6.5 Securely Transmitting & Exchanging Patient Data
Key Takeaways
- Data transmitted to pharmacies, providers, agencies, and researchers must move over an encrypted, authenticated channel appropriate to the content and the recipient.
- Direct secure messaging, TLS-protected interfaces, SFTP, and portal messaging are compliant channels; standard email, SMS, and consumer fax are not without added protection.
- Purpose and audience determine what may be sent: treatment exchange is broad, while research, marketing, and most third-party disclosures require authorization or de-identification.
- The minimum necessary standard applies to every non-treatment transmission, and highly protected categories require separate handling.
- Every external transmission is verified for correct recipient address, correct patient, correct content scope, and successful delivery, and is logged.
Test plan task 2.B — "securely transmit and exchange patient data internally and externally (e.g., to pharmacies, other health care providers, other agencies) for research, analytics, and continuity of care" — is supported by four knowledge statements: requirements and procedures for secure transmission (2.K5), types of data that must be encrypted and the encryption processes (2.K6), types of information that can be shared externally (2.K7), and considerations such as purpose and audience (2.K8). Section 10.1 covers the interoperability standards themselves; this section covers doing it safely.
Choosing a Channel
| Channel | Appropriate For | Protection |
|---|---|---|
| HL7 v2 / FHIR interface | Orders, results, ADT between systems | Private network or VPN; TLS for network transport |
| Direct secure messaging | Referrals, summaries, transitions of care | Encrypted, identity-verified push using trusted certificates |
| Query-based HIE exchange | Retrieving records for unplanned care | Participant agreements, authentication, audit |
| FHIR API with OAuth 2.0 | Patient-authorized apps, third-party tools | Token-based authorization scoped to the request |
| NCPDP SCRIPT | Prescriptions to pharmacies | Encrypted network, digital signature for EPCS |
| X12 EDI over a clearinghouse | Eligibility, claims, remittance, authorization | Encrypted transport with trading partner agreements |
| SFTP / managed file transfer | Bulk extracts, registry submissions, research datasets | Encrypted in transit and at rest, key-based authentication |
| Patient portal secure messaging | Communicating with patients | Authenticated session, encrypted transport and storage |
Channels that are not acceptable for PHI without additional protection: standard unencrypted email, standard SMS text, consumer cloud file sharing without a business associate agreement, personal messaging applications, and unencrypted removable media.
Two frequently misunderstood cases:
- Fax. Traditional fax remains widely used and is permitted, but it is high-risk because a misdialed number sends PHI to a stranger. Confirm the number, use pre-programmed entries, include a confidentiality cover sheet, and confirm receipt for sensitive material. Digital fax that terminates in an encrypted queue is preferable.
- Appointment reminder texts. Permitted with documented patient consent and limited to minimum necessary logistics — date, time, location — with no clinical detail (Section 2.4).
What Must Be Encrypted
Knowledge statement 2.K6 asks which data must be encrypted and how. The practical standard used by health care organizations:
- In transit — all ePHI leaving a device or crossing a network, using current TLS or an equivalent encrypted tunnel.
- At rest — ePHI stored on servers, databases, backups, laptops, tablets, phones, and removable media, using a NIST-approved algorithm such as AES.
Under the HIPAA Security Rule as currently written, encryption is an addressable implementation specification: the organization must assess it, implement it where reasonable and appropriate, and document an equivalent alternative if it does not (Section 9.3). In practice, nearly every organization implements encryption, because encryption that meets HHS guidance also triggers the breach notification safe harbor described in Section 9.4 — encrypted data that is lost or stolen does not require notification. That single incentive is why "encrypt everything portable" is the operating rule regardless of the addressable designation.
Purpose and Audience Determine Content
Knowledge statements 2.K7 and 2.K8 make purpose the controlling variable.
| Purpose | Authorization Needed? | Content Limit |
|---|---|---|
| Treatment (to another provider, pharmacy, or facility) | No | Minimum necessary does not apply to treatment disclosures |
| Payment (to a payer or clearinghouse) | No | Minimum necessary applies |
| Health care operations (quality, audit, credentialing) | No | Minimum necessary applies |
| Public health reporting (required by law) | No | As specified by the reporting requirement |
| Research | Yes, unless an IRB/privacy board waiver applies, a limited data set with a data use agreement is used, or the data is de-identified | Strictly scoped |
| Analytics by a vendor | No, if the vendor is a business associate under a BAA | Minimum necessary; contract-limited |
| Marketing or sale of PHI | Yes, specific authorization required | As authorized |
| Any other third party | Yes, valid HIPAA authorization (Section 3.3) | Exactly what the authorization names |
Categories requiring extra care regardless of channel: psychotherapy notes (standalone authorization), substance use disorder records under 42 CFR Part 2 (redisclosure prohibition must accompany the data), HIV and other state-protected conditions, and genetic information.
Verify Before You Send
Most real-world breaches in this area are addressing errors, not cryptographic failures. Before transmitting:
- Right recipient. Verify the Direct address, fax number, or endpoint against a known record rather than a typed guess. Autocomplete selecting the wrong "Dr. Smith" is a leading cause of misdirected PHI.
- Right patient. Confirm two identifiers on the outbound package.
- Right scope. Send what the purpose or authorization covers and no more. "Entire chart" is rarely the minimum necessary outside treatment.
- Right protection. Confirm the channel is the approved one for that content and recipient.
- Confirm delivery. Check for the acknowledgment, transmission report, or interface ACK. An unacknowledged transmission is not a completed one.
- Log it. Record what was sent, to whom, when, by whom, under what authority, and how it was verified. Non-exempt disclosures go into the accounting of disclosures (Section 3.3).
When a Transmission Goes Wrong
Misdirected PHI is handled as a potential breach: stop the workflow, notify the privacy officer immediately, attempt to retrieve or obtain attested destruction from the unintended recipient, document every step, and let the privacy officer run the four-factor risk assessment in Section 9.4. Mitigation evidence — a signed destruction attestation from a recipient who is itself a covered entity — directly affects whether the incident is reportable.
A referral coordinator needs to send a specialist a consult packet including recent notes and lab results. Which transmission method is appropriate?
A research team asks for a dataset containing full dates of service, ZIP codes, and diagnoses for 4,000 patients. Which condition would permit release without individual patient authorizations?
A staff member faxes a discharge summary and immediately realizes the number belonged to a local business rather than the receiving clinic. What is the correct first action?