Does HIPAA Impose Requirments on the Mailing of PHI?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice; instead, all information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.  

The HIPAA Privacy Rule requires covered entities to have in place "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information (PHI). This article covers safeguards to be considered by a covered entity when mailing protected health information to patients.

Appropriate physical safeguards to protect PHI that a covered entity mails to patients can include measures such as: shielding PHI from public view (e.g., not using a postcard or a see-through envelope, and instead, using an envelope thick enough such that PHI could not be viewed unless the envelope is opened); assuring that the mailing has appropriately-sized and quality packaging; and not overstuffing envelopes. 

The envelope or other mailer containing the PHI should expose the least amount of PHI as is necessary to ensure the letter reaches the intended recipient. This minimum information generally may include the covered entity return address, and the patient's name and mailing address. A postcard exposes all of the information sent to the patient. While HIPAA does not explicitly prohibit the use of postcards, the use of postcards is not a best practice and may not satisfy HIPAA requirements.  A postcard exposes all the information being sent to the patient.  While HIPAA does not explicitly prohibit their use, it is not a best practice and may not meet the requirements.

In terms of envelopes, the best practice is to mail envelopes with PHI with a level of postal service that is first-class mail or higher.