Medical Reserve Corps Unit Email and PHI Policy Guide

MRC units need email procedures that help volunteers coordinate while protecting patient information and sensitive volunteer records. HIPAA duties depend on the role of the unit’s sponsoring organization and how it handles health information; the unit’s own policies and other applicable laws may add protections.

What information do MRC units communicate by email?

Units may use email to share routine administrative updates, training and drill notices, activation instructions, volunteer assignments, and contact information. ASPR guidance recommends that MRC units establish procedures for notifying, organizing, and deploying volunteers, with policies tailored to unit operations. ASPR’s MRC Unit Factors for Success

Before sending, decide whether every recipient needs the information. A general drill reminder usually does not need a full volunteer roster, personal phone numbers, or patient details. Use an approved channel for sensitive information and share only what recipients need for their assigned roles.

How should units protect volunteer personal information?

Volunteer rosters can include names, email addresses, phone numbers, credentials, schedules, availability, or emergency contacts. This information is personal and may be confidential under unit or sponsoring-agency policy, even when it is not protected health information (PHI) under HIPAA.

• Use agency-approved email and volunteer-management systems rather than personal accounts or unapproved file-sharing services.
• Limit access to people who need the information for their duties, and remove access when it is no longer needed.
• Use BCC for broad announcements when recipients do not need to see one another’s addresses.
• Check recipient addresses, attachments, and reply-all lists before sending.
• Keep sensitive rosters out of subject lines and avoid forwarding them beyond authorized recipients.

HIPAA’s access-control requirements apply to covered entities and business associates handling electronic PHI; other confidentiality requirements may also apply to volunteer data. HHS guidance on covered entities and business associates

What counts as protected health information in MRC communications?

PHI is individually identifiable health information connected to a person’s past, present, or future health condition, health care, or payment for health care, when it is held or transmitted by a HIPAA covered entity or business associate. Examples include a patient’s name paired with a diagnosis, treatment, test result, or identifiable care details. Information can identify someone through a combination of details, not only a name. HHS guidance on individually identifiable health information

An MRC unit is not automatically a HIPAA covered entity simply because it is part of the Medical Reserve Corps or handles sensitive information. HIPAA applies to covered entities and business associates as defined by the law; a volunteer may also be part of a covered organization’s workforce when working under its direct control. The sponsoring agency should determine which rules apply to the unit’s specific activities. HHS overview of HIPAA coverage

Volunteer contact details and schedules are not PHI by themselves. Similarly, confidential information is not automatically PHI: the information must meet HIPAA’s definition and be held or handled in a context covered by the Rules. HIPAA specifically excludes employment records held by a covered entity in its role as employer; other privacy rules or agency policies may still protect sensitive records.

When may PHI be sent by email?

HIPAA does not categorically prohibit email for electronic PHI. A covered entity or business associate must use appropriate safeguards to control access, protect information integrity, and guard against unauthorized access during transmission. It must assess the risks and select and document suitable protections. HHS guidance on sending e-PHI by email

Email encryption is an addressable Security Rule implementation specification, not a blanket requirement to encrypt every email in every circumstance. The organization must assess whether encryption is reasonable and appropriate; if it is not, the organization must document that decision and implement an appropriate alternative when required. This does not make ordinary email automatically safe: follow the sponsoring organization’s approved method for PHI. HHS guidance on Security Rule encryption

Where the Privacy Rule’s minimum necessary standard applies, limit PHI to what is reasonably needed for the purpose. The standard has exceptions, including certain disclosures to or requests by health care providers for treatment, so do not treat it as a reason to withhold information needed for authorized care. HHS guidance on the minimum necessary standard

How can units securely share deployment and drill details?

Most deployment notices can be useful without patient-level information. Send the assignment, reporting location, time, role, and operational instructions through an approved channel, and include only the volunteer details needed to coordinate the response.

• Use a verified distribution list or an access-controlled volunteer platform for rosters and updates.
• Use a secure, approved system—not an ordinary email attachment—when authorized staff need patient-specific information.
• Keep patient identifiers and clinical details out of general activation messages, subject lines, and broad distribution lists.
• Confirm the recipient and their role before sharing sensitive information, especially during fast-moving activations.
• Use the unit’s approved backup communication method if email or the secure system is unavailable.

These practices support timely coordination while reducing unnecessary disclosure. The unit’s incident and communications plans should specify which channels volunteers may use during drills and deployments.

What should an MRC email policy include?

A practical policy should align with the sponsoring organization’s privacy, security, incident-response, and records-retention requirements. ASPR’s MRC guidance calls for unit-specific documented policies and procedures for volunteer management and operations; it does not prescribe a single email policy for every unit. ASPR’s MRC Unit Factors for Success

• Scope and roles: Explain who the policy covers, who may authorize access, and which privacy or security official volunteers should contact.
• Information categories: Distinguish routine operational messages, volunteer personal information, and PHI.
• Approved tools: Identify permitted email accounts, secure messaging or file-sharing systems, and backup channels.
• Sending rules: Require recipient verification, limited distribution, appropriate access controls, and use of approved safeguards for PHI.
• Volunteer training: Explain how to handle sensitive information, recognize misdirected email, and report security incidents.
• Incident response: Provide a prompt reporting route and explain who assesses possible breaches and handles required notifications.
• Review and enforcement: Set a process for updating the policy and addressing violations under the sponsoring agency’s rules.

Do not describe a volunteer’s training certificate as proof that an MRC unit or sponsoring organization is HIPAA compliant. Training should explain the organization’s own policies and the volunteer’s assigned duties.

What should units do if PHI is sent to the wrong recipient?

Report the mistake immediately through the unit’s established incident-reporting route, such as the supervisor, coordinator, privacy officer, or security officer. Include what was sent, when it was sent, the intended and actual recipients, and whether the recipient may have opened or forwarded it.

• Do not forward the message further or try to make an independent breach determination.
• Preserve the message and relevant details for the organization’s review; follow instructions before deleting or recalling anything.
• Follow the privacy or security officer’s instructions about contacting the unintended recipient and requesting that they not access, use, disclose, or retain the information.
• Help the organization document the incident and any steps taken to contain or mitigate the disclosure.

A misdirected email does not by itself determine whether a reportable HIPAA breach occurred. The covered entity or business associate must assess the circumstances, including the information involved, who received it, whether it was viewed, and how the risk was mitigated. Required breach notifications apply when the rules’ criteria are met. HHS Breach Notification Rule guidance

In practice, units should use approved channels, limit access to information needed for each task, and report suspected disclosures promptly. The sponsoring organization’s policy determines the correct procedure and who evaluates any HIPAA obligations.

FAQs

Does the Medical Reserve Corps have a standard email policy for PHI?

ASPR guidance recommends that MRC units maintain policies and procedures tailored to their operations, but it does not prescribe a single email policy for all units. Whether HIPAA applies depends on the unit’s sponsoring organization and its role in handling the information. Follow your unit’s and sponsor’s current policies, and ask the coordinator or privacy officer which approved channel to use.

Can MRC units email volunteer deployment details?

Yes, units can communicate deployment details by email under their approved procedures. Share only what recipients need, check addresses and attachments, and protect rosters or other sensitive information using the sponsor-approved system. Avoid including patient-identifying or clinical information in broad deployment messages.

How should volunteers report an email containing PHI sent to the wrong recipient?

Notify your supervisor, MRC coordinator, or designated privacy or security contact immediately using the unit’s incident-reporting process. Preserve the message and provide the relevant details. Do not forward it or decide on your own whether a breach occurred; follow the organization’s instructions for containment and further communication.

Does keeping volunteer information confidential mean it is protected health information?

No. Confidentiality is broader than PHI. A roster or schedule may be sensitive personal information without being PHI under HIPAA. PHI must meet HIPAA’s definition of individually identifiable health information in a covered context; other laws and agency policies may protect information that HIPAA does not.