HIPAA GUIDE
Referral packets, records requests, prior authorizations, intake forms, images. Protected health information moves between providers, payers, labs, attorneys, and patients all day, and most of it still moves as an email attachment or a fax. This guide maps the HIPAA Security Rule to those movements and explains what a compliant transport looks like.
The HIPAA Security Rule at 45 CFR Part 164 Subpart C applies to electronic protected health information wherever it is created, received, maintained, or transmitted. Four technical safeguards in 164.312 do the work when a document moves.
Transmission security, 164.312(e)(1). Covered entities and business associates must implement technical security measures to guard against unauthorized access to ePHI being transmitted over an electronic communications network. The encryption specification at 164.312(e)(2)(ii) is addressable, which means you must implement it or document why an equivalent alternative is reasonable. In 2026, no reviewer accepts an explanation for unencrypted PHI in transit. Access control, 164.312(a)(1). Only authorized persons may access ePHI. For a document in motion the question is whether anyone other than the intended recipient can open it. Audit controls, 164.312(b). Mechanisms must record and examine activity in systems that contain or use ePHI. For a transmitted document that means a record of who received it, when, and whether it was accessed again. Person or entity authentication, 164.312(d). Verify that the person seeking access is who they claim to be. A password set once and reused everywhere is weak authentication; verifying identity at the moment a document opens is strong.Behind the technical safeguards sit the risk analysis requirement at 164.308(a)(1)(ii)(A), which must account for every channel PHI travels; business associate agreements under 164.308(b) and 164.314 for any vendor that transmits PHI on your behalf; and the Breach Notification Rule at 164.400 through 414, under which an unencrypted document that reaches the wrong inbox is a presumptive breach unless a four-factor risk assessment shows a low probability of compromise.
Email encrypts in transit only when every hop negotiates TLS, and mail systems fail open when negotiation does not succeed. The attachment is then stored in cleartext in the sender's sent items, the recipient's inbox, archives, and backups, which multiplies the number of systems holding ePHI and the number of places a breach can originate. There is no record of who opened it. The safe-harbor provision of the Breach Notification Rule only protects data that was encrypted; an attachment that was decrypted on arrival and sits in a mailbox is not.
Fax survived because it was treated as out of scope, and the arrival of e-fax and scan-to-email on every multifunction printer ended that. A scanned referral that leaves the copier as an SMTP attachment is a transmission of ePHI under the Security Rule, with every weakness described above and usually a stored mail credential on the device as well.
A portal satisfies encryption at rest and produces logs. It fails where PHI actually moves: between a referring practice and a specialist, a provider and a payer, a clinic and a patient's attorney. None of those parties will create an account in your system to receive one document, so the compliant channel is bypassed and the PHI goes by email anyway. Portals also concentrate credentials, and a patient portal credential is now one of the most commonly phished identities in healthcare.
A transport that satisfies the standard looks like this: the sender's system creates a one-time encrypted delivery for a named recipient; the recipient opens it from a notification with no account, password, or app; the document is encrypted from pickup to delivery and the encrypted container is destroyed once delivered, so nothing persists on a relay, in an inbox, or in a backup; and every pickup is logged per document with who, when, and from where. That is the Secure Digital Transport model, and it is the control, not a workaround. The practical walkthrough is in how to send sensitive documents without a portal.
Mapped to the Security Rule: encryption from pickup to delivery meets transmission security without a fail-open hop; a delivery bound to one recipient with identity verification at open meets access control and authentication; destruction of the encrypted container after delivery means there is no residual copy of ePHI in transit infrastructure to inventory, secure, or breach; and the per-document access log is the audit control. The vendor providing the transport is a business associate and must sign a BAA; Botdoc does.
Botdoc's transport is used by healthcare providers and the organizations that exchange documents with them, including through SecureMFP, which replaces scan-to-email on the multifunction printers clinics already own so a scanned chart never becomes an attachment, and through the SDT Engine for practices and health IT vendors building document exchange into their own systems. Botdoc executes business associate agreements and maintains SOC 2 Type 2 examination of the controls behind the transport.
Standard email is not. Transmission security under 164.312(e) requires protection of ePHI in transit; ordinary email is hop-by-hop at best and fails open, and the attachment then persists unencrypted in multiple mailboxes with no audit trail. HHS has said email can be used with appropriate safeguards, which in practice means encryption the whole way and controls on what happens after delivery; most encrypted-email products meet the first and not the second.
The encryption specification is addressable, not required, which means a covered entity must implement it or document why an equivalent measure is reasonable and appropriate. In practice no risk analysis supports sending PHI unencrypted over a public network, and the Breach Notification Rule's safe harbor applies only to encrypted data, so encryption in transit is the operating standard.
No. The Security Rule requires outcomes: transmission security, access control, authentication, audit controls, and a BAA with any vendor that handles ePHI. A portal is one way to meet them and it fails when the other party is outside your organization. A transport that delivers or collects a document without a recipient account meets the same standards and is what actually gets used.
Movement of a document containing PHI in which the file is encrypted from pickup to delivery, access is bound to the named recipient with authentication at open, the encrypted container is destroyed after delivery so no copy persists in transit systems, and each pickup is logged. The transport vendor signs a BAA. Secure Digital Transport is the category built on that model.
Yes. A scan that leaves a multifunction printer as an SMTP attachment is a transmission of ePHI with the same weaknesses as any email, plus a mail credential stored on the device. Replacing the transport leg on the printer, rather than the printer, is the fix; that is what SecureMFP does.
This guide summarizes public regulations for educational purposes. It is not legal or compliance advice; confirm obligations with your counsel and your examiner.