6.5 Securely Transmitting & Exchanging Patient Data

Key Takeaways

  • Data transmitted to pharmacies, providers, agencies, and researchers must move over an encrypted, authenticated channel appropriate to the content and the recipient.
  • Direct secure messaging, TLS-protected interfaces, SFTP, and portal messaging are compliant channels; standard email, SMS, and consumer fax are not without added protection.
  • Purpose and audience determine what may be sent: treatment exchange is broad, while research, marketing, and most third-party disclosures require authorization or de-identification.
  • The minimum necessary standard applies to every non-treatment transmission, and highly protected categories require separate handling.
  • Every external transmission is verified for correct recipient address, correct patient, correct content scope, and successful delivery, and is logged.
Last updated: August 2026

Test plan task 2.B — "securely transmit and exchange patient data internally and externally (e.g., to pharmacies, other health care providers, other agencies) for research, analytics, and continuity of care" — is supported by four knowledge statements: requirements and procedures for secure transmission (2.K5), types of data that must be encrypted and the encryption processes (2.K6), types of information that can be shared externally (2.K7), and considerations such as purpose and audience (2.K8). Section 10.1 covers the interoperability standards themselves; this section covers doing it safely.

Choosing a Channel

ChannelAppropriate ForProtection
HL7 v2 / FHIR interfaceOrders, results, ADT between systemsPrivate network or VPN; TLS for network transport
Direct secure messagingReferrals, summaries, transitions of careEncrypted, identity-verified push using trusted certificates
Query-based HIE exchangeRetrieving records for unplanned careParticipant agreements, authentication, audit
FHIR API with OAuth 2.0Patient-authorized apps, third-party toolsToken-based authorization scoped to the request
NCPDP SCRIPTPrescriptions to pharmaciesEncrypted network, digital signature for EPCS
X12 EDI over a clearinghouseEligibility, claims, remittance, authorizationEncrypted transport with trading partner agreements
SFTP / managed file transferBulk extracts, registry submissions, research datasetsEncrypted in transit and at rest, key-based authentication
Patient portal secure messagingCommunicating with patientsAuthenticated session, encrypted transport and storage

Channels that are not acceptable for PHI without additional protection: standard unencrypted email, standard SMS text, consumer cloud file sharing without a business associate agreement, personal messaging applications, and unencrypted removable media.

Two frequently misunderstood cases:

  • Fax. Traditional fax remains widely used and is permitted, but it is high-risk because a misdialed number sends PHI to a stranger. Confirm the number, use pre-programmed entries, include a confidentiality cover sheet, and confirm receipt for sensitive material. Digital fax that terminates in an encrypted queue is preferable.
  • Appointment reminder texts. Permitted with documented patient consent and limited to minimum necessary logistics — date, time, location — with no clinical detail (Section 2.4).

What Must Be Encrypted

Knowledge statement 2.K6 asks which data must be encrypted and how. The practical standard used by health care organizations:

  • In transit — all ePHI leaving a device or crossing a network, using current TLS or an equivalent encrypted tunnel.
  • At rest — ePHI stored on servers, databases, backups, laptops, tablets, phones, and removable media, using a NIST-approved algorithm such as AES.

Under the HIPAA Security Rule as currently written, encryption is an addressable implementation specification: the organization must assess it, implement it where reasonable and appropriate, and document an equivalent alternative if it does not (Section 9.3). In practice, nearly every organization implements encryption, because encryption that meets HHS guidance also triggers the breach notification safe harbor described in Section 9.4 — encrypted data that is lost or stolen does not require notification. That single incentive is why "encrypt everything portable" is the operating rule regardless of the addressable designation.

Purpose and Audience Determine Content

Knowledge statements 2.K7 and 2.K8 make purpose the controlling variable.

PurposeAuthorization Needed?Content Limit
Treatment (to another provider, pharmacy, or facility)NoMinimum necessary does not apply to treatment disclosures
Payment (to a payer or clearinghouse)NoMinimum necessary applies
Health care operations (quality, audit, credentialing)NoMinimum necessary applies
Public health reporting (required by law)NoAs specified by the reporting requirement
ResearchYes, unless an IRB/privacy board waiver applies, a limited data set with a data use agreement is used, or the data is de-identifiedStrictly scoped
Analytics by a vendorNo, if the vendor is a business associate under a BAAMinimum necessary; contract-limited
Marketing or sale of PHIYes, specific authorization requiredAs authorized
Any other third partyYes, valid HIPAA authorization (Section 3.3)Exactly what the authorization names

Categories requiring extra care regardless of channel: psychotherapy notes (standalone authorization), substance use disorder records under 42 CFR Part 2 (redisclosure prohibition must accompany the data), HIV and other state-protected conditions, and genetic information.

Verify Before You Send

Most real-world breaches in this area are addressing errors, not cryptographic failures. Before transmitting:

  1. Right recipient. Verify the Direct address, fax number, or endpoint against a known record rather than a typed guess. Autocomplete selecting the wrong "Dr. Smith" is a leading cause of misdirected PHI.
  2. Right patient. Confirm two identifiers on the outbound package.
  3. Right scope. Send what the purpose or authorization covers and no more. "Entire chart" is rarely the minimum necessary outside treatment.
  4. Right protection. Confirm the channel is the approved one for that content and recipient.
  5. Confirm delivery. Check for the acknowledgment, transmission report, or interface ACK. An unacknowledged transmission is not a completed one.
  6. Log it. Record what was sent, to whom, when, by whom, under what authority, and how it was verified. Non-exempt disclosures go into the accounting of disclosures (Section 3.3).

When a Transmission Goes Wrong

Misdirected PHI is handled as a potential breach: stop the workflow, notify the privacy officer immediately, attempt to retrieve or obtain attested destruction from the unintended recipient, document every step, and let the privacy officer run the four-factor risk assessment in Section 9.4. Mitigation evidence — a signed destruction attestation from a recipient who is itself a covered entity — directly affects whether the incident is reportable.

Test Your Knowledge

A referral coordinator needs to send a specialist a consult packet including recent notes and lab results. Which transmission method is appropriate?

A
B
C
D
Test Your Knowledge

A research team asks for a dataset containing full dates of service, ZIP codes, and diagnoses for 4,000 patients. Which condition would permit release without individual patient authorizations?

A
B
C
D
Test Your Knowledge

A staff member faxes a discharge summary and immediately realizes the number belonged to a local business rather than the receiving clinic. What is the correct first action?

A
B
C
D