Under HIPAA, can we e-mail patient information outside of our health care organization?
It depends on what you are e-mailing and for what purpose. Under HIPAA privacy you are not permitted to send out information for marketing purposes. Moreover, the HIPAA rule on security does not prohibit the use of e-mail. It is covered under the section, of “Data in transit,” which specifies the use of encryption and access controls. According to the final Security Rule, published in February 2003, encryption of e-mail is an addressable standard, rather than a requirement. Refer to the earlier guidelines published by the Centers for Medicare and Medicaid Services (CMS), formerly HCFA, on Internet Security Policy (http://www.cms.hhs.gov). Before sending e-mail, providers should consider the nature of the information being sent, the purpose for sending it, and whether it is necessary to use the Internet to transmit the information. Because the Internet is an “open” network, information can be intercepted by the wrong party if the proper precautions aren’t taken.
