Protecting Electronic Health Records in Transit and at Rest

Healthcare providers need to communicate and exchange the clinical and administrative data from Electronic Health Records of patients. The Health Insurance Portability and Accountability Act (HIPAA) of 1996 requires the safeguarding and protection of Electronic Health Records when in transit and in storage. This paper presents a solution to protect Electronic Health Records in both states, in transit and at rest. Our secure data container guarantees data confidentiality and integrity and supports different data formats, including text and images. It can work in environments with limited Internet connectivity, which is important at times of disease pandemics or natural disasters. The potential benefit of this solution for healthcare providers would allow emailing data to patients in the form of our data container without using a HIPAA-compliant email server. This technology supports the ability to send and receive medical record documents, for a single encounter or encounters related to a condition, (1) allowing patient to download and keep their personal health record; (2) sharing continuity of care information with a provider referral to ensure medication reconciliation, for instance, with providers who are outside the information exchange network; and (3) delivering medical records securely to an insurance company who requires notes for a submitted claim. To address the problem of clinical and administrative data exchange between different healthcare providers across multiple networks, states and countries, our methodology allows patients to download and store their Electronic Health Records locally.