Hacker News Reader

In your theoretical scenario, the doctor himself violated HIPAA when he emailed himself the document. He exposed the document to his email provider and all those along the transport path of the email. So, to agree, technology can only do so much, you have to use it correctly.

View on HN

If the email server was provided by his workplace, then it was likely secured and HIPAA compliant. Most hospital email services are. Once the file is on his hard drive, most hospitals will require that the user uses some kind of encryption if it contains PHI. They enforce this by training and recertification procedures every year or so.

When I worked at an insurance company, emailing certain things was a huge no-no. So I doubt that.

Reply on news.ycombinator.com