Physician Practice

Q&A: Does HIPAA allow us to email appointment reminders?

Physician Practice Insider, January 27, 2015

Q: What type of information can we email to patients? For example, is it permissible to email appointment reminders? I'm wondering what sort of PHI the email can include and what we should omit. Also, I am unsure whether to include the information in the body of the email or in an attachment.

A: CEs can send appointment reminders to patients via unencrypted email as long as the CE sending the reminder is not a specialty practice, such as a mental health practitioner, because that will reveal the condition of the patient if someone intercepts the email. Any PHI may be sent to the patient as long as the email is encrypted in the body of the email and as an attachment.

The Omnibus Rule specifically permitted healthcare providers to communicate with patients using unsecure email as long as the patient is made aware of the risks before an email containing PHI is sent. Meaningful Use Stage 2 takes security a step further and requires hospitals, critical access hospitals, and eligible healthcare professionals to implement secure email so the provider and the patient can communicate securely.

In the end, if PHI is included in an unencrypted email and the email is intercepted, it is a breach of unsecure PHI and may be reportable to the individual and OCR.

Editor’s note: This question was originally answered in the HCPro newsletter, Briefings on HIPAA.

Most Popular