HIPAA and Email - How Does Your Practice Deal with Compliance in a Digital Age?

The internet has created a new business modelClient information gathered by [Clinic or
for the smaller medical practice, specialty clinic andOrganization's Name] is protected by Federal Law.
medical service (e.g. dermatologist, plastic surgeon,If this communication contains any client
physical therapist, psychologist, et. al). More andinformation, including information which would
more, patients are looking to communicate withidentify a client, you are prohibited from
their healthcare providers as they do in theirredisclosing it to any person or organization in any
personal and business lives – via email.manner, and you are required to maintain it as
Email as a communication solution for the smallerconfidential. Failure to do so is punishable by civil
clinic can be a time-saving resource. It can replaceand criminal penalties. If such information has
the many phone calls and postal mailings, adding areached you in error, please contact [Clinic or
financial benefit to the smaller clinic.Organization's Name] With the advent of phishing,
Does email eliminate the office visit? No, nothingmalware, and spyware, the unintended recipient
can replace the personal face-to-face office visit,could possibly spread a patients PHI like a virus;
but email can be an additional tool clinicians canusing or selling data to any number of damaging
implement to streamline their practice.sites.
Some healthcare practitioners do however feelProtecting a patient's PHI is an ingrained concept
that emailing their patients equates to working forwithin the medical profession. Laws and
free, but some clinics have already adoptedgovernment mandates are take this notion a step
charging for email consultations.further, medical facilities not compliant to
At some practices, patients pay a flat rate fromprotecting their patient’s PHI face stiff
$100 to several hundred dollars per year for thispenalties under HIPAA. PHI includes and is not
type of service. Harvard professor of medicinelimited to:
Dr. Daniel Z. Sands, a proponent to a digital clinic,- Patient's address, phone number
stated "I think it’s reasonable to assume- Treating Hospital/Clinic number assigned the
that if lawyers and accountants charge for time,patient
then physicians should too. (1)"- Patient's date of birth/ SSN
Sustainability of Health Information Technology is- Patients legal next of kin/guardian and their
also on the government's radar. As part of thetelephone number
President's mandate to move the medical field- Patient's insurance information (pre-certification/
towards a digital clinical setting within the next tenDSHS/ Medicare)
years (2). The National Coordinator for Health IT,- Anticipated Admission date and time
Dr. David Brailer, noted the value-added benefit ofWhile there are some drawbacks to email,
investing in Healthcare IT:patients want the option of emailing their doctor,
Information technology supports treatmentpharmacist, therapist or clinic. "People are often
choices for consumers and enables better andmore comfortable talking to a computer than
more cost-effective care... Health IT not only addsthey are to a doctor," said Dr. Delbanco, a
value to the way people lead their lives, but itprofessor of medicine at the Harvard Medical
gets more out of our investment in healthcareSchool and the lead author of an article on
overall. (3)doctors and e-mail in the New England Journal of
It is possible for clinics to shift towards a digitalMedicine (6).
medical office while remaining financially solid.Dealing with HIPAA compliance issues can often
Rights management software tools have becomebe frustrating to the small clinical practice. SBRM
a reality for the small and medium business officesolutions bridge the gap between staying current
(4). Small Business Rights Management (SBRM)with healthcare industry regulations and keeping a
reflects a shift Rights Management softwaresmall physician practice open. Patient/client
tools.information, private communiqué regarding
SBRM solutions provide clinics and practices of adiagnosis/treatment, and medical billing can stay
smaller scale an equal level of user rightsdiscreet, only the intended recipient will see this
management and encryption previously availableinformation.
to larger medical organizations (e.g. state hospitals,With SBRM solutions; clinics don't have to worry
large research facilities, university medicalthat their email content breaks the Hippocratic
networks, etc.).Oath's creed of confidentiality by revealing
With any medical advance, the side affects of apatient's PHI. Healthcare providers can remain both
solution or cure, must also be considered. Whilerespectful and compliant under HIPAA regarding
email is beneficial time-wise and financially, therethe patient privacy.
are also cons to using this tool – manyEnd Notes:
HIPAA related. According to the Health Privacy1.) Dr. Daniel Z. Sands as quoted in Liz Kowalczyk's
Project's 2005 study, 70% of Americans arearticle "Is E-Mailing the Future of Doctor-Patient
concerned that personal health information (PHI)Relations?" The Boston Globe, D2, April 27, 2004,
could be disclosed as a result of weak dataLexis Nexus –
security (5)2.) United States Department of Health and
Currently, healthcare organizations are required toHuman Services, "Secretary Leavitt Takes New
provide a disclosure statement whenSteps to Advance Health IT," Press Release on
communication is sent to their patients. A sampleHHS website, June 6, 2005,
of a healthcare professional’s email3.
disclosure statement may read like this: