Being HIPAA compliant means enforcing the generally accepted set of security standards that protect information in the health care industry. HIPAA violations can lead to civil penalties and fines depending on severity. Certain types of violations can also result in criminal penalties, which may include prison time.
Digital security is critical to HIPAA compliance, and that means your company's email platform must use the proper safeguards. Zoho Mail provides a robust email platform that’s also HIPAA compliant. Whether you run a small business or an enterprise, Zoho Mail can scale to your business and its compliance needs.
HIPAA compliance basic guidelines
The Health Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996. It required the U.S. Department of Health and Human Services (HHS) to promulgate regulations protecting the privacy and security of certain types of health information.
HHS subsequently created the HIPAA Security Rule and the HIPAA Privacy Rule.
The Privacy Rule, also known as the Standards for Privacy of Individually Identifiable Health Information, provides standards to protect citizens’ health information. The Security Rule, or the Security Standards for the Protection of Electronic Protected Health Information, provides a national set of security standards for protecting health information in electronic form. Under the Security Rule, your business email must be secured.
Who is a covered entity under the Security Rule?
Covered entities include health plans, health care clearinghouses, and health care providers, like independent dental providers or doctors' offices. Fortunately, tools exist for determining whether you are covered by HIPAA.
Which information is protected under HIPAA?
The Privacy Rule protects individually identifiable health information, also called protected health information (PHI). The Security Rule protects health information created, received, maintained, or transmitted electronically by covered entities. Importantly, the Security Rule does not apply to PHI transmitted orally or in writing.
How can you comply with HIPAA rules?
The Security Rule requires that covered entities maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting electronic-PHI (e-PHI).
Additionally, the Security Rule is flexible and scalable to allow covered entities to examine their own needs and respond appropriately based on their size. Importantly, the Rule does not dictate any specific measures, but simply requires entities to review and modify security measures according to the organization’s capabilities.
Covered entities must also engage in risk analysis and management. This means evaluating potential security risks relating to e-PHI, implementing security measures to mitigate risks, documenting and justifying measures, and maintaining continuous, reasonable, and appropriate security protections.
Covered entities must also implement certain administrative, physical, and technical safeguards.
Remember, the most important aspects of HIPAA compliance are the regulations under the Security and Privacy Rules. These Rules preempt conflicting state laws, create a robust framework to help better manage PHI, and are scalable for companies of all sizes.
Why your email needs to be HIPAA compliant
HIPAA helps protect individuals’ health information and encourages companies to build new technologies that make patient care better and more efficient.
HIPAA compliance is key for managing the reputation of your business. After all, failing to be HIPAA compliant can land you in legal trouble, which is never good for a company’s image.
HIPAA violations and their consequences
The HHS’ Office for Civil Rights (OCR) enforces both the Privacy and Security Rules. A HIPAA investigation usually begins with a complaint; from there, possible rule violations are investigated. If a criminal violation is suspected, it is forwarded to the Department of Justice. The Department of Justice can either accept the case or kick it back to OCR.
If no criminal violation is found, OCR can issue penalties and make formal findings of violations. Many times, OCR merely provides technical assistance to ensure that regulations are being followed. In many instances, voluntary compliance, corrective action, and other agreements can be reached without further issues.
Civil and criminal penalties
If civil or criminal penalties are necessary, consequences will be dictated by the severity of the violation. Minimum and maximum penalties may apply depending on the level of culpability. Additionally, penalties are leveraged based on the number of violations an organization has committed.
Civil penalties
There are four levels of civil penalties for HIPAA violations. The maximum penalty is $1.5 million for all identical violations within one calendar year.
| Culpability | Minimum penalty per violation | Maximum penalty per violation | Annual cap |
| 1. No Knowledge | $100 | $50,000 | $25,000 |
| 2. Reasonable cause | $1,000 | $50,000 | $100,000 |
| 3. Willful neglect, timely corrected | $10,000 | $50,000 | $250,000 |
| 4. Willful neglect, not timely corrected | $50,000 | $50,000 | $1,500,000 |
Usually, when considering the penalty, OCR will assess the following factors:
- Number of people impacted
- Degree of harm the violation caused
- Any history of compliance or noncompliance
- The size and financial situation of the organization
- Whether imposing fines would jeopardize the organization’s ability to continue providing health care
Settlements often combine corrective action plans with monetary payment.
Criminal penalties
Criminal penalties are much rarer than civil penalties, but they can still be issued. According to OCR, criminal penalties can occur when:
“A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm. The Department of Justice is responsible for criminal prosecutions under the Privacy Rule.”
It is important to avoid these penalties because of the potential for jail time and huge fines.
Social consequences of violations
In addition to the civil and criminal penalties for violating HIPAA, there are social costs. HIPAA exists to protect the privacy rights of all Americans. Ensuring you pick tools and software that are compliant helps you provide better health care and keep personally identifiable information safe.
How Zoho Mail helps you stay HIPAA compliant
Picking the right email service can be tough, but Zoho is ideal for businesses and covered entities handling e-PHI.
Privacy and security
Zoho Mail is both HIPAA compliant and highly secure. Security at Zoho takes the form of both physical and digital safeguards. Zoho’s data centers are equipped with 24/7 surveillance and biometric authentication to prevent unauthorized entry. In terms of digital security, every email is encrypted. By securing your company’s communications, Zoho helps you comply with the laws. And Zoho's solutions are scalable to your company’s needs.
eDiscovery and retention
Compliance also involves being able to reproduce documents and generate reports. Remember, even if you comply with HIPAA, you still may need to pull data to prove your compliance. The Zoho eDiscovery feature makes this simple. Email retention means you can track, retain, search, and discover your data whenever you need it.
If an investigation is launched, you can easily search, narrow down, and export necessary information. You can even produce audit logs to track activity throughout the process.
HIPAA compliant secure email
HIPAA compliance has become more complicated since the regulations were first signed into law. Fortunately, the right software makes compliance a breeze. Zoho Mail is a high-quality, HIPAA compliant email platform to protect data, and avoid civil and criminal penalties.
If you don’t have a Zoho Mail account, sign up today!
Get the complete Zoho advantage: you can now use Zoho Mail along with the broad suite of products that Zoho offers by signing up for Zoho Workplace or Zoho One.
Author bio: Gary Stevens
Gary Stevens is the CTO of Hosting Canada, a website that provides expert reviews on hosting services and helps readers build online businesses and blogs.
One of the most important benefits of HIPAA for healthcare professionals is being provided with a clear set of rules to follow with respect to healthcare data.
Excellent article !