HIPAA Email Regulations and Patient Communication Guidelines

Imagine sending a text to your patient about their eye exam. They’re at work and can’t read it. Later, a family member glances at the phone and sees the reminder.

A message meant for the patient is creating privacy issues. It could risk a HIPAA violation for your optometry practice.

Technology makes it easy and convenient to get in touch with your optometry patients. Moreover, good communication supports better patient engagement. However, you must be mindful of the safeguards and regulations that protect patient privacy.

‍

HIPAA Overview 

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) protects patient health information and regulates all forms of patient communications. This includes texts, emails and emerging technologies such as patient portals, secure messaging apps, and telehealth platforms.

As in most industries, healthcare communication is increasingly digital. Simply put, texting and emailing are convenient for both optometrists and their patients. They are less time-consuming than phone calls and the telephone tag that often follows.

Today, texts and emails pose the biggest risk of exposing protected health information (PHI). As such, optometry practices must take every step possible to prevent unauthorized access.

Follow HIPAA communication guidelines for patient conversations via text, email, and online patient portals.

Security Requirements and Implementation

Let's examine the fundamental security standards that form the basis of all HIPAA-compliant communication.

Core Security Standards

Healthcare providers must implement comprehensive security measures to protect patient information across all communication channels.

HIPAA-compliant electronic communication should account for the following safeguards:

• Evaluate the risks associated with sending electronic protected health information (ePHI).
• Implement appropriate access controls and protections against unauthorized access.
• Protect the integrity and security of ePHI during transmission.
• Consider encryption or an equivalent safeguard based on the practice’s documented risk analysis.
• Use reasonable safeguards such as verifying recipient information and limiting unnecessary PHI.
• Document communication policies and patient preferences when appropriate.
• Train staff on approved communication methods and procedures.
• Regularly review security risks and update safeguards as needed.

Note: Providers must adjust their approach to protecting patient privacy to suit different communication channels.

HIPAA Guidelines for Text Messaging

Americans send and receive over 2 trillion texts every year, and 97 percent own a cell phone. Having this kind of access to your patients means you can get in touch with almost anyone in an instant—for better or for worse. 

You can’t control who unlocks a phone and reads a private text message, so HIPAA requires that you take extra steps to maintain patient data security.

According to The HIPAA Journal, texting can be compliant, provided you encrypt the data and use a secure network to prevent data breaches. 

Other HIPAA safeguards for texting PHI include:

• Patients must have provided consent to be contacted by SMS text.
• Practices must implement policies surrounding texting and accessing sensitive health information.
• Messages must comply with the minimum necessary standard. 
• Only authorized users may handle PHI.
• Practices must conduct frequent risk assessments to verify HIPAA text messaging remains compliant.
• All authorized users must understand these policies and know that noncompliance has consequences.

HIPAA Guidelines for Email

HIPAA allows healthcare providers to communicate with patients by email, but practices must take reasonable steps to protect PHI and ePHI. The appropriate safeguards depend on what information is being transmitted and the security risks associated with the communication method.

For optometry practices, HIPAA email safeguards can include:

• Verify the patient’s email address before sending sensitive information.
• Limit the amount of PHI included in an email to what is necessary for the purpose of the communication.
• Use secure communication methods when the sensitivity of the information or identified security risks warrant additional protection.
• Implement access controls so only authorized staff can send or access messages containing PHI.
• Establish written policies governing how staff communicate patient information electronically.
• Train employees to recognize risks such as misdirected email, phishing, unauthorized access, and inappropriate disclosure of PHI.
• Document security decisions and safeguards as part of the practice’s HIPAA risk-management process.

Patients may also request that their health information be sent through email in certain circumstances. Practices should follow applicable HIPAA right-of-access requirements and explain relevant security risks when an individual requests an unsecure transmission method.

When Should an Optometry Practice Use a Secure Patient Portal Instead of Email?

For routine communications with limited sensitive information, email may be appropriate when the practice applies reasonable safeguards. More sensitive communications may warrant a secure patient portal or HIPAA-compliant messaging platform.

Consider using a secure channel when sending or discussing:

• Detailed exam results or diagnoses
• Treatment information
• Insurance or billing information containing PHI
• Medical records or documents containing substantial PHI
• Sensitive clinical images
• Information that would create a significant privacy risk if sent to the wrong recipient

A secure patient portal can provide additional access controls, authentication, audit trails, and other safeguards that are difficult to achieve with ordinary email.

HIPAA Guidelines for Patient Portals

Modern healthcare practices increasingly rely on patient portals as secure gateways for health information exchange. These web-based platforms serve as digital hubs where patients can safely access their medical records, view test results, schedule appointments, and communicate with their healthcare providers. 

To maintain HIPAA compliance, patient portals must incorporate multiple layers of security safeguards. These technical and administrative controls protect sensitive patient information while ensuring authorized access. 

Security requirements include:

• All patient data must be encrypted during transmission to prevent unauthorized interception.
• The portal must implement secure authentication methods to verify the identity of users accessing the system.
• The system must maintain detailed audit trails that record all access to patient information.
• Healthcare organizations must implement role-based access controls that limit staff access based on job functions.
• The portal must include automatic timeout features that log users out after periods of inactivity.

When properly implemented, secure patient portals become a powerful tool for both practices and patients—boosting trust, streamlining care delivery, and maintaining HIPAA compliance while meeting patients' growing expectations for digital access to their healthcare information.

HIPAA Risk Assessment & Management

As convenient as it may be, sending your patient a text or email is not without risks. Sending healthcare communications without following medical records security standards is dangerous. 

HIPAA mandates that healthcare providers—including optometrists—conduct regular risk assessments to identify vulnerabilities in their communication channels to lower the odds of a data breach or non-compliance.

With these fundamental security requirements in mind, let's examine how HIPAA compliance applies to specific communication channels used in optometry practices.

HIPAA Violations

While these communication tools offer valuable ways to connect with patients, understanding common HIPAA violations is crucial for avoiding costly mistakes and protecting patient privacy.

HIPAA is constantly changing, and there have been significant updates in 2024. Major proposed changes include greater freedom for patients to inspect and access their own PHI, so optometrists must keep security a priority to avoid violations and penalties.

HIPAA violations can result in significant civil or criminal penalties depending on factors such as the nature of the violation, level of culpability, corrective action, and applicable enforcement rules. Because penalty amounts can change over time, practices should consult current HHS Office for Civil Rights guidance when evaluating potential exposure.

Fines increase with severity—from reasonable cause to willful neglect—and the number of patients involved. It’s important to note that some violations carry criminal charges and can lead to jail time.

9 Common HIPAA Violations

There are many ways HIPAA provisions can be breached. Here are the most common.

1. Unencrypted Patient Records

Per HIPAA, you must store patient information and records securely, ensure they’re properly encrypted, and password protect them.

2. Improper Destruction of PHI

Obsolete medical records should be permanently destroyed so that they don’t fall into unauthorized hands.

3. Not Properly Training Employees

All practices are required to train employees on HIPAA compliance, including regarding texting and emailing PHI.

4. Unencrypted Data Transmission

Sending patient information via unencrypted email, messages, or storage devices poses a high risk for data breaches.

5. Lost or Stolen Devices

Mobile devices or laptops containing patient information that are lost or stolen present a high risk of a HIPAA violation.

6. Lack of HIPAA-Compliant Text Messaging Solutions

When healthcare providers communicate with patients with standard SMS or third-party messaging apps that are not HIPAA-compliant, they risk interception and unauthorized dissemination of patient data. Non-compliant methods lack essential encryption and access control features.

7. Sending PHI Through Email Without Appropriate Safeguards

Email-related HIPAA problems can occur when staff send PHI to the wrong recipient, disclose more information than necessary, fail to follow the practice’s approved communication procedures, or transmit sensitive information without safeguards appropriate to the identified risk. Staff should verify recipient information and know when a secure portal or messaging system is the safer option.

8. Failure to Obtain Patient Consent

Sometimes, healthcare providers may share patient information for reasons like referrals without obtaining patient consent.

9. Inadequate Incident Response

Failing to report a data breach within 60 days can lead to penalties under HIPAA’s Breach Notification Rule.

HIPAA Violation Penalties 

Without the proper safeguards in place, you put your practice at risk of serious HIPAA violations. These infractions can be costly—both in fines and in damage to your reputation.

2 Examples of Recent HIPAA Violations

These potential violations aren't just theoretical concerns. Data breaches are on the rise, and millions of Americans have had their PHI exposed due to HIPAA data violations.

Recent cases demonstrate the real-world consequences of HIPAA non-compliance. Here are some major violations that occurred in 2024.

1. Lafourche Medical Group Case ($480,000 Fine)

A phishing attack on Lafourche Medical Group exposed the PHI of 34,862 patients. The Office for Civil Rights (OCR) investigation revealed inadequate risk assessments and lack of policies to monitor system activity.

Resolution: Lafourche settled the case with a $480,000 fine and entered into a corrective action plan that included a thorough risk assessment, ongoing training and system monitoring enhancements​.

2. Green Ridge Behavioral Health ($40,000 Fine)

Following a ransomware attack that exposed the PHI of 14,000 patients, Green Ridge Behavioral Health faced a $40,000 fine. The OCR investigation revealed several compliance failures, including the failure to conduct a proper risk analysis, not reducing risks to ePHI and a lack of policies for monitoring system activity. 

This organization had no security risk analysis prior to the attack and inadequate procedures for reviewing system activity logs.

Resolution: Green Ridge Behavioral Health paid a $40,000 penalty and committed to a corrective action plan that included security risk analysis, implementation of policies to reduce risks to ePHI and improved system activity monitoring procedures to prevent future violations.

Major Unresolved HIPAA Breaches 

• Change Healthcare breach. This breach is considered the largest healthcare data breach in history. A cyberattack compromised PHI of about 100 million individuals, exposing a massive amount of sensitive patient data.
• Kaiser Foundation Health Plan breach. Website trackers leaked PHI and internet traffic for around 13.4 million individuals. This data was disclosed to third parties and even social media.

Hundreds more cases are currently under investigation by the Department of Health and Human Services Office of Civil Rights. These cases underscore the critical need for robust risk management, access controls, and consistent staff training to avoid costly penalties and safeguard patient trust.

Despite these cautionary tales, maintaining HIPAA compliance while communicating effectively with patients is achievable with the right tools and practices.

See the FAQ below for answers to your frequently asked questions about HIPAA patient communication guidelines.

Solutions and Best Practices

Patients love communicating via text and email; in one survey, 80% of respondents said they prefer digital communication like texts and emails, meaning they’re more likely to engage with your services and have a positive experience. 

However, the penalties can be great for getting it wrong. One solution is to use EHR and practice management software, like RevolutionEHR, that includes the HIPAA security features you need to protect your practice.

RevolutionEHR: Secure Healthcare Communication Solutions

To make it easier to give your patients what they want, two communication tools work seamlessly from within RevolutionEHR to allow you to do just that—while saving time and ensuring that your practice remains HIPAA compliant.

RevDirect

RevDirect is a messaging service that allows users to exchange PHI with other healthcare professionals from within RevolutionEHR. RevDirect is HIPAA-compliant, so your practice providers and staff will be assured that PHI in external messaging meets HIPAA security guidelines.

With RevDirect, your practice can:

• Exchange protected health information securely and seamlessly from within RevolutionEHR
• Save time by streamlining external communications
• Never need to search for misfiled records sent by fax or email
• Eliminate the expenses of printing, faxing and mailing

RevConnect

RevConnect is a set of patient communication tools that simplifies the sharing and tracking of messages to patients using powerful email and text features.

With RevConnect, you can:

• Automate appointment and recall reminders to dramatically reduce no-shows.
• Send recall notices to increase patient retention.
• Create email campaigns and track performance.
• Create and send optical order status updates.
• Send automated birthday messages.

Through RevDirect and RevConnect, RevolutionEHR provides the comprehensive, secure communication tools your practice needs to maintain HIPAA compliance while delivering the convenient digital experience your patients expect.

Take control of your PHI with RevolutionEHR—to protect your patients and your practice. To learn more, request a demo today.