HIPAA Compliant Mailing FAQ

Outsourcing your healthcare-related print and mail can have many benefits for your communications and business objectives, including:

With over 40 years of HIPAA-compliant document processing and mailing expertise, we’re a trusted patient statement vendor whose solutions can reduce production costs, stimulate collections and comply with emerging regulations. We have worked with both healthcare providers and health insurance companies to securely process printed and electronic communications containing PII and PHI.

Print and mail companies like FSSI maintain HIPAA compliance by continually meeting all HIPAA compliant and security standards to keep sensitive data secure, including:

Health information alone is not PHI, but when it includes one of these identifiers it becomes PHI:

PHI is any health information that can be tied to an individual. This includes information used while providing healthcare, processing payments for healthcare or in health insurance. ePHI is basically PHI stored electronically on a hard drive, server, thumb drive or another electronic device.

The main HIPAA security requirements fall into three categories:
Physical – Includes the physical safeguards in place to secure access to physical equipment including computers, internet routers, data storage and other data devices.
Administrative  – Includes the policies and procedures that impact ePHI as well as risk management, system architecture and maintenance related to these security measures. This also includes other administrative aspects like HR and employee training.
Technical  – Includes the cybersecurity of the computers, mobile devices, encryption, network security, device security and anything related to the actual technology of storing and communicating ePHI.

The four essential HIPAA rules that govern compliance are:
The Privacy Rule –In this rule, any identifiable patient data is subject to privacy covered by the covered entity or associated business.
The Security Rule – This rule established the national standards for the mechanisms required to protect PHI data. These procedures extend across all stages of operations within the company.  This includes technology, administration, physical safeguards for computers and devices, and anything that could impact the safety of Protected Health Information.
The Breach Notification Rule –This rule specifies what an entity must do when a security breach occurs. Organizations must have a plan in place to notify the public and victims in the event of a breach.
The Omnibus Rule – This rule states that HIPAA requirements also cover associates, contractors and anyone working with a company. These companies need to update their gap analysis, risk assessment, and compliance procedures accordingly to cover any individuals working on their behalf.

Depending on the needs of the client, FSSI can use address verification tools, such as the USPS’ Coding Accuracy Support System (CASS), NCOA and Move Update Compliance, to help ensure each statement, bill or invoice reaches the hands of its recipient. Working with a CASS-certified provider ensures that your address data follows postal formatting and requirements and is in compliance with USPS standards. 

HITRUST stands for the Health Information Trust Alliance. It was founded in 2007 and uses the “HITRUST approach” to help organizations from all sectors – but especially healthcare – effectively manage data, information risk and compliance.

HITRUST certification by the HITRUST Alliance enables vendors and covered entities to demonstrate compliance with HIPAA requirements based on a standardized framework.

HITRUST was organized with the intent to provide an option for the healthcare sector to address information risk management across a matrix of third-party assurance assessments, with the hope of consolidating, reducing, and in some cases, eliminating the need for multiple reports. HITRUST refers to this design element as “assess once, report many.”

While FSSI does not have HISRUST CSF Certification, it has passed the HIPAA compliance requirements to be a HIPAA-certified print and mail provider. Both certifications have similar guidelines. Being HIPAA compliant ensures that FSSI follows the best practices for keeping highly sensitive data secure when accessing processing and storing protected health information.

HIPAA rules state that you must send PHI-related documents through First Class postal mail – never using standard mail. In some situations, you must use even Certified Mail, requiring the recipient to sign for the receipt of the mailpiece. An additional plus when sending mail certified, is that it’s also trackable, down to a signed record of delivery.

The following list includes examples of ways an organization can violate HIPAA – also extending to contractors and any vendor working with the organization: