There are two ways of sending patient PHI as safely as possible.

FIRST: Sending the PHI through the email as a password protected attachment.

·         Get written permission from the patient to send their bills via email.

·         Save file to a .pdf format.

·         Password Protect the .pdf with a password that is known by both parties. Example: last four digits of their social security number etc.

·         State in the email to use the last four digits of their ss# to open the email. The email itself should be very generic.

·         Attach the file to an email – individually

Second: Set up PGP software installed on your secure website. This is the BEST way. You would email your patient with a link to your view their bill. The patient would have to set up their own user name and password. They could then login and print or save a copy of their bill in .pdf format.  

The answer is YES.  To be sure that I was answering this correctly I called the Office of Civil Rights to see what they say.  “All complaints are investigated.  If we receive a complaint on a doctor that is not a covered entity the doctor will have to respond to the letter documenting why they are not required to be compliant.  But they must respond to the letter.

Read this.  It will give you an idea of how to start and maintain a risk analysis which is required by HIPAA Security.

https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html

Everything you need to know is available at Health and Human Resources website.  https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html