Take the 2-minute tour ×
Healthcare IT Stack Exchange is a question and answer site for healthcare IT professionals and solution providers. It's 100% free, no registration required.

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not asking a "should" question here. I know patient-doctor communications should be encrypted. I know that the meaningful use requirements now in draft reward for Direct Project based communications.

What want to know is, definitively, can healthcare providers have patients sign waivers that allow the doctors to legally email in plain text with them? People seem to read the different HIPAA-HITECH act regulations very differently. Vendors of secure products always say that secure email is legally required. Yet I know several healthcare providers who communicate PHI using plain-text email with their patients, by having their patients sign something that says that the patient understands the issues with plain text email and still considers it "protected" under HIPAA.

So there at least some people who argue that it is illegal (vendors) and some who argue that it is legal and actively send plain text emails.

I am not asking this because I do not have an opinion on this myself. I am asking for someone to make an assertion regarding this issue, and back it up with quotes and corresponding links to the various sections of the laws and federal rules in question. Obviously all of the relevant national level rules and laws should be referenced in an accepted answer.

Because this can be a bit of work, I am putting a bounty on this one.

share
    
    
A great question. Look forward to any answers. However, I have to state my prediction that you could put a 'real' bounty out to lawyers who could give you a winning case either direction. I doubt there is enough concrete print legislation to definitively state an answer. Honestly, though, GREAT question (as I believe vendors over-hype their over-engineered solution offerings) –  Wayne Heilala Apr 9 '12 at 22:20
comments disabled on deleted / locked posts

migrated to security.stackexchange.com by jonsca Apr 30 '12 at 22:46

This question belongs on our site for Information security professionals.