Imagine checking a personal email at work or at the public library and seeing this subject line show up in the alert box: “Confirmation of Patient Certification in the Medical Use of Marijuana Online System.”
That’s what happened to more than 6,800 patients in Massachusetts who have been approved for marijuana use as part of medical treatment, although after questioning by The Boston Globe, the state’s Department of Health has changed its ways. New emails will feature a softened subject line and no longer include the patients’ full names in the body of the message, The Globe reported earlier this month.
Patient privacy experts expressed surprise at the state’s original email wording, saying it failed to safeguard protected health information.
“They are supposed to protect the privacy of medical information,” David Szabo, a healthcare lawyer with Locke Lord Edwards LLP in Boston, told The Globe.
Massachusetts requires patients who can use marijuana, along with their prescribing physicians, to register with a state database.
In comparison, IT officials at a pair of Boston hospitals contacted by The Globe outlined more conservative approaches to emailing medical marijuana patients:
- Beth Israel Deaconess Medical Center’s emails to patients include a subject line that simply says “Important Information from Your Doctor.”
- Electronic messages from Partners HealthCare don’t include a patient’s personal information, instead prompting patients to log in to a Partners’ hospital’s website to view sensitive material.
Regardless of whether you agree with the medical marijuana movement, mentioning that information in an email subject line is a poor practice. It’s no different than getting an email from your provider saying a Rogaine prescription or birth control pills are ready. It’s protected health information, and mentioning it in the subject line of an email that a passerby could see raises questions about protection efforts.
Scott Wallask is news director at SearchHealthIT. Follow him on Twitter @Scott_HighTech.