It is not a HIPAA breach to email patient names per se, although patient names and other protected health information (PHI) should not be listed in the subject lines of emails as the information could easily be seen by unauthorized people. The general rule is that PHI, including patient names, should not be shared or disclosed without the patient’s consent or in accordance with the HIPAA regulations. However, there are certain circumstances where patient names can be shared via email within a healthcare organization or with other covered entities, provided appropriate safeguards and security measures are in place. These measures include encryption of the email, secure network connections, and limited access to authorized individuals. Even when messages are secured with encryption in transit, message headers – which include the subject line and to and from fields – are often not encrypted and could potentially be intercepted and seen. A compliant email service like Paubox should be used to ensure safe transmission of PHI., Examples of PII include social security numbers, driver’s license numbers or financial account numbers (credit/debit). Do not put PII in the subject line of an email. Your internal email network may be encrypted; however, the subject line is not protected., Never include any PHI in the email subject line or file attachment name – just in case, make sure the subject line is encrypted in transit. If you mention PHI in the body, make sure the email is encrypted from transmission to delivery. Make sure the email is being sent to the correct recipient..