Feb 08, 2023 Doctors, nurses, or employees who use Gmail to share sensitive data are more likely than others to have their sensitive data compromised. To protect your business from being non-compliant with federal HIPAA (Health Insurance Portability and Accountability Act) law, you need to have a proper plan in place.

It is not a HIPAA violation to email medical records provided the communication is permitted by the Privacy Rule, that safeguards are in place to comply with the Security Rule, and – if emailing medical records to a patient – that the patient has consented to receiving ePHI by email.

HIPAA compliance demands that therapists must check and double check the address to which they send an email each and every time. Some clients may copy other people, such as parents or partners, on emails to therapists. Never hit “reply all” unless the client has specifically asked that you do otherwise.

Essentially, any personal data that is connected to an individual's health condition automatically becomes PHI. This means that a patient's email address could be considered PHI if it is linked to a health condition or treatment.

Sending PHI via unencrypted email does not violate HIPAA, but Covered Entities and Business Associates must take reasonable steps to ensure the patient understands and acknowledges the risk of unsecured email transmission.

Patient emails ing to the HHS, the healthcare provider can assume (unless the patient has explicitly stated otherwise) that email communications are acceptable to the individual. Providers should assume the patient is not aware of the possible risks of using unencrypted email.

Four steps to send HIPAA compliant emails Secure patient information in transit and at rest. ... Enter into a Business associate agreement. ... Set up policies and procedures. ... Train your staff on secure email best practices.