HIPAA Compliant File Sharing: What the Rule Says | Curogram

A patient calls and asks for her imaging report by email. The front desk says HIPAA does not allow that. The front desk is wrong, and it is wrong in the direction that costs the practice a complaint.

File sharing is where most HIPAA confusion sits. Staff is told to be careful; nobody tells them what the rule actually says, and caution turns into refusal.

Our position is that three things get repeated as fact and are not. Encryption is not strictly required, cloud storage is not a pass-through, and a patient can insist on plain email.

What follows: what the rule says today, what the proposed update would change, and what to do this week.

Sharing Health Information Is Significant

Files move more PHI in one action than any other thing a practice does.

What Counts as a File

A chart export, a lab PDF, an imaging CD, a photo of an insurance card, a scanned referral. Each one is protected health information the moment it names a patient.

A text message leaks one detail. A misdirected chart export leaks a life, which is why file sharing carries more weight than the messages around it.

Where It Actually Goes Wrong

Rarely a hacker. Usually a staff member attaching the wrong PDF, or a free cloud account nobody signed paperwork for.

Standard texting is the other common slip. SMS is not encrypted in transit, so a file belongs behind a secure link rather than attached to a message.

How And When Patient Data Is Shared Depends On The Circumstances

The rule treats three situations differently, and most staff only know about one.

Treatment, Payment, and Operations

Sharing for treatment, payment, or health care operations needs no separate authorization. Sending a chart to a referred specialist is permitted.

Send only what the purpose needs. The minimum necessary standard applies to most disclosures, though not to treatment.

When You Need Written Authorization

Anything outside those three needs the patient to sign first. A marketing use or an employer request both qualify.

Intake is the easy win here. Clinics running HIPAA texting workflows in athenahealth collect ID and insurance uploads through a secure link. The file lands in the record rather than a staff inbox.

The Carve-Out Nobody Uses

A patient asking for their own records is different again. Under the right of access, they can ask for plain unencrypted email.

OCR's guidance says you must honor that. Warn them of the risk, note the warning, and send it. After it leaves, the exposure is theirs, not yours. Refusing is the thing that draws a complaint. Right of access has been OCR's most enforced area for years.

HIPAA Upholds And Protects Patient Privacy

The Security Rule is less prescriptive than most summaries claim, and that is about to change.

Encryption Is Addressable, Not Required

Under the HIPAA Security Rule as written, encryption is an addressable specification. You assess it, then either use it or record why an equal measure is reasonable.

Addressable has never meant optional. It means documented, and an undocumented decision is the part that fails an audit. Encrypt anyway. The paperwork for not encrypting costs more than the encryption.

What the Proposed Update Would Change

HHS published a notice of proposed rulemaking in January 2025 to overhaul the Security Rule. It would drop the addressable distinction and require encryption outright.

It is still a proposal. More than 4,700 comments came in. HHS projects a final rule in July 2027, which puts enforcement around 2028.

Plan for it now rather than budget for it later. Nothing in the proposal asks for something a careful practice is not already doing.

What a Mistake Costs

Penalty amounts rose on January 28, 2026. OCR applies four tiers by culpability, each with its own yearly cap.

The gap between the first row and the last is the whole argument for writing things down.

How Can You Remain HIPAA-Compliant When Sharing Patient Files Over Telemedicine?

Four practical rules cover almost every case.

Get a Signed Agreement, Including From Your Cloud

Any vendor that handles PHI for you is a business associate. Get a business associate agreement signed before the first file moves.

The myth worth killing is the conduit exception. HHS limits it to transmission-only services, so a storage provider is never a conduit.

A cloud provider holding patient files is a business associate even with no key to open them. HHS says so directly. Vendors like Curogram sign a BAA with Practice Fusion practices as a matter of course.

Send a Link, Not an Attachment

A link can expire, be revoked, and be logged. An attachment is gone the second it sends.

Enterprise networks running two-way HIPAA texting on Oracle Health keep plain SMS for scheduling. Anything clinical routes to an encrypted channel.

Write Down What You Decided

Run a risk analysis, record the encryption decision, train staff once a year, and keep the log. That record is what an investigator asks for first.

What To Do This Week

Three of the beliefs most practices hold about sharing patient records are wrong, and each one costs something different.

Treat encryption as mandatory, and you skip the real duty, which is documenting the choice.

Call a cloud account a pass-through, and you go without a signed agreement. Refuse to email a patient their own file, and you draw the complaint you were avoiding.

Start with an inventory. List every place a patient file leaves the practice. Then check which of those vendors has signed an agreement.

Most practices find at least one that has not. Fix that before the proposed rule makes encryption a requirement rather than a decision you wrote down.

See how patient files move through a secure link instead of an inbox. Book a Curogram demo.

Frequently Asked Questions