Does an Email Subject Line have to be HIPAA Compliant?
An email subject line has to be HIPAA compliant if an email containing Protected Health Information is sent by or on behalf of a HIPAA covered entity for a purpose permitted by the HIPAA Privacy Rule via an email service that meets the requirements of the HIPAA Security Rule – when applicable – unless an exception applies.
The question does an email subject line have to be HIPAA compliant may appear a little unusual inasmuch as, if an email containing Protected Health Information is sent for or on behalf of a HIPAA covered entity for a purpose permitted by the HIPAA Privacy Rule, all the components of the email have to be HIPAA compliant unless an exception applies.
However, the reason this question gets asked is that email subject lines are not usually encrypted when the body of an email is encrypted. This is because email subject lines form part of an email’s metadata. An email’s metadata ensures the email is routed and delivered correctly and helps email filters identify spam and email-borne threats.
If an email’s subject line is encrypted, it makes it harder for email filters to analyze the metadata in order to detect spam and email-borne threats. This makes it more likely that an email with an encrypted subject line will be rejected, deleted, quarantined, or delivered to a junk folder depending on how the recipient’s email service is configured.
What is a HIPAA Compliant Email Subject Line?
When email subject lines are not encrypted, any Protected Health Information included in the subject line could be exposed to unauthorized access if an email is intercepted in transit. For this reason, the subject line of a HIPAA compliant email should not include Protected Health Information when an email is sent beyond an organization’s internal network.
In addition, when sent beyond an organization’s internal network, the content of an email subject line should avoid language that implies a treatment relationship. For example, neither “dentist appointment reminder”, “blood test result”, nor “join our weight loss webinar” disclose Protected Health Information, but they all imply a treatment relationship.
One further point to consider when discussing does an email subject line have to be HIPAA compliant is that, although an email may originate as a permissible provider-to-provider communication within an organization’s internal network, the email could subsequently be forwarded beyond the internal network with the same subject line.
For this reason, it is a best practice to train workforce members not to include Protected Health Information or imply a treatment relationship in all email subject lines. It can also be beneficial to explain why email subject lines have to be HIPAA compliant even when transmitted within an internal network to avoid misunderstandings and potential HIPAA violations.
Exceptions to When Does an Email Subject Line have to be HIPAA Compliant
There are several exceptions to when does an email subject line have to be HIPAA compliant. These include – but are not limited to – when a patient requests a disclosure of Protected Health Information in a confidential communication, when a patient authorizes a disclosure of Protected Health Information in an email subject line, and when a provider replies to a patient who has initiated an email exchange.
When a patient requests a disclosure of Protected Health Information in a confidential communication (per §164.522(b)), the disclosure may not necessarily mean in the email subject line. However, there may be circumstances in which the patient requests their name and the nature of the email is entered in the subject line if – for example – they share an inbox with other members of their family.
A patient can authorize an exception to when does an email subject line have to be HIPAA compliant for any reason. Examples include when the patient requests their medical records are sent to a different provider by email, and the receiving provider needs to know in the subject line who the medical records relate to. Authorization might also be required if one or both of the providers does not use a HIPAA compliant email service.
The final exception to when does an email subject line have to be HIPAA compliant is when a patient initiates an exchange of emails with sensitive information in the subject line. According to HHS guidance, providers can assume the patient consents to receiving a reply by email – but the guidance also advises providers to alert patients to the risks of disclosing sensitive information in an unencrypted email field.
