Professionals have been discussing the need for secure, HIPAA compliant email for years, and especially since so many mental health professionals use email with clients and patients. A 2009 study by the American Psychological Association showed that 9.8% of psychologists polled reported using email for clinical purposes with clients (Jacobsen & Kohout).
In our newsletter, we’ve talked about Hushmail and other popular vendors who offer secured email platforms.
Outlined in the HIPAA Omnibus Rule, just published in January (see our HIPAA’s Final but Sweeping Changes to Privacy and Security Rules), there is increased liability for practitioners as well as vendors. As a result, there is a heightened attention on how we as professionals can hold email vendors more accountable for their claims of HIPAA compliance, or lack thereof.
Here is a list of important questions for us to ask vendors about HIPAA compliant email, generated by a group called Health BI:
- Where exactly will messages and documents reside?
- Explain the data center setup.
- Explain the data security infrastructure.
- What kind of encryption is used?
- What kind of auditing capabilities are provided?
- Explain system redundancy and availability strategy?
- Provide HIPAA compliancy documentations.
- Explain how customers are protected against mishandling of data by recipients of messages
- How much experience does the vendor have in developing solutions for healthcare?
Please feel free to comment in our blog below.
Jacobsen, T. & Kohout, J. (2010). 2008 APA Survey of Psychology Health Service Providers: Telepsychology, Medication and Collaboration. APA Center for Workforce Studies.