Medical Records and the Law

500 CHAPTER 13: ELECTRONIC HEALTH RECORDSmodem-to-modem links; in-house routers, servers, and bulletinboards; commercial third-party host services; and the Internet. (For amore detailed description of security risks related to Internet e-mail,see the discussion of the Internet later in this chapter.) As people becomemore accustomed to the benefits of e-mail, they use this mediumto transmit a wide variety of sensitive information, including patientdata, large documents for research projects, budgets, and other confidentialtime-critical information. At many healthcare organizations,e-mail is used as a communication vehicle between patients and theircaregivers.The development of e-mail technologies (that is, modes of e-mailcommunication) has been occurring at such a rapid pace, however, thatat times the related implementation of technological safeguards haslagged behind. This raises confidentiality and security challenges forhealthcare facilities in relation to the transmission of patient healthcareinformation via e-mail. Organizations that are HIPAA covered entitiesmust comply with all the requirements of the Privacy and SecurityRules with respect to the transmission of PHI by e-mail. Others involvedin the healthcare industry will likely be subject to state laws governinghealth information privacy and security.Among other things, this will require healthcare facilities to providetheir staffs with training to ensure organization-wide recognition ofthe security risks associated with e-mail and compliance with applicableprivacy and security policies and procedures. All healthcare professionalsusing e-mail to transmit patient healthcare information shouldunderstand that e-mail affords individuals no more confidentiality thanwritten memoranda or letters—and, in the absence of adequate technologicalsafeguards, may in fact offer less privacy and security. Healthcareprofessionals who use e-mail must recognize the necessity ofexercising caution when transmitting patient information, and shouldbe trained concerning the importance and means of sending e-mailmessages that do not compromise the integrity of data, create the potentialfor a privacy or security breach, or contain inappropriate statementsthat could be misconstrued.Before outlining recommended safeguards that healthcare facilitiesmay want to consider in addressing e-mail security risks, it is worthbriefly noting relevant federal law (and corresponding state laws) enactedwith the legislative intent to provide enhanced protection for theprivacy of electronic communications. Title III of the Omnibus CrimeControl and Safe Streets Act of 1968, also known as the federal wire-