In fact, the act provides limited control over the disclosure of information to other parties and only applies to information collected by the federal government and its agencies. The primary intent of the act is to allow individuals to discover, obtain, and correct or amend information collected about them by the federal government. Public Law 104-191, the Health Insurance Portability and Accessibility Act signed into law in August 1996, may pave the way to federal guidelines for electronic health information. The law also mandates Congress to enact legislation within 36 months of enactment of the act. Should Congress fail to enact legislation, the secretary of HHS is required to publish final regulations within six months of Congress's deadline.
Laws regarding health information are in place in many states.
Healthcare organizations considering the use of e-mail should take these laws into consideration. The most successful security measures combine effective policies with proven security hardware and software tools. The organization should have a clear understanding of its business process, so as not to introduce security measures that have a negative impact. In some ways, e-mail is similar to other types of communication tools. It would be wise to use existing communication policies, perhaps for the use of fax machines or the telephone, as guides when developing an e-mail security policy.