Inherited Retinal Disease Clinic Email and PHI Policy Guide

When may an inherited retinal disease clinic email patients about treatment?

A clinic may email you about treatment, appointments, follow-up, or other care-related matters. HIPAA does not categorically prohibit email, including email that contains protected health information (PHI). The clinic must use reasonable safeguards and follow applicable HIPAA Security Rule requirements when sending electronic PHI. HHS guidance on email communications with patients

For an inherited retinal disease clinic, treatment communications might involve test results, a medication plan, or information about a genetic diagnosis. Such details can identify you and reveal information about your health, so the clinic should use a communication method suited to the sensitivity of the message.

If you email the clinic first, HHS says the clinic may generally assume email is acceptable unless you have said otherwise. You can still change your patient communication preferences at any time by asking for another reasonable method or location for receiving PHI.

What safeguards should clinics use when sending email containing PHI?

HIPAA requires covered providers to use reasonable safeguards to protect PHI. For email, this can include email recipient verification before sending, limiting the information in the message, and choosing a transmission method that protects electronic PHI against unauthorized access. HHS explains that email is not automatically prohibited, but the clinic must assess and apply appropriate safeguards. HHS guidance on email safeguards and HHS guidance on the Security Rule and email

• Confirm your email address is accurate, especially after you report a change.
• Use a secure method appropriate to the information being sent, such as an encrypted message or a secure patient portal.
• Include only the PHI needed for the purpose of the message; avoid unnecessary details about a diagnosis or treatment.
• Use care with attachments, reply-all, and address suggestions that could send your information to someone else.
• Follow the clinic’s policies for documenting your communication choices and handling messages.

These are examples of practical safeguards, not a promise that every email system works the same way. HIPAA’s Security Rule calls for appropriate protections for electronic PHI in transit; HHS explains that encryption is an addressable specification that a covered entity must assess and address appropriately, rather than a one-size-fits-all rule that makes every unencrypted email automatically unlawful. HHS explanation of email and transmission security

What are the risks of using regular email for patient communications?

Regular email may not provide the same protections as a secure patient portal. A message could be sent to the wrong address, viewed by someone with access to a shared inbox or device, or exposed through an account compromise or an unencrypted transmission. Notifications displayed on a shared screen may also reveal message details.

An unencrypted email disclosure can expose sensitive information such as your diagnosis, test results, or treatment plan. Email is not necessarily inappropriate, but you should understand the privacy trade-offs and tell the clinic if you would rather use another method. HHS notes that disclosures through remote communication technologies can create privacy and security risks if appropriate protections are not in place. HHS resource on privacy and security risks in remote communications

You can reduce risks on your end by using a private email account, securing it with a strong password and multifactor authentication when available, and avoiding shared devices or accounts for sensitive messages. These steps do not guarantee privacy once a message has been sent.

How can patients request a more confidential communication method?

Tell the clinic which method and destination you prefer—for example, secure patient portal messaging, a particular phone number, or mail sent to a specified address. You can ask the clinic to record your patient communication preferences and to avoid sending treatment details to an email address you do not consider private.

Under HIPAA, a covered health care provider must permit you to request and must accommodate reasonable requests to receive PHI by alternative means or at alternative locations. The clinic may ask you to make the request in writing or specify an alternative method or address, but a provider may not require you to explain why you want confidential communications. HHS summary of HIPAA confidential communication requirements

If you prefer unencrypted email for a specific communication, you can discuss that choice with the clinic. HHS says providers should use safeguards and may explain the risks so you can decide how you want to communicate. HHS guidance on patient email choices

How do patient portals protect messages and health information?

A secure patient portal typically lets you sign in to an account to send messages and view health information, rather than placing the full message in an ordinary email inbox. HHS identifies encrypted email and systems that require patient login, such as patient portals, as examples of communication methods that can support safeguards for electronic PHI. HHS Guide to Privacy and Security of Electronic Health Information

Portal features and protections vary by clinic and system. Ask the clinic how to activate your account, who can access messages, whether email notifications reveal message content, and how to update your communication preferences. A portal can add protections, but it does not remove the need to protect your own password and device.

Use the portal for routine questions and non-urgent follow-up if your clinic offers it. If you are unsure whether your message was received or how quickly the clinic responds, check its instructions rather than assuming portal messages are reviewed immediately.

When should patients call the clinic or seek emergency care?

Email and portal messages may not be monitored continuously, so use the clinic’s phone number for time-sensitive symptoms or treatment questions. If you cannot reach the clinic, follow its after-hours instructions or seek urgent eye care based on the symptoms.

Seek immediate eye care or go to an emergency department for sudden vision loss, a sudden increase in floaters, flashes of light, or a curtain-like shadow in your vision. These can be signs of retinal detachment, which the National Eye Institute describes as a medical emergency. National Eye Institute guidance on retinal detachment

Severe eye pain, a serious eye injury, or a sudden major change in vision also warrants urgent evaluation. Do not wait for an email reply if you think you may be having an emergency; contact emergency services for a life-threatening emergency.

In short, clinics may use email for care when they apply appropriate safeguards, and you can request a reasonable alternative confidential communication method. Use the portal or another clinic-approved option for routine messages, and call or seek urgent care rather than emailing about emergency symptoms.

FAQs.

Can an inherited retinal disease clinic email me about my treatment?

Yes. HIPAA allows covered providers to communicate with patients by email when they use reasonable safeguards and meet applicable Security Rule requirements. You can ask the clinic to use a more confidential method if you prefer.

What information can a clinic include in an unencrypted email?

There is no single list of information HIPAA categorically forbids in an unencrypted email. The clinic must use reasonable safeguards, including limiting the amount or type of information disclosed where appropriate, and must protect electronic PHI as required by the Security Rule. You can request that sensitive treatment details be sent another way.

Can I ask the clinic to contact me through a different method?

Yes. You can request a reasonable alternative method or location, such as portal messaging, phone, or mail to a specified address. A covered health care provider must permit and accommodate reasonable requests under HIPAA.

Is email appropriate for urgent eye symptoms or medical emergencies?

No. Email may not be checked promptly. Call the clinic for time-sensitive concerns, and seek immediate eye care or emergency care for symptoms such as sudden vision loss, new flashes or many floaters, a curtain-like shadow, severe eye pain, or serious eye injury.