HIPAA Email Compliance
Protected Health Information (PHI) deserves more than a password. Here's what HIPAA and the HITECH Act actually require for email, and exactly how MDOfficeMail meets every one of those requirements.
Protected Health Information (PHI)
What HIPAA actually protects, in plain terms.
HIPAA defines PHI as the health information of an individual that identifies the individual, or for which there is a reasonable basis to believe it can be used to identify the individual. Individually identifiable health information includes many common identifiers such as name, address, birth date, social security number, etc.
Individually identifiable health information relates to the past, present, or future information regarding:
- Physical or mental health or condition of the individual,
- Provision of healthcare to the individual, or
- Payment for the provision of healthcare to the individual.
For more information, please visit hhs.gov – Summary of the HIPAA Privacy Rule.
HITECH Technical Safeguards
The main technical safeguards HIPAA HITECH legislation requires for email.
Business Associate Agreement
A BAA has to be signed by the service provider and the covered entity.
Access Control
This includes Unique User Identification, Two-Factor Authentication (2FA), Emergency Access Control, Automatic Logoff, and Encryption and Decryption.
Audit Controls
To track user access and file access.
Person or Entity Authentication
Transmission Security
Including Integrity Controls and Encryption.
Device and Media Controls
Including data backup, data storage, and data disposal.
How MDOfficeMail Is HIPAA Compliant
MDOfficeMail is HIPAA compliant by virtue of the following features.
HIPAA Business Associate Agreement
A HIPAA Business Associate Agreement is signed with clients.
SSL connection strictly enforced
SSL connection is strictly enforced for all services, both at the sender's and recipient's end. This cannot be modified even by the Account Administrators.
Encryption strictly enforced
Encryption is strictly enforced for all outbound messages unless the user manually over-rides it.
SSL required to view messages
Messages can be viewed or downloaded only by establishing an SSL connection.
Secure replies, no account needed
Recipients can reply securely without having a secure email account.
Facility to validate new recipient
A new recipient needs to enter a 6-digit code to access email received. This randomly generated, recipient-specific code can be provided only by the sender.
Password strength enforced
Minimum password length and complexity is enforced.
Automatic Webmail session timeout
Automatic Webmail session timeout is enforced.
Force-expire sent messages
Encrypted emails sent can be force expired at any time.
Automatic deletion
Encrypted emails sent will automatically get deleted after a fixed time.
MDVault session timeout
Automatic session timeout is enforced for the message viewing page of MDVault.
Legal archiving, up to 7 years
All emails are archived remotely for a specified length of time, up to 7 years. These emails cannot be edited or deleted. As long as the user is active, archived messages can be viewed and downloaded.
Emergency Access Procedure
PHI in email communications can be accessed from any location via the internet. There are also mechanisms for authorized administrators to access account data.
Audit Controls
Audit reports of all logins to WebMail, POP, IMAP, and SMTP services are available to administrators. Reports include the date, time, and the IP address from which logins were made.
Frequently Asked Questions
A few more details worth knowing.
See how MDOfficeMail keeps your practice HIPAA compliant
Sign a Business Associate Agreement, get encrypted email by default, and give your patients' information the protection it needs.
See Pricing & Signup