Email Redaction, Hospitals, and HIPAA Compliance

As many industries such as healthcare have become both highly regulated and technology-dependent, it is imperative that hospitals and other healthcare facilities maintain detailed and in-depth records of their patients at all times. These records contain personal information such as general patient info, protected health information or PHI, and other applicable documentation. Moreover, a large clinic or rehabilitation center will have mass numbers of emails containing this archived information, as health care professionals must constantly be in communication with one another to ensure that they are providing their patients with the best care possible. While there are both moral and ethical standards that healthcare professionals must abide by, there are regulatory standards as well.

The Health Insurance Portability and Accountability Act or HIPPA for short is a law that governs and regulates how healthcare providers manage the PHI of their patients, ranging from insurance payments to specific medical records. Created in 1996 and amended in 2013, Its main purpose is to provide regulatory policies aimed at protecting patient confidentiality. While the act consists of 5 sub-sections or Titles in total, Title II pertains to protecting the privacy of patients and ensuring that a patient’s PHI is safeguarded at all times. As such, any email sent containing sensitive patient information must first be redacted before being released to the public.

What are some instances in which email redaction is necessary in a medical setting?

There are many instances that can lead to a patient’s personal information being leaked to the public without their consent. The most common way that this happens is through simple human error. Whether it be the misplacement of a flash drive or the sharing of a patient’s information on social media, individuals who work in healthcare have little room for error when managing the sensitive data of others. Alternatively, a patient’s PHI information can also be illegally accessed by hackers and ransomware. In July 2020 alone, PHI information for over 763,837 people was exposed by nefarious means on behalf of internet hackers. UnityPoint Health, an Iowa-based healthcare provider, agreed to pay patients affected by a data breach in their system a 2.8 million dollar settlement in what was one of the largest healthcare data breaches in history.

In 2019, the HIPPA Journal published a breach report detailing a 196% increase in the number of medical records exposed in data breaches when compared to 2018. At the end of the year, at least 12.5% of the population had had some form of personal information leaked to the public without their consent. Furthermore, this data breach was the largest spike the U.S. had seen since 2015, and more medical information was improperly used in 2019 than was in the years 2009-2014. In the midst of this, Reuters Healthcare and Pharmaceuticals have reported that hackers consider a patient’s PHI information to be worth 10 times more than their credit card or social security information on the black market or dark web. Additionally, a recent KPMG cyber security report noted that 56% of healthcare executives consider HIPAA violations and in turn comprised privacy to be their primary security concern when managing their respective operations.

How can I implement email redaction in my medical office?

While health care professionals can still make use of programs such as Adobe to manually redact sensitive issues from files, there are automatic redaction software options that complete this task in a fraction of the time. What’s more, as healthcare professionals will have more personal information on a patient than virtually any other service or institution, it is of the utmost importance that they are able to effectively redact their information when necessary.

Automatic redaction software utilizes cutting-edge AI technology to automatically censor sensitive information in a matter of minutes. This will allow healthcare professionals to not only maintain HIPAA compliance at all times, but will also provide prospective patients with the peace of mind that they can trust the ways in which their personal data is stored, collected, and disseminated to the public.

See below an example of automatic PDF redaction that can be applied to thousands of files that have thousands of pages in a few clicks.