Can You Send Medical Records by Email?
You can send medical records by email provided the reason for sending medical records is permitted or required by the HIPAA Privacy Rule, and provided the service used to send medical records by email supports compliance with the HIPAA Security Rule. However, exceptions may apply depending on the circumstances.
Because medical records contain individually identifiable health information that is considered Protected Health Information (PHI) under HIPAA, members of a covered entity’s or business associate’s workforce can only send medical records by email when the reason for sending medical records by any means is permitted or required by the HIPAA Privacy Rule.
Permitted reasons include uses and disclosures of PHI for treatment, payment, and healthcare operations, for public health activities, to employers (for purposes permitted by §164.512(b)), to report child abuse, elder neglect, or domestic violence, for law enforcement purposes, and for judicial or administrative proceedings. (Note: Some disclosures are “required” in some states).
Required reasons include when a patient’s medical records are required by the Department of Health and Human Services (HHS), and when a patient exercises their HIPPA rights to access their medical records and/or transfer them to a different provider. It may also be required to return medical records by email when a Business Associate Agreement is terminated.
The Minimum Necessary Standard and Privacy Protections
When sending a medical record by email for a permitted reason, it is important to be aware of the minimum necessary standard, any privacy protections that apply, and whether an attestation is necessary. The minimum necessary standard stipulates that uses and disclosures of PHI must be limited to the minimum necessary to achieve the purpose of the use or disclosure unless:
- A disclosure is to a healthcare provider for treatment purposes.
- A disclosure of more than the minimum necessary PHI is authorized by the patient.
- A disclosure is required by a law or regulation that pre-empts HIPAA.
Privacy protections can apply when a patient has requested that some or all of their PHI is withheld, or withheld from certain parties. Examples of when this exception may apply include when a patient does not want their health plan to know about a treatment they have paid for privately, or does not want friends or family members to know about a health condition.
Some disclosures of PHI for law enforcement purposes, for health oversight activities, or for judicial or administrative proceedings may need to be supported by an attestation that medical records sent by email will not be further disclosed to conduct an investigation into a person seeking, obtaining, providing, or facilitating reproductive healthcare (see §164.509).
How to Send Medical Records by Email Securely
The second requirement to send medical records by email is that the email service used supports HIPAA compliance (except when exceptions apply – see below). This means the email server must be hosted in a secure environment, and the email service must have capabilities to support compliance with applicable Administrative, Physical, and Technical Safeguards.
In many cases, covered entities and business associates subcontract their email services to a HIPAA compliant email provider. The HIPAA compliant email service provider manages the secure environment, shares responsibility for compliance with applicable Safeguards, and provides assurances for the confidentiality, integrity, and availability of PHI contained in the content of emails via a Business Associate Agreement.
In such cases, covered entities and business associates are still required to configure the email service to support HIPAA compliance, implement access and audit controls, and train members of the workforce on how to send medical records by email securely. It will also be necessary to train members of the workforce on how to identify threats to the security of email accounts and data, and how to report a suspected security incident or other HIPAA violation.
Exceptions to the HIPAA Security Rule Requirements
Exceptions to the HIPAA Security Rule requirements for sending medical records by email exist when a patient authorizes sending medical records via a non-compliant email service, when a patient requests confidential communications via a non-compliant email service, or when HHS’ Office for Civil Rights exercises enforcement discretion for medical records sent by email.
All three exceptions are rare because they would only occur if a covered entity or business associate did not have a HIPAA compliant email service through which to send medical records by email. Furthermore, in the first two exceptions, organizations would likely be able to offer alternative methods of transmission if it is not possible to send medical records by email securely.
Nonetheless, it is important covered entities, business associates, and workforce members are aware these exceptions may apply in addition to the exceptions discussed above with regards to the minimum necessary standard, privacy protections, and attestations. Covered entities and business associates unsure of when you can – and when you can’t – send medical records by email are advised to seek independent HIPAA compliance advice.
