1

We’re bringing several new doctors into our email system. In their old system, they were allowed to maintain and use only their personal email.

I need to present reasons to convince those in charge they need to make them all be in the company’s system.

Thoughts that come to mind:
HIPAA - the system is managed and maintained by us for HIPAA compliance - personal email is not. (was told this alone was not a good enough reason)
Singular address book in the company (push back is - their address can be added as a global contact so they can be found by anyone trying to email them)
Legal - If a subpoena is presented, company IT takes care of this - dealing with that on personal email seems challenging at best
Managing company communications when user is no longer with company

What other reasons can you think of for why they should be on corporate email instead of personal?

Or if you have reasons why it shouldn’t matter and anyone would be able to use whatever email they want - please give those as well - helps us prepare for those counter arguments.

10 Spice ups
2

HIPAA would be enough I’d think. Discovery would be another biggie.

18 Spice ups
3

I wouldn’t consider forcing a doctor to limit their means of contact, as they are on call 24/7 to not just the organization, but to their patients (assuming each may practice as such). At least not without a more extensive understanding of their own professional and legal obligations. (One can’t just say HIPAA like a magic spell.)

An MD is a professional license which carries its own set of rules and responsibilities. And as each doctor is required to carry their own malpractice insurance, they may be considered more like contractors than employees. Medical law is a big CEU obligation to anyone in healthcare. This might be a good reason for you to study beyond the IT requirements, just to meet their needs.

The wife and I also have had personal experiences where HIPAA and legal reasons have been an impediment to good healthcare. It’s nice having an older doctor who’s fed up with the system and just wants people to get better.

5 Spice ups
4

Thanks for responding.

Regardless of a provider’s personal desired - there is still the law they are supposed to operate inside.
What limitation do you foresee a provider having if using a corporate email account instead of a personal one like Gmail or Yahoo? Especially when you consider they are housing PHI in those systems?

Not only does the provider have responsibilities to the patient and the law - so does the company, and the other partners.

Some of my existing providers use their corporate email for everything - both personal and business - I think that’s better than the other way around. of course if they leave, life is more challenging for them, though that’s the cost of today’s world. Nearly everyone in the corporate world has two or more email address - a personal one and the one they use at/for work, not sure why providers should be different?

As for the impediment you speak of - DHH makes several mentions of providers being allowed to ‘meet patients where they are’ i.e. via txt/sms/email etc, as long as the patient has been informed that there is a risk to their data being exposed while traveling over unencrypted networks.
I’m curious what specifically kept you from having good healthcare, versus slightly inconvenienced healthcare?

Let’s take that a step further and say the provider emailed your data to you - and it was subsquently leaked and that lead to at least public embarrassment for you, would you still want them to send unencrypted?

2 Spice ups
5

I think them having a corporate email for what’s happening at YOUR facility/company makes sense from the standpoints of everything already listed. However, there is the counter argument of previous patient/practices that need to be in contact with them. Also, there is the turn around aspect and if you’re forcing them to convert to your email. Trying to detangle that to their personal email can be a hassle and quickly irritate everyone involved. The facility I used to work at had a policy that stated doctors had to have a corporate email and everything relating to that facility was supposed to go through that email. However personal email for doctors were not blocked because of previous reasons mentioned. This covered the company and made the doctors happy. Did it happen that way? No mostly not but it’s not our job to enforce policy and at the end of the day our responsibility was covered.

2 Spice ups
6

Context of the USA
Very few doctors are actually on call 24/7, in our situation the patients have zero direct access to the providers (concierge providers are a totally different thing).
And even if they are - it’s not like they would be limited to accessing corporate email (topic of this thread) any time they like - just like their personal email today - they would have anytime/anywhere access via their phone/personal device.

2 Spice ups
7

HIPAA, discoverability already touched on here but also e-mail security in terms of filtering and protection.

6 Spice ups
8

I would toss Backups on your list.

Person email can’t be backed up properly. A managed email like MS 365 can be automatically backed Up.

I would also toss email security scanning on that list. Personal email doesn’t have any protections against spam \ malware \ phishing.. again managed email at least has this as an add on option

3 Spice ups
9

I have read a lot of good reasons in this thread for not using personal email for a business and whole heartily agree.

I will add one more thing - professionalism. While I don’t work in a medical field, I always question any company that does not have a business email with their own domain. My personal opinion is that people that have personal, e.g. @gmail.com or whatever, emails is that the buiness feels like a pop-up, temporary business.

9 Spice ups
10

I mean, just look at it! I’d want to hit “Reject” on this email so quickly if it showed up in quarantine…

From: DrSteveLuvsPizza99@gmail.com
To: PatientRecordsDepartment@hospital.com
Subject: Important Medical Test Results

Dear Records Team,

Please update John Doe’s chart with the attached lab results ASAP.

Sent from my Samsung Galaxy S47

11 Spice ups
11

We’ve had a few providers ask for this in the past.
Each time I was a bit amused by the fear in their faces when I explained what discovery would look like if they used their personal email.

7 Spice ups
12

an excellent point. I would delete that straight away.

To add to this one more item I just though of.. SPF and DMARC. with a gmail you don’t have control if this. with a managed email and your own domain you get control over who can use it and that gives the patient \ customer a bit of security as their system can properly flag and discard impersonation attempts and spam

3 Spice ups
13

I’m having a private conversation and it was the last thing I added to my list - professionalism.

2 Spice ups
14

I love this -
Of course the push back is - I never do that… that’s what I have staff for.

2 Spice ups
15

Audit trail… covers the company’s liability in lawsuits, and could protect the doctors themselves if someone sues them since everything is in the open and recorded. They have evidence.

5 Spice ups
16

but if the individual in question is using personal emails what are the staff using? Policy comes from the top down.

3 Spice ups
17

We have this problem when it comes to SMSing - we have providers who refuse to give up SMSing - and refuse to use a provided ‘texting’ app - because “I don’t want to have to remember what app to use to talk to whom”

3 Spice ups
18

Staff can and have been fired for not adhering to company policy… so it’s not an issue… providers/owners are another matter.

in my existing situation - it’s never been a problem, as mentioned, several choose to move all of their personal communications into the corporate email system even after being notified that it’s all part of the company record then.

3 Spice ups
19

Now - that said - the providers who choose to SMS staff - are of course SMSing staff on their personal devices.. ug!
and we can’t fire staff for that :frowning:

3 Spice ups
20

This.

And this.

2 Spice ups