HIPAA demands encrypted e-mail. (Communicating with Patients).

COLORADO SPRINGS -- Physicians using regular e-mail to communicate with patients are strongly advised to switch to a secure messaging service that will meet new HIPAA requirements, said Dr. C.T. Lin, senior medical director of informatics at the University of Colorado Health Sciences Center, Denver.

On April 14, privacy standards mandated by the Health Insurance Portability and Accountability Act (HIPAA) will take effect. Further, final regulations for the HIPAA security standards were just published. Under these new standards, patient health information sent over the Internet must be secure and encrypted, Dr. Lin explained at the annual meeting of the Colorado Chapter of the American College of Physicians.

"This will become a great issue going forward for those of us now corresponding with patients through regular nonencrypted e-mail," he said.

Several software companies now offer an Internet-based service for encrypted online physician/patient communication. Some services, including RelayHealth (www.relayhealth.com) and Medem (www.medem.com), are free to physicians.

Here's how secure messaging works: Physicians sign up with a provider, which gives patients a password to access a secure Web site to exchange messages with their physician. When the physician sends them an e-mail, the service transmits a regular, unencrypted e-mail informing them that a message awaits at the secure Web site.

"So even if someone hacks into the unencrypted message, they get no information about that patient's health," Dr. Lin noted.

The physician decides how much, if anything, to charge for e-mail responses of varying complexity. The secure messaging service bills the patient directly. Many of the services also offer appointment scheduling, prescription ...