for Electronic Transmission of Protected Health Information

July 3, 2007 Bulletin 154 Security for Electronic Transmission of Protected Health Information The Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) created by the Office of Civil Rights to implement the requirements ofthe Health Insurance Portability and Accountability Act of 1996 (HIP AA) established a set ofnational standards for the protection ofcertain "protected health information" (PHI). 45 C.F.R.F.R. § 160.103. Many ofthe organizations subject to the Privacy Rule, "covered entities," are also regulated by the Indiana Department of Insurance (IDOI). While the IDOI recognizes the substantial efforts the health insurance industry has made to comply with the purpose ofthe Privacy Rule and to define and limit the circumstances in which an individual's health information may be used or disclosed, unfortunately there are still a significant number ofmembers ofthe health insurance industry that do not adequately protect PHI transmissions. Due to the unparalleled increase in the receipt and transfer ofhealth information electronically, the IDOI strongly recommends that health insurers implement secured email technology for all PHI transmissions, including email exchanges to and from any insured citizen ofIndiana. INDIANA DEPARTMENT OF INSURANCE