HIPAA covered entities like fertility clinics may send patient information by email to patients or individuals they have legally authorized as long as the disclosure is permitted under HIPAA. If a partner or other recipients wish to receive the patient's information, they need an applicable basis. The HHS guidance on the matter states that treatment and payment are allowed without an authorization from the patient, but clinics must take precautions when emailing.

 

Providing patients with their records

Patients typically have the ability to get their records sent to them by email. Patients with a personal representative (whoever may be legally appointed to make medical decisions for the patient) will have similar access as long as it is within their power of attorney.

Patients are also able to continue their care through email. A 2023 Boston IVF quality improvement study concluded, “A compassionate email sent after one visit may increase return to care behavior.” Because the study was not randomized, they could not conclude whether the email helped patients come back. For clinics, the practical task is to match the requested records to the patient and confirm the delivery address before sending results or follow-up information.

 

Can both partners receive the same fertility results?

Just because a partner is attending appointments with a patient does not mean they can have access to that patient's entire medical history. The HHS has outlined specific information that clinics are allowed to share with a partner, provided the patient gives their consent, doesn't voice an objection, or other conditions are met.

A patient's agreement to receive medication directions does not equate to unrestricted access to their entire history. When clinicians are about to include the partner in communications related to patient lab results, they should first consider whether they can legally disclose. The ASRM's guidance on confidentiality suggests allowing disclosure of information relevant to a reproductive partner.

 

Handling gestational-carrier information

Using a gestational carrier raises additional considerations about what information to share. The intended parents may want insights into the carrier's background. ASRM recommends a medical release authorizing disclosure of information pertinent to the arrangement, alongside legal agreements and informed consent documents.

 

Before emailing screening results, staff should check the release, applicable law, named recipients, and attachments. A shared conversation about appointment timing should not become the default destination for every medical document.

 

Limiting access within the clinic

Clinic staff should not assume they have clearance to access fertility-related email communications. There needs to be access controls in place that are appropriate to the role and the information they need access to.

A U.S.-based research team’s 2022 study, available through NCBI, examined 444 employees at one academic medical center who accessed records without permission. Warning emails addressed access “without a known work-related purpose;” repeat violations occurred among approximately 2% of warned employees versus 40% of controls.

 

Checking business associate access

Should a clinic utilize an external billing service or cloud-based email provider that handles protected health information (PHI), that organization might be classified as a business associate. To guarantee they remain compliant, there are actions clinics should undertake.

According to the HHS, a cloud provider that stores encrypted PHI can still be considered a business associate. Just because they cannot read the encrypted information does not mean they are not a business associate. It is necessary to understand the capabilities and limitations of any product or service when it comes to their fertility-related emails.

See also: HIPAA email security 101: Your HIPAA email questions answered

 

Respecting email preferences

A patient might prefer their records sent to an address separate from their spouse's. Confirm their preferred communication methods and accommodate them. Paubox's maturity report also revealed employees were not utilizing encrypted email.

Ensure the procedure is straightforward and that patient details are kept up to date with the options available. Should patients understand the inherent risks of alternative methods to HIPAA compliant email, they have the option to request that their records be sent without encryption.

 

Protecting delivery without expanding permission

Paubox's maturity report revealed that 47% of companies boosted their encryption following a data breach. With our Google Workspace or Microsoft 365 integration, Paubox automatically encrypts outgoing messages. Encryption supports protected delivery, but it cannot establish a recipient’s right to receive a record.

An encrypted attachment sent to the wrong partner can still disclose information improperly. Before sending, always double-check the recipient, ensure they possess the necessary permissions, and confirm the patient's preferences. Also be sure to review the attachments and any earlier messages in the same email chain.

 

FAQs

Does another treating provider need a BAA?

A provider does not need a business associate agreement merely to receive information for the patient’s treatment.

 

Can an employer request a patient’s fertility results?

An employer may ask, but a clinic generally needs the patient’s authorization or another applicable legal basis before disclosing the information.

 

Can a clinic email records in response to a subpoena?

The clinic must first establish that disclosure meets applicable HIPAA legal-process conditions and other relevant laws.