> Under HIPAA requirements emailing personal medical info is a massive no-no.
Doesn’t that only apply to covered entities, which the internet is telling me does not include the Social Security Administration.
Doesn’t that only apply to covered entities, which the internet is telling me does not include the Social Security Administration.
This is called "Individual Right of Access". If you ask a doctor to email your records to your personal Gmail, the doctor must comply. However, they are required to briefly warn you that email is unencrypted and insecure. Once you say, "I understand the risk, send it anyway," the doctor is no longer liable for any breach that happens during transmission.