PreVeil supports the HIPAA Security Rule’s business associate, access control, audit, authentication and encryption requirements for email and files sent through it, while risk analysis, policies, training and physical safeguards stay with the practice. The tables below walk through the administrative, physical and technical safeguards in 45 CFR 164.308, 164.310 and 164.312, marking each specification required or addressable and showing whether PreVeil supports it, shares it with the practice, or leaves it to the practice.
How is the HIPAA Security Rule organized?
The HIPAA Security Rule sets standards in three groups: administrative safeguards in 45 CFR 164.308, physical safeguards in 45 CFR 164.310 and technical safeguards in 45 CFR 164.312. Many standards carry implementation specifications labeled “(Required)” or “(Addressable)” under 45 CFR 164.306(d).
A required specification must be implemented. An addressable specification still requires action, since the practice must assess it and then implement it, adopt an equivalent measure, or document why neither is reasonable.
Section 164.306(b)(2) lets a practice weigh its size, complexity and capabilities, its technical infrastructure, “the costs of security measures,” and “the probability and criticality of potential risks” when deciding how to implement each standard. The tables use three labels for PreVeil’s role. Supports means a PreVeil control directly supports the specification for email and files sent through PreVeil; Shared means PreVeil provides a control that the practice’s own procedure relies on; Practice means a policy or procedure the practice owns.
Which administrative safeguards does PreVeil support?
PreVeil supports the business associate contract standard in 45 CFR 164.308(b) by signing a business associate agreement (BAA), the contract HIPAA requires with any vendor that handles patient data. PreVeil shares the required information system activity review by providing system logs the security official reviews. Risk analysis, sanctions, training and contingency planning stay with the practice.
PreVeil’s encryption is also a risk-reducing measure the practice can record in its risk management plan.
Which physical safeguards in the HIPAA Security Rule apply to email and file sharing?
The HIPAA Security Rule’s physical safeguards in 45 CFR 164.310 cover facilities, workstations and devices, and they are mostly the practice’s responsibility. Workstation security and device and media controls matter for email because laptops and phones hold mailboxes, and disposal and media re-use are required specifications. PreVeil’s role here is limited to device management in the admin console.
Which technical safeguards does PreVeil support?
PreVeil supports most of the technical safeguards in 45 CFR 164.312 for email and files sent through it. Unique user identification and audit controls are required, and PreVeil gives each staff member an individual user with keys on that person’s devices, plus system logs. Encryption of stored and transmitted ePHI (electronic protected health information) is addressable, and PreVeil encrypts message contents, attachments and files end to end.
PreVeil uses FIPS 140-3 validated cryptographic modules (certificate #5145), the federal standard for encryption software.
How does the HIPAA Security Rule mapping connect to breach notification?
Encryption is addressable under the HIPAA Security Rule, but encryption consistent with HHS guidance decides whether lost or stolen PHI is unsecured, and so whether notification is required. Under 45 CFR 164.402, PHI encrypted consistent with HHS guidance is not unsecured PHI, so the HHS Breach Notification Rule does not require breach notification when that PHI is exposed.
The HHS guidance to render unsecured PHI unusable, unreadable, or indecipherable says entities that secure information this way “are relieved from providing notifications,” and it expects decryption tools to sit on a device or at a location separate from the data. PreVeil’s design keeps the keys apart from the data by default. PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices, and stored message contents, attachments and Drive files stay encrypted under those keys.
What stays with the practice under the HIPAA Security Rule?
The practice owns its risk analysis, policies and procedures, sanctions, training, contingency planning, evaluation, physical safeguards and documentation, which 45 CFR 164.316(b)(2)(i) requires it to keep for six years. The practice also owns vendor oversight. A vendor that cannot read PHI has less PHI to expose, but that does not replace the practice’s own obligations.
HHS guidance on HIPAA and cloud computing treats a cloud provider that stores electronic PHI as a business associate “even if it does not hold a decryption key and therefore cannot view the information.” PreVeil signs a BAA on that basis, and the BAA sets out PreVeil’s obligations under 45 CFR 164.504(e) and 45 CFR 164.314(a).
Frequently asked questions
Which HIPAA Security Rule requirements does PreVeil support?
PreVeil supports the business associate contract standard, unique user identification, audit controls, person or entity authentication, access control, and the addressable encryption specifications for stored and transmitted ePHI, for email and files sent through PreVeil. It shares activity review, access management and log-in monitoring with the practice.
Is PreVeil enough on its own to satisfy the HIPAA Security Rule?
No. PreVeil supports specific Security Rule requirements. The practice’s risk analysis, policies, training, contingency planning and physical safeguards complete its compliance program.
Are audit controls required under HIPAA?
Yes. Audit controls under 164.312(b) are a required standard, and information system activity review under 164.308(a)(1)(ii)(D) is a required implementation specification.
Is encryption required under the Security Rule?
No. Encryption is addressable under 164.312(a)(2)(iv) and 164.312(e)(2)(ii). A practice must assess encryption, then implement it, adopt an equivalent measure, or document why neither is reasonable and appropriate under 164.306(d)(3).
Can PreVeil read a practice’s data?
No. PreVeil cannot access or decrypt message contents, attachments or files, because the encryption keys stay on users’ devices.
How can a practice review this mapping with PreVeil?
A demo walks your practice’s security official or IT provider through how PreVeil supports each row of this mapping inside the email the practice already uses. Request a demo
