HIPAA-Compliant Email Retention and Archiving for Healthcare Companies: What You Need to Know
If you’re a medical company in the U.S., you’ve heard of HIPAA. The Health Insurance Portability and Accountability Act was passed by Congress in 1996 and is one of its most stringent industry regulations. HIPAA applies to a wide range of healthcare providers, including health insurance companies, company health plans, government programs like Medicare and Medicaid, doctors, clinics, pharmacies, nursing homes, dentists, chiropractors, and health care clearinghouses, among others. The regulation was designed to protect sensitive individual healthcare information across a wide range of use cases and applications.
Email Retention and HIPAA
There are a number of protections outlined in HIPAA, but today we’re focusing on the legislation’s impact on email retention and archiving.
Email retention is covered as part of the regulation’s Security Rule, which states that electronic communications containing HIPAA procedure and policies must be retained for a minimum of six years. During this time, audit and access controls must be put in place to secure protected health information (PHI) and prevent deletion or modification of the email content.
Email Archiving and HIPAA
Though email archiving is not specifically mentioned as part of the Security Rule, archiving satisfies many other requirements that are outlined in its contents, including satisfying requests from individuals who request a copy of their PHI. If emails are not archived and protected properly, organizations will be unable to satisfy these requests.
Other HIPAA standards mandate that organizations must respond quickly to compliance reviews, payment disagreements, or appeal against a Department of Health and Human Services ruling. HIPAA-compliant archiving solutions ensure every email is stored in highly secure, encrypted and digitally signed archives for quick search and e-discovery when they are needed most. Emails should also be encrypted at the point of export (to protect PHI during transit) when they are needed for litigation, to satisfy a patient request, or other use cases as provided in HIPAA.
Additional Email Security Measures
To prevent any email tampering by disgruntled or opportunity-hungry employees (PHI pays on the black market), email archiving solutions can provide auditing, anti-tampering, and privacy officer management features. And while HIPAA doesn’t require email encryption for emails that are sent internally behind a firewall or under another “reasonable and appropriate” solution, it’s a good idea to put email security practices and solutions (including encryption) in place to safeguard sensitive healthcare information so your organization can minimize the impact of a potential data breach.
Other U.S. Industry – Specific Regulations
There are many other industries in the United States with compliance regulations in place, and several of these regulations have specific requirements for email archiving and retention. For example, the Sarbanes Oxley Act, mandates all public companies to retain emails for a minimum of seven years, while the Federal Deposit Insurance Corporation (FDIC) requires emails to be retained for a minimum of five years.
The Sarbanes-Oxley (SOX) Act, for its part, prohibits any kind of document destruction (including electronic files like emails) after the government makes an inquiry related to a criminal offense (for individuals, businesses, etc.). In addition, publicly traded companies must store any documents related to insider dealings for an indefinite amount of time.These rules also apply to federal contractors and vendors.
Ensure Your Organization is Prepared
HIPAA-compliant email archiving and retention protects the privacy of PHI to ensure the confidentiality, availability, and integrity of this data when it’s needed most – to meet compliance and regulatory requirements.
Beyond HIPAA, almost every industry has mandates (or, at minimum, suggestions) about how to retain and archive sensitive information, including email content. To ensure your organization is compliant and prepared, email archiving is a no-brainer.
Libraesva Resilient Archive technology protects vital corporate email data for all types of regulated and unregulated organizations, ensuring this data can be easily searched – but not changed or deleted.
With Libraesva Email Archiver, data is archived across distributed, multi-volume storage for high availability and redundancy and is stored in a secure, open standards ZIP archive format so you can change vendors without hassle (though we hope you don’t want to)!
Learn more about Libraesva Email Archiver.
