{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"Episode 629: Does HIPAA Require TLS 1.2+ for Email? What Practices Actually Need to Know","description":"Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech. In our latest episode, we answer a listener question and provide clarification on whether securing outbound email in Google Workspace (as discussed in Episode 623) would constitute a HIPAA violation. We discuss: Why blanket claims about HIPAA violations or HIPAA requirements from service providers or vendors raise our ethical hackles Opportunistic vs. forced TLS Legacy TLS and how it would be used with the forced TLS setting configured in Google Workspace What HIPAA actually requires for email security Where NIST (National Institute for Standards of Technology) guidance fits in The actual risk analysis for legacy TLS Benefits of secure email services, and when it might make sense to cancel Data to gather from your secure email service to do your own risk analysis Listen here: https:\/\/personcenteredtech.com\/group\/podcast\/ For more, visit our website. Resources for Listeners PCT Resources Episode 623: Now You Can Secure Outbound Email in Google Workspace Our earlier episode explaining the Google Workspace configuration that can require TLS for outbound email, what forced TLS does and does not protect, and how it fits into HIPAA security and risk management. PCT Article: A Practical Way to Secure Outbound Email in Google Workspace: What Mental Health Practices Need to Know PCT\u2019s detailed guide to enforced outbound TLS in Google Workspace, including the difference between opportunistic and enforced TLS, appropriate fallback methods, and considerations for deciding when ordinary inbox delivery versus escrow-style messaging is appropriate. PCT\u2019s Free Google Workspace Configuration Help Center Step-by-step guidance and video tutorials for configuring Google Workspace for HIPAA-compatible use, including the global outbound routing rule for requiring TLS. PCT Article: 3 Kinds of Email Security: How to Make an Informed and HIPAA-Aware Choice PCT\u2019s framework for understanding conventional email, TLS-secured email, and escrow\/portal-style secure messaging\u2014and choosing safeguards based on the information, client, and practice context. HIPAA Risk Analysis & Risk Mitigation Planning Service for Mental Health Practices \u2014 Care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You\u2019ll have your Risk Analysis performed by a PCT consultant using a tool built specifically for mental health practices, along with a mitigation checklist to help you reduce identified risks. PCT\u2019s Comprehensive HIPAA Security Compliance Program bundles: For Group Practices For Solo Practitioners Comprehensive HIPAA Security Policies & Procedures Forms and logs for documenting the implementation and maintenance of Policies & Procedures Device & Workspace Security Suites Direct support and consultation from the PCT team and therapist-attorney Eric Str\u00f6m, JD, PhD, LMHC HIPAA Risk Analysis & Risk Mitigation Planning service and tool HIPAA Security & Privacy Ethics training Group Practice Care Premium \u2014 Includes weekly live and recorded Group Practice Office Hours, including a monthly session with therapist and attorney Eric Str\u00f6m, JD, PhD, LMHC; the Device Security Suite; the Remote Workspace Security Suite; and additional direct support and consultation resources. Resources 45 C.F.R. \u00a7 164.312 \u2014 HIPAA Security Rule Technical Safeguards The regulation itself, including the Transmission Security standard at \u00a7 164.312(e). HHS: Are Covered Entities Required to Use NIST Guidance Documents? HHS expressly states that NIST guidance can inform implementation, but use of NIST guidance documents is not itself required by the HIPAA Security Rule. HHS: Is the Use of Encryption Mandatory in the Security Rule? HHS explains the Security Rule\u2019s risk-based approach to encryption as an addressable implementation specification and the requirement to determine and document reasonable and appropriate safeguards. Google Workspace Admin Help: Ciphers for Gmail SMTP TLS Connections Google\u2019s current documentation on Gmail\u2019s support for TLS 1.0\u20131.3, its preference for newer TLS versions, and its continued support for legacy TLS during outbound negotiation when newer versions are unavailable. NIST SP 800-52 Rev. 2: Guidelines for the Selection, Configuration, and Use of TLS Implementations NIST\u2019s technical guidance on TLS versions, configuration, cryptographic standards, and migration to newer TLS protocols. ","author_name":"Group Practice Tech","author_url":"https:\/\/personcenteredtech.com\/group\/podcast\/","html":"