Secure Email Communication & Data Privacy

Email Communications for Medical Billing Portals

Medical billing portals use email communication for a number of reasons. Messages may be sent to communicate registration, confirmation, a recurring payment notice or another message directed to the end user or patient. Sometimes the email may include sensitive information and it's really important, from a medical billing provider perspective, to ensure considerations for what PHI (Protected Health Information) is shared and in what format.

One of the best policies is to restrict access to PHI data until someone is logged in to the medical billing portal. In some cases, portals send out a link along with a notification to a confirmed email address of a user. The email will simply inform the user of an update or a new unread message, without elaborating further or offering any other indication. Depending on the level of security that you wish to configure with your email, it is also possible to do things like encrypting an attachment and allowing the user to download it.

Moreover, it’s feasible to include some form of actual information, but not include details. For example, the message might be:

• Important information about your recent test
• Urgent message about your account
• Notification or reminder of an upcoming billing
• Payment processed successfully
• Account balance zero

The above types of messages might be acceptable as long as they simply notify the user but don’t contain any sensitive information.

We generally recommend reviewing with a legal counsel if there's any uncertainty on what is acceptable in each particular circumstance. The capability certainly exists and we’re able to incorporate limited information with a link for the user to click, authenticate and then see more detail in a message center.

Other Forms of Communication With Users

In addition to email, it's also quite helpful to utilize messaging within the medical billing portal itself. These would correlate with an email that goes out, which might let the user know that a new message was received or there's an unread message. Then the notifications would show throughout their experience and be consistently available for them to open and read. The notifications are marked as read after clicking and reading, so users will know they have completed the action.

The benefit here is that a user can see the notification even if they don't have access to their email. They will still get a visual indicator of an unread message and be notified, in spite of not seeing the email because -for whatever reason- they can’t view their inbox at the moment.

Depending on the sensitivity of the messages, it may be desirable to incorporate an additional verification for successful login. For added security, a multi-factor authentication can be employed whenever someone goes to view a message that contains sensitive data.

As an example, this type of behavior is commonplace on a lot of eCommerce applications, where you have to verify your identity or authenticate again before you can actually complete a purchase. On most instances this will be the case if you are using an existing credit card but sending to a different address. The same kind of thought process applies to medical billing portals. We basically want to consider the sensitivity level of the information about to be accessed, and whether we should redouble our efforts to verify the user is indeed who we believe them to be.

• Medical Billing Portal Overview
• Medical Billing HIPAA Compliance & Regulations
• Meet PHI Data Regulations with Data Tokenization
• HIPAA-Compliant Billing Software
• Portal Security and Penetration Testing Best Practices
• HIPAA-Compliant Database Software
• Sensitive Information Access Levels & Protection
• Administrative Security Measures Best Practices
• HIPAA-Compliant Web Hosting
• Secure Email Communication and Data Privacy
• Including Patient Insurance Providers and Physicians
• Integration Options for Medical Billing Portals