|
Question: "We recently had an attorney ask if we encrypt the documentation we send after emailing them files through our Dropbox service. How do I answer them? I am not sure."
Answer:
This is an excellent question and highlights the importance of understanding your file-sharing practices, especially when dealing with sensitive information. Here's how you can address this concern.
First, it's important to note that sending sensitive documents via regular email attachments is not secure. If you're currently doing this, it's essential to stop immediately and implement a more secure method.
If you use Dropbox to share files, you should consider using Dropbox Business, Business Plus, or Enterprise plans, as these offer features that are compliant with security standards and regulations such as HIPAA.
When using Dropbox for secure file sharing, it's crucial to ensure that files are encrypted both in transit and at rest. This means that files are encrypted when uploaded to Dropbox, remain encrypted while stored on Dropbox servers, and are encrypted during transfer when shared.
To securely share files with the attorney, you should create a secure shared link for the specific file or folder in Dropbox, set an expiration date for the link, enable password protection for the link, and send the secure link via email while providing the password through a separate, secure channel (e.g., a phone call).
It's also advisable to encrypt sensitive files before uploading them to Dropbox for an extra layer of security.
Inform the attorney that you are using a secure file-sharing method that complies with relevant regulations and that the files are encrypted throughout the process.
Remember, maintaining compliance isn't just about technology; it's also about having clear policies and procedures in place. Ensure your staff is trained on proper file-sharing protocols, and consider having a written policy that outlines these procedures. If you're unsure about any aspect of your file-sharing practices, feel free to reach out to our team at natasha@targetcoding.com for further assistance. This will help ensure that your processes meet all necessary security and compliance requirements.
Click for Dropbox's Trust Guide on HIPAA and HITECH regulations with Dropbox. Always ensure a BAA is signed with any vendor you share patient date with.
Need help with proper compliance? Schedule a free consultation with Dr. Kotlar now!
| 
