If you are looking for a HIPAA compliant email solution for your business make sure you understand the pitfalls. There is certainly no shortage of HIPAA compliant email solutions on the market today. I’ve seen ads for systems that fall into the freeware category all the way to full MS Exchange mailbox integration. Cloud based computing is making hosted solution more popular than ever. These solutions tend to be easier to roll out and less expensive and less complicated for small and medium sized companies. If easy is what you are looking for secure email may work for you, but if security is your priority you may want to look elsewhere.
Many encrypted secure email solutions suffer from a very simple flaw that can cause your business great harm with a single misspelling. That is correct; a single misspelling has the potential to cause a data breech that you would be obligated by law to report. Ironically the word that could cause all this trouble is “secure”. How could this happen you say? It is very simple, let me explain. In an effort to make the process of sending secure email easy for the user base many popular HIPAA Compliant email systems rely on the end user to enter the subject as “secure” which triggers the email route through an encryption path rather than the regular unsecure email pathways. What if a secretary, or doctor, or clerical office worker misspells the subject or simply forgets to use the subject trigger word? The email goes out unprotected without any security to any/all recipients. If that unsecure contained PHI you just created a data breech that you are obligated by law to report.
Most employees use email every day for a variety of business related tasks that do not involve patient data or PHI in any form. They understand email is not secure and never to use it as such. In my option, adding a feature that provides the necessary security to the email, then leaving the possible data breech in the hands of the end user by way of a typo, is a recipe for disaster. Site to site VPN, file level encryption, SSL, and even the good old fax machine are better options.