Pediatric Informatics: Computer Applications in Child Health (Health ...

23 Electronic Mail in Pediatric Practice 313
23.2.3 Breaches of Security and Privacy
The Health Insurance Portability and Accountability Act (HIPAA) sets federal
requirements for privacy and security of protected health information (PHI). Though
this legislation primarily deals with electronic data transmission and interchange of
billing information, it also addresses all electronic health care communications,
including e-mail communications.
HIPAA does not prohibit e-mail communications between physicians and
patients or between physicians but recognizes that e-mail (and any health information
technology) presents risks to privacy and that anyone using e-mail needs
to (a) identify risks to the unauthorized access to personal health information and
(b) adopt policies and procedures to mitigate those risks. HIPAA also requires that
office policies, as they relate to its use of medical information be made known to
patients and made available in the practice’s Information Privacy Notice.
Practice policies
The HIPAA Security Rule specifies that practices (and other “covered entities”)
must use physical, technical, and administrative safeguards with PHI. The HIPAA
Privacy Rule specifies that safeguards must include auditing and disclosure procedures
(for breaches). For e-mail, this includes, but is not limited to:
Limited physical and password-protected access to practice computer systems
(including e-mail)
Use of secure e-mail (either secure messaging or private service) with backup systems
Policies to remove access for employees who no longer work for the practice
E-mail practices
Patients and families themselves may be the greatest threat to their e-mail privacy.
Poor e-mail practices (by patients and/or practices) that may put privacy at risk
include:
Leaving computers unattended while logged into e-mail or leaving screens or
printed messages open and accessible to others; not destroying discarded messages
appropriately (shredding documents, emptying “Trash” or “Recycle” bins)
Sharing e-mail accounts or passwords with others (or using poor password security)
Handling messages inappropriately: forwarding e-mail messages to others,
sending replies to a group of recipients (“reply to all”)
23.3 Issues in Physician–Physician and Physician–Staff
Electronic Communication
23.3.1 Technical Issues
Secure e-mail communications between physicians (for patient-related matters)
may be provided by a shared private network, provided by a common hospital, IPA,