Patient Data Sharing: Security Best Practices

Secure patient data sharing requires three layers: cryptographic controls (AES-256-GCM at rest, TLS 1.3 in transit), identity controls (MFA, role-based access, minimum necessary), and governance (BAAs, audit logs, incident response). The practical baseline: a HIPAA-compliant EHR, FHIR R4 API exchange for modern integrations, Direct Secure Messaging for provider-to-provider referrals, and a BAA-signing encrypted transfer service like HexaTransfer Enterprise for ad-hoc cases outside the EHR. 45 CFR Section 164.312, the HITECH Act, and state laws like Texas HB 300 and California CMIA layer additional specific duties.

The Minimum Necessary Standard

HIPAA 164.502(b) requires covered entities to disclose only the minimum PHI necessary for the purpose. This applies to internal use, disclosures to business associates, and disclosures to other covered entities (with exceptions for treatment purposes).

In practice:

• Referrals: share the clinically relevant subset, not the entire record
• Billing: claims data and supporting documentation, not clinical notes
• Research: de-identified or limited data sets when possible
• Legal: only what's responsive to the specific request
• Quality measurement: aggregated or de-identified whenever feasible

EHRs support this through role-based access templates (physicians see everything; front desk sees scheduling and insurance; billing sees financial but not notes). Configure these by role, not per-user.

Patient Consent: When It's Required and When It Isn't

HIPAA distinguishes between treatment/payment/operations (TPO) — which don't require patient authorization — and other uses, which generally do.

TPO exceptions (no authorization required):

• Sharing with other providers for the patient's treatment
• Billing and collection
• Quality assessment, training, accreditation

Authorization required:

• Marketing communications (with narrow exceptions)
• Sale of PHI
• Research (unless IRB-approved waiver)
• Psychotherapy notes (most disclosures)
• Employer inquiries about specific employees

State laws add stricter consent requirements. California CMIA requires patient authorization for many disclosures that HIPAA permits. Texas HB 300 imposes additional training and notification requirements. Check the most restrictive applicable law.

Provider-to-Provider: Direct, FHIR, TEFCA

For legitimate treatment purposes, providers have multiple exchange options:

Direct Secure Messaging: S/MIME secure email within the DirectTrust trust framework. Built into every certified EHR. The workhorse for care transitions.

FHIR R4 API: RESTful exchange for real-time record access. Mandated under ONC Cures Act certification. Enables applications like Apple Health, Epic's Care Everywhere, and payer-provider data exchange.

TEFCA (Trusted Exchange Framework and Common Agreement): the federal framework for nationwide exchange, launched in 2023 with several Qualified Health Information Networks (QHINs). Expands record access across the country.

CommonWell and Carequality: pre-TEFCA exchange networks that many EHRs connect to. Often the path of least resistance for cross-organizational treatment data.

Patient-Facing: Portals, APIs, and Third-Party Apps

The Cures Act requires certified EHRs to provide a patient-facing FHIR API. Patients can:

• Access their records through the provider's portal (MyChart, FollowMyHealth, HealtheLife)
• Connect third-party apps (Apple Health, Fitbit, research apps)
• Request electronic copies under HIPAA right of access (164.524)

Providers can't block patient-directed access to a third-party app just because they don't trust the app's security. That would be information blocking under the Cures Act, subject to CMP enforcement.

What you can do: offer patient education about third-party app security, require the patient to authenticate before the first connection, and log the authorization.

Secure Transmission Methods by Use Case

Different situations demand different channels:

• Urgent clinical referral: Direct Secure Messaging, or phone plus EHR note
• Routine consultation request: Direct, CCDA attachment, or FHIR API
• Imaging transfer: cloud image exchange (Ambra, LifeImage), DICOMweb, or encrypted physical media
• Lab results: HL7 v2 over VPN, or FHIR Observation
• Insurance prior authorization: X12 278 transaction or payer portal
• Patient communication: portal secure message, BAA-covered email (Paubox, Virtru)
• Emergency records release (under 164.510(b)): verbal with subsequent documentation

Never default to unencrypted email, SMS, or consumer messaging for PHI. Those channels are allowed only when the patient specifically requests them and you've documented their informed consent to the risk.

Encryption Baseline: What Good Looks Like

HIPAA's Security Rule treats encryption as addressable, but in 2026 anything less than modern encryption is indefensible:

• At rest: AES-256-GCM for disk and database encryption
• In transit: TLS 1.3 preferred; TLS 1.2 acceptable with approved cipher suites; TLS 1.0 and 1.1 forbidden
• Key management: HSM-backed (AWS KMS, Azure Key Vault, Google Cloud KMS, on-premise HSMs)
• Password storage: never in plaintext; use Argon2id or bcrypt
• Backup encryption: same AES-256-GCM standard as production

For end-to-end encrypted transfers, implementations use AES-256-GCM with per-file keys derived via PBKDF2 (600k+ iterations) or Argon2id from a user-supplied passphrase. The key never touches the server.

Audit Logs That Actually Help During Investigations

Section 164.312(b) requires audit controls. Logs should capture:

• User identity (tied to unique user ID)
• Timestamp (UTC, synchronized via NTP)
• Action (view, create, update, delete, print, export, download)
• Target record (patient MRN or equivalent identifier)
• Source (workstation, IP, application)
• Result (success, failure, denied)

Send logs to a centralized SIEM (Splunk Cloud, Microsoft Sentinel, Elastic Security, Datadog). Retain for at least 6 years. Protect against tampering: once written, logs should be append-only, with cryptographic integrity (hash chains, S3 Object Lock, or WORM storage).

Quarterly, review audit logs for anomalies: after-hours access to VIP patients, bulk downloads, access to records of personal acquaintances (co-worker snooping is a perennial HIPAA violation pattern).

Handling Breaches: The 60-Day Clock

If PHI is compromised (lost laptop, phishing, ransomware, inadvertent disclosure), you're on a timeline:

• Discovery: start of the clock
• Containment: hours to days
• Assessment: within days, determine scope and affected individuals
• Notification to affected individuals: within 60 days
• Notification to HHS: within 60 days if 500+ affected; annually for smaller breaches
• Notification to prominent media: within 60 days if 500+ state residents affected
• State AG notification: per state law, often concurrent

Enterprise covered entities typically budget for a retained breach counsel, a forensics firm on call, and credit monitoring vendor relationships pre-established. Setting up these contracts after a breach costs triple.

Special Categories: Mental Health, Substance Use, Genetics

Some categories carry stricter rules:

• Psychotherapy notes (164.501): separate authorization required for most disclosures
• Substance use disorder records (42 CFR Part 2): federal confidentiality law stricter than HIPAA; recent 2024 revisions aligned with HIPAA in several areas but retained consent requirements
• HIV/AIDS status: many state laws require specific consent
• Genetic information: GINA prohibits certain uses; state laws add requirements
• Minors' records: state law governs parental access and adolescent consent

Build these distinctions into your EHR's consent management and release-of-information workflow. A single "release all records" button that dumps SUD records without Part 2 consent is a federal violation.

Training That Changes Behavior

Annual click-through HIPAA training doesn't change behavior. More effective:

• Quarterly phishing simulations with immediate remediation for clickers
• Role-specific scenarios (front desk, nurse, physician, IT, billing)
• Case studies from real OCR settlements, with dollar figures
• Tabletop exercises for incident response
• Clear sanction policy actually enforced (HIPAA requires it, many organizations ignore it)

Document completion rates and test scores. Retain training records for at least 6 years.

A Workable Patient Data Security Program

• Governance: HIPAA privacy officer, security officer, quarterly risk review
• Technical: HIPAA-compliant EHR, FHIR APIs, Direct, SIEM, MFA everywhere
• Administrative: WISP, training log, incident response playbook, BAAs with all vendors
• Physical: badge access, workstation lock policies, device encryption
• Insurance: $5M+ cyber policy appropriate to organization size
• Ad-hoc transfers: BAA-signing E2EE transfer service

Try it at hexatransfer.com — free, no account, 10 GB max.