What is HIPAA?
HIPAA (the Health Insurance Portability and Accountability Act) was amended in 2013 to include several stringent rules regarding the sharing of personal medical information via email. While it doesn’t prevent the use of emails, these rules make emailing covered information a process that requires forethought and lots of security.
The information that HIPAA covers is called protected health information (PHI). PHI includes demographic information, medical history, laboratory and other test results, insurance information and many other types of information that a healthcare professional collects as part of their job. HIPAA email security is essential for compliance.
The Specific Security Requirements of HIPAA
HIPAA addresses emails by covering access control, integrity controls, audit controls, transmission security, and ID authentication.
- Access controls – Policies and procedures must be developed that govern who has access to PHI in emails.
- Audit controls – The covered business must have electronic communications policies and technology in place to provide detailed audits of access and other activity of PHI.
- Integrity controls – There must be technologies and policies in place that ensure that PHI is not altered, particularly when it’s being transferred via email.
- Transmission security – Particularly pertaining to emails and messaging systems, there must be technology in place to prevent unauthorized access to PHI in transit.
The Protections that will meet HIPAA Standards for email security
HIPAA lays out strict guidelines for email security. Each of these items is required by law to protect the integrity of PHI that is being shared via email.
End-to-end encryption – Encryption must be shared by the sender and the recipient to ensure that all data remains encrypted in transit and cannot be read by an interceptor. This prevents loss of PHI or unauthorized access. Check out ContentCatcher Email Encryption
Archiving – In order to meet the guidelines of HIPAA’s auditing regulations, an organization must maintain an encrypted archive of all of its electronic correspondence. This archive must be easily searchable and must preserve all of the data and metadata of the emails. There must also be additional protection against unauthorized access to the archive.
Anti-spam and antivirus – Protections against spam, phishing, and malware must be a part of email security. Email filters, attachment “sandboxing” and scanning, dynamic URL scanning, and more should be in place. The purpose of all of this is to prevent unauthorized people from gaining access to the organization’s systems and email via malicious software. Check out ContentCatcher
Data Loss Prevention (DLP) – In reference to email correspondence, a DLP solution provides enhanced security via content filtering, permissions rules, authentication, and more. All of this should limit access both within the organization and outside of it. Check out ContentCatcher which offers DLP
The Power of the HIPAA Laws
HIPAA was designed to keep patients’ information safe from prying eyes and only visible to those persons who have a need to know. The guidelines are strict and the penalties are extremely high for any organization or person who violates those laws.
From education to encryption, following HIPAA laws is mandatory for anyone in the healthcare field.