Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

What?!?! I need a BA Agreement with my email provider?

Here’s a question from our twitter feed this past week. Like most things in life, I think this needs a little more than 140 characters to explain, so here’s a blog post. Take that Twitter!

A few weeks back, we addressed the question: Do you need a Business Associate or Business Associate Subcontractor Agreement with your email host? (Remember: Covered Entities have Business Associates, Business Associates have Subcontractors.)

We answered most emphatically . . . . Yes! – Because they are potentially handling PHI on your behalf. You need to make sure they understand what their responsibilities are to protect PHI.

Then this question came in: Encryption/decryption happens on the endpoints so the web/email hosting companies are unable to see anything even if they wanted. So, you don’t need a Business Associate Agreement with them, right?

Sorry, the answer is still, Yes. You are still going to have to ask them to sign a Business Associate Agreement.

Let’s break down how email encryption works. Either you use your current email client (Outlook, Apple Mail, etc.) and encryption from your vendor*, or you have to login to a website client in order to send an encrypted email. Either way, your message is then encrypted, and stored on your vendor’s server. At this point, an email is sent to your client with a link back to the vendor’s site saying, “Hey, you’ve got an email from Bob’s Agency, click here to see it.” The client is then required to login to a password-protected site. Once the client successfully logs in, the email is then unencrypted and made readable.

In both scenarios, the email is encrypted from point to point, and technically it’s unreadable by your email provider, right? Yep, no disagreement here…  Buuuuuuut… Who has the encryption keys? That would be your email provider, and this is one of the key reasons why you need a Business Associate or Business Associate Subcontractor Agreement.

In this Agreement, there should be information about how the company is encrypting the emails, and where the encryption keys are stored. For instance, are they stored onsite or offsite? On another server, etc.? Who has access to these encryption keys? How does the company keep these keys safe? How does the company handle physical security? This is due diligence that your company MUST do before you sign that contract with the encryption service.

Luckily, most email encryption providers today offer to sign Business Associate and Business Associate Subcontractor Agreements, or offer one on their site. Just make sure you carefully review any of their agreements and make sure you understand their security procedures before you sign off on them.

Remember folks, CYA is the name of the game when it comes to HIPAA. There are serious penalties for any misuse of PHI, and you are responsible for what your business associates and subcontractors do on your behalf. This is why you have EVERY contractor sign a Business Associate Agreement, or Business Associate Subcontractor Agreement, and ask this simple question, “May I see your Privacy and Security Policies and Procedures?” If they don’t have them, then don’t do business with them.

Keep those questions coming, and we will do our best to get them all answered!

*This will probably be a plug-in to your client, and will have to be actively selected in order to send encrypted emails.

By Jason Karn

Total HIPAA specializes in HIPAA compliance services, helping businesses adhere to HIPAA guidelines and protect sensitive data. Our experts ensure your organization remains compliant with HIPAA regulations, meaning you can focus on your core operations while we handle documenting the policies and procedures that make up your HIPAA compliance plan. Trust Total HIPAA for comprehensive compliance solutions tailored to your needs. Book a clarity call today.

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

Building a Culture of Compliance

Building a Culture of Compliance

Culture takes shape in every type of organization, whether it's a business or a sports team. This happens as certain behaviors become the norm, whether by design or by accident. Prosperous companies...

Artificial Intelligence in HIPAA Compliance

Artificial Intelligence in HIPAA Compliance

What is AI? Artificial intelligence is the science of making machines that can learn, similar to the ways humans do. AI technology can process large amounts of data in ways that humans can’t....

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)