A broken link will only frustrate the recipient – who was interested enough to click through, no less – and lower your conversion rate.
Better still, send the test email to a colleague somebody and ask for their opinion about the quality of the message and whether it creates the desired impression.
Demystifying HIPAA-Compliant Email Marketing
As the most experienced HIPAA-compliant email provider, LuxSci specializes in providing secure and HIPAA-compliant solutions for companies aiming to send hundreds of thousands – or millions – of emails. Our hypersegmentation tools allow you to precisely target an unlimited number of patient sub-populations to maximize the efficacy of your messaging.
Are you interested in discovering how LuxSci’s secure email marketing platform will streamline your healthcare engagement efforts?
Contact us to learn more about our products and pricing.
SSL and TLS play critical roles in securing data transmission over the internet, and AES-256 is integral in their most secure configurations. The original standard was known as Secure Sockets Layer (SSL). Although it was replaced by Transport Layer Security (TLS), many in the industry still refer to TLS by its predecessor’s acronym. While TLS can be relied on for securing information at a high level—such as US Government TOP SECRET data—improper or outdated implementations of the standard may not provide much security.