Earlier quoted context omitted.
> but that's typically more cumbersome as you have to trade keys with everybody that needs an email. What would be needed is a public key infrastructure. If organizations like the state board of medicine could serve as a certificate authority for physicians licensed in that state (or maybe the DEA since they issue id numbers to physicians that are needed for controlled substance prescriptions), then the key managemen…
That sounds fine in theory and if implemented well it would work, but I'm not sure how well it would work in reality. I just refer to my small business tax return every year to get an idea of how many forms would need to be filled out to just send email. How would that work for offices that send non PHI emails? Would it go through that system too, or would it have to key on recipient email addresses? How hard would i…
They could encrypt those emails as well. While sending a non-encrypted email that contains PHI is a problem, sending an encrypted email that doens't contain PHI shouldn't be an issue (as long as the intended recipient can decrypt it, which they should).
> How hard would it be to shut down and create a new email for each employee that left, etc.
That comes down to revoking the certificate or using shorter intervals for the duration where the certificate is considered valid. For example, if the organization requires that one changes their password every 60 days, then a certificate should not have more than a 60 day period where it's valid.
> Would you have to have a special email server just for PHI and another for regular?
This wouldn't be server dependent. This would be dependent on the email client handling the encryption and decryption. The more that's automated, the less chance that there's a mistake with regards to email containing PHI.
> Also, physicians themselves rarely send emails, they have office assistants do it. They are busy providing care.
Physicians have to do all sorts of things like writing progress notes, dictating admission and discharge summaries, calling in prescriptions, writing orders, etc. The system they use could also be used to securely send PHI containing email to other physicians, pharmacists, or hospital systems.
But regulation could be a good incentive against physicians allowing others to use their account credentials to do things like sending PHI information to other organizations. No physician would like to be summoned by the board of medicine of the state they're licensed in over something like that.
But I think that a lot of the problems could be addressed by those who have cross-domain knowledge about technology and health-care (speaking as someone who went through medical school and subsequently changed fields to computer science/software development).