can you email a patient a copy of her x-rays

Why not?

I had x-rays taken a couple of week ago, there was no printed copy, it was on computer, they had monitors in the exam room and merely opened them.

For them to be emailed they have to be on computer, not all facilities may or may not have that ability

This is a gray area as the emailed x-rays can be opened by virtually anyone. This is still being explored by HIPAA.

This question is not being "explored by HIPAA."

There is no part of the HIPAA Privacy or Security Rules that prohibits the emailing of patient records, including films, CDs, diagnostic images, etc.

The security of emailed Protected Health Information is covered in the HIPAA Security Rules (since 2005). This is one of the types of rules that allow the "covered entity" (i.e. doc, hospital, clinic, etc.) to determine whether it is reasonable, based on costs and other factors, to encrypt email. Most facilities and practices do not encrypt email for various technical reasons (mostly -- the receivers rarely have the same encryption certificates, hence the receiver wouldn't be able to open the email).

The sender of the email has the obligation to ensure that the email address is correct, and to be prepared to mitigate any situation in which the email lands at the wrong address.

Health & Human Services has directly answered your question as follows: (see Does the HIPAA Privacy Rule permit a doctor, laboratory, or other health care provider to share patient health information for treatment purposes by fax, e-mail, or over the phone?)

"Does the HIPAA Privacy Rule permit a doctor, laboratory, or other health care provider to share patient health information for treatment purposes by fax, e-mail, or over the phone?

Answer:

Yes. The Privacy Rule allows covered health care providers to share protected health information for treatment purposes without patient authorization, as long as they use reasonable safeguards when doing so. These treatment communications may occur orally or in writing, by phone, fax, e-mail, or otherwise. . .

The Privacy Rule requires that covered health care providers apply reasonable safeguards when making these communications to protect the information from inappropriate use or disclosure. These safeguards may vary depending on the mode of communication used."

Hope this helps.

Lane Hatcher
ADVERTISING REMOVED