What is a HIPAA Email Disclaimer?
A HIPAA email disclaimer is a section of text located at the end of an email that informs recipients that the email includes Protected Health Information (PHI) and advises them what to do if they receive the email in error. There are circumstances in which the addition of a disclaimer can be beneficial, but it does not absolve the sender of a HIPAA violation.
Around 8% of all data breaches notified to HHS’ Office for Civil Rights each year are attributable to misdeliveries. It is not known how many are misdeliveries through the mail and how many are misdeliveries by email, but it is known that in 2022 (the most recent year for which data are available) HHS’ Office for Civil Rights received 64,592 data breach notifications.
An equal split of mail/email misdeliveries implies around 2,600 data breach events each year are attributable to emails being sent to the wrong recipients. To clarify, this does not mean 2,600 recipients received emails containing other people’s PHI. Some bulk misdeliveries of email can impact tens of thousands of patients or – in this case – plan members.
What Does a HIPAA Email Disclaimer Do?
Depending on how a HIPAA email disclaimer is phrased, the “disclaimer” section of text at the end of an email generally states that the content of the email contains confidential health information that is protected by law and is intended for the sole use of the individual to whom the email is addressed. The disclaimer should also include instructions on what to do if the recipient has received the email in error – report the error by phone and delete the email.
What a HIPAA email disclaimer does not do is “disclaim” the sender of the email from the responsibility of disclosing PHI impermissibly without authorization. Some sources suggest a HIPAA email disclaimer should include instructions not to further disclose the content of a misdelivered email; but, as the recipient is unlikely to qualify as a HIPAA covered entity, the sender of the misdelivered email is not in a position to make any demands on the recipient.
Is Adding a HIPAA Email Signature Beneficial?
Adding a HIPAA email signature can be worthwhile for two reasons. The first is that, if a person receives a misdelivered email and follows the instructions on what to do, the sender of the email will find out sooner rather than later about the impermissible disclosure. This will help better mitigate the consequences – especially if the email is one of tens of thousands that may have been misdelivered, or exposes PHI of multiple individuals to multiple recipients.
The second reason adding a HIPAA emails signature may be worthwhile is that it can reassure intended recipients that the sending organization is complying with its HIPAA responsibilities. While disclaimers of this nature have no legal standing, the perception of compliance can lead to patients having more trust in their healthcare providers and sharing more information with their healthcare providers – resulting in more accurate diagnoses and treatment plans.
Why Disclaimers Should be Phrased with Care
There are some absolutely dreadful examples of HIPAA email disclaimers on the Internet – some suggesting that the sender could take legal action if the email is forwarded or its content used without permission, while others advocate the misdelivered email should be returned to the sender – potentially further exposing PHI to unauthorized access via ISPs’ servers if the recipient of the misdelivered email does not encrypt outbound emails.
As the objective of a HIPAA email disclaimer is to find out as quickly as possible that an email has been misdelivered and to ensure the misdelivered email is deleted from the recipient’s email account, it is advisable to phrase disclaimers with care and use “please” and “thankyou” in the disclaimer, rather than threatening legal action. HIPAA covered entities and business associates who want to add a HIPAA email disclaimer to the end of outbound emails are advised to seek professional legal and compliance advice regarding the content of the disclaimer.
