Paubox and PreVeil both give healthcare practices encrypted email and a business associate agreement (BAA), but they encrypt in different places. Paubox encrypts outbound email by default and delivers it over TLS (Transport Layer Security, the encryption mail servers use between each other) to the recipient’s inbox. PreVeil encrypts message contents and attachments end to end on the sender’s device, with keys that stay on user devices, so messages are only readable by the sender and the recipient – never by PreVeil or another vendor.
What is the main difference between PreVeil and Paubox?
The main difference is where the message stays encrypted. Paubox protects email in transit using TLS and delivers it to the recipient’s inbox like ordinary email. PreVeil encrypts message contents and attachments on the sender’s device and keeps them encrypted in transit and at rest in both mailboxes, with keys that stay on users’ devices.
That difference bears on the breach notification safe harbor. Under 45 CFR 164.402, protected health information (PHI) is “unsecured” unless it is rendered “unusable, unreadable, or indecipherable to unauthorized persons” by a method in HHS guidance. HHS guidance also says decryption tools “should be stored on a device or at a location separate from the data they are used to encrypt or decrypt.”
How does Paubox deliver HIPAA email?
Paubox’s user guide states that “all outbound emails are encrypted by default,” with no box to check or keyword to type. Most recipients read the message in their inbox without a portal or passcode. When a recipient’s provider does not support TLS, Paubox delivers through its secure message center, and the recipient opens a one-click link in a browser.
Paubox does not ensure that inbound emails or replies are encrypted.
How does PreVeil encrypt email and files?
PreVeil encrypts message contents and attachments end to end on the sender’s device, inside Outlook, Gmail or Apple Mail. PreVeil cannot access or decrypt a practice’s email or attachments, because the encryption keys stay on users’ devices. Replies through PreVeil are always encrypted end to end.
PreVeil Drive applies the same end-to-end encryption to files, which suits practices that exchange imaging, referral packets and records with specialists, payers and business associates. PreVeil’s cryptographic modules are FIPS 140-3 validated, and the admin console and system logs on the Business plan support the required audit controls standard under 45 CFR 164.312(b).
How do PreVeil and Paubox compare side by side?
The table compares both products on the same attributes, using Paubox’s own public pages for Paubox and PreVeil’s verified product facts for PreVeil. Paubox’s pages do not describe key custody, so the table does not characterize it.
How do PreVeil and Paubox support the HIPAA Security Rule?
PreVeil and Paubox both support the HIPAA transmission security standard, 45 CFR 164.312(e)(1), and both offer a BAA. PreVeil also keeps stored messages and files encrypted under keys held on users’ devices, which supports the addressable encryption specification for stored PHI and the breach notification safe harbor if a mailbox is compromised. Addressable means the practice implements the specification if reasonable and appropriate, or documents why not and uses an equivalent alternative. Audit controls under 164.312(b) are required, and PreVeil’s admin console and system logs on the Business plan support them.
Which fits a small practice?
The deciding questions are who the practice exchanges PHI with and where that PHI should stay encrypted. A practice that sends and receives records and files with other providers, payers and business associates, and wants messages to stay encrypted in every inbox under keys that stay on users’ devices, fits PreVeil’s design.
PreVeil works inside the email clients staff already use. Outside parties use PreVeil for free from their browser, so a referring specialist or a billing company can reply with PHI and the reply is encrypted end to end as well.
Frequently asked questions
Is Paubox end-to-end encrypted?
No: Paubox’s outbound email is encrypted by default and delivered over TLS, with a secure message center for recipients whose providers lack TLS. PreVeil encrypts message contents and attachments end to end on the sender’s device.
Do PreVeil recipients need to pay?
No. Patients, outside providers, payers and business associates read and reply to PreVeil messages for free from their browser, and their replies stay encrypted end to end.
Can PreVeil read a practice’s email?
No. PreVeil cannot access or decrypt message contents, attachments or files, because the encryption keys stay on users’ devices.
How can a practice compare its options against the Security Rule?
A demo with PreVeil covers how it fits the practice’s email and file sharing.
