Personal Email and Cloud Storage: Where PHI Leaves Your Practice

In 2015, Metropolitan Hospital Center had to notify patients after an employee emailed protected health information to his personal account. According to NYC Health + Hospitals' own compliance report, he wanted to do hospital work while employed at another job. The system's data loss prevention program caught the transfer. The employee was terminated, patients were notified, and OCR asked questions.

That is an uncomfortable example for a medical practice because the shortcut is so familiar: send a spreadsheet home, put a referral packet in a personal drive, or save a scan somewhere it will be easier to open later.

Think of it as taking a patient chart out of the practice's locked records room and putting it in your own filing cabinet. Your cabinet might have a perfectly good lock. The practice still needs to know where the chart is, who can open it, and how to get it back when you leave.

What the hospital actually documented

The December 1, 2015 Corporate Compliance Report, on printed page 20, records this sequence for Metropolitan:

• June 1, 2015: Breach notifications were sent to affected individuals after the unauthorized transfer to the employee's personal email account.
• September 2015: OCR inquired about the breach, which Health + Hospitals had reported in June.
• October 16, 2015: The compliance office submitted its response to OCR.

These are notification and inquiry dates; the report does not give the exact day the employee sent the email. It also does not identify the email provider or announce a settlement amount. There is no basis here to label this a Gmail or Yahoo breach, or to attach a fine to it.

A cloud shortcut that became part of a $2.7 million settlement

Oregon Health & Science University provides another documented example. Its resolution agreement with HHS says workforce members disclosed the electronic PHI of 3,044 individuals to an internet-based service provider without obtaining a business associate agreement or other satisfactory assurance that it would safeguard the information.

• January 5, 2011 through July 3, 2013: The agreement identifies this as the period of the cloud-related disclosures and missing business associate agreement.
• July 28, 2013: HHS received OHSU's notification about the cloud-storage breach.
• July 18, 2016: HHS announced a $2,700,000 settlement and a three-year corrective action plan.

The settlement covered multiple compliance problems, including a separate stolen-laptop incident. It was not a $2.7 million charge solely for cloud storage, and the agreement was not an admission of liability. Its cloud findings nevertheless show why an account that works well for sharing files can still create a serious compliance gap.

What this means for personal Dropbox, Google Drive, iCloud, Gmail, or Yahoo

A staff member may have a strong password and MFA on a personal account. That does not put the account under your practice's management. Before patient information goes there, ask who controls access, which devices receive synced copies, whether sharing can be restricted, and what evidence you can retrieve if something goes wrong.

The same questions apply to a personal Gmail or Yahoo inbox used to send a referral, and to a personal Dropbox, Google Drive, or iCloud account used to hold one. These are examples of places to check in your own practice, not provider names established by the two case records above.

Do not assume that a business subscription or a familiar brand settles the issue. For a cloud provider maintaining electronic PHI on your behalf, HHS guidance requires a HIPAA-compliant business associate agreement, along with compliance with the other HIPAA requirements. That remains true when the provider stores encrypted information and does not have the decryption key. A BAA is necessary in that relationship; it does not replace your risk analysis or secure configuration.

Have your IT and compliance leads verify the actual account, covered services, agreement, and settings. A contract for the practice's managed environment should never be assumed to cover an employee's separate personal account.

Make the approved route usable

Ask a scheduler or billing coordinator to show you how they send a large file, work away from the office, or share documents with an outside billing service. If the approved route fails at those tasks, a reminder about policy will leave the problem in place.

Give staff a managed route they can use: an approved portal or file-sharing service, individual work accounts, appropriate access limits, and a clear support contact. Then test whether your team can revoke access when someone leaves, review sharing activity, and prevent work folders from syncing into personal storage. Keep MFA in place, but check the destinations and sharing rules too.

Patients' own email choices require separate handling. HHS says a patient requesting an accessible copy of their records may choose unencrypted email after a brief risk warning and confirmation. Follow your records-release process for those requests. That patient right does not authorize staff to keep working copies in their personal inboxes.

What to do this week

• Ask where staff actually put patient files. Include personal email, browser accounts, cloud drives, phone scans, and automatic folder backups. Ask about the task they were trying to finish.
• Verify the approved systems in writing. Record the account owner, services covered by the BAA where required, access settings, and person responsible for reviewing them.
• Test one everyday workflow. Have a staff member send a referral or share a large document through the approved route. Fix the obstacle that would otherwise send them back to a personal account.
• Review forwarding and syncing with IT. Look for work mail forwarded to personal addresses, public sharing links, and work folders copied to personal cloud storage. Put appropriate restrictions and monitoring in place.
• Give staff a reporting path for existing copies. If PHI has already left approved systems, involve your privacy lead promptly. Preserve relevant evidence and follow the incident-response process before coordinating migration, containment, or deletion. Assess breach-notification obligations rather than assuming that deleting a file resolves them.

Ask your practice manager, IT provider, and privacy lead to bring the answers to the same meeting. An approved-app list will not tell you much if nobody has checked how the work gets done.

If you cannot confidently map where patient information lives or who can reach it, a Secure Start assessment is a practical place to begin. Cube IT can help identify the gaps and prioritize the work, alongside your practice's HIPAA compliance efforts.