Emailing Confidential CDHA Personal Health Information or Business Information:

Important Changes and Information you need to know as a CDHA Clinician/Researcher

Like any tool you use in medical practice, email has benefits and risks. Educating yourself on how to use email responsibly in your practice is important, as the standards for maintaining the privacy, confidentiality, and security of email in healthcare are higherthan those for personal email use. Effective clinical documentation and communication are also considerations when using email. Inappropriate use of email can compromise patient safety and privacy and result in liability.

Most importantly:

  • Your cdha.nshealth.ca email account must be used to communicate CDHA confidential personal health information or business information (“CDHA confidential information”). Need help with your cdha email account: Call IT at 473-3399
  • Dal.ca email accounts are no longer appropriate for sending, receiving or storing CDHA confidential information, as they are switching to Microsoft 365.
  • Communication of CDHA confidential information to a recipient using a non-nshealth.ca email account or gov.ns.ca email account must be properly encrypted using CDHA approved tools

Please read the following document in its entirety to get the information you need.This document uses a question and answer format to address a number of important issues involving the emailing of CDHA confidential information securely to avoid privacy breaches and professional liability.

Emailing Confidential CDHA Personal Health Information or Business Information:

Frequently asked Questions

I’ve heard Dalhousie is switching to Microsoft 365 and Dal email is no longer to be used to share personal heath information? Is this true? I use it to email patient information to clinicians and researchers I collaborate with, as well as for teaching.

After discussion with Dalhousie University, both institutions agreed that personal health information is not to be emailed using your Dalhousie email account, as it was not intended for this purpose. The legal standard for the transfer and storage of personal health information is higher than for other less sensitive information. You may have already received information from dal about the migration.

Can I use gmail or another external account? I’ve never used my cdha.nshealth.ca account and heard that some clinicians don’t like it.

No. Email accounts such as gmail, hotmail, yahoo, etc are not secure for transferring personal health information. Web-based email services can lack important security features. CDHA’s policy, Email Acceptable Use CH50-045, in place since November 2011, states:

2.2.5. Do not email any identifiable confidential patient information or confidential, sensitive business information outside the Capital Health/NSHealth network unless appropriately secured with encryption. [NOTE: A discussion of CDHA’s approved encrypted email file transfer service, send.nshealth.ca, follows later in this memo]

2.2.6. Do not automatic forward any confidential patient or business information to an external mail account.

Check with IT at 473-3399 before using any unapproved electronic information transfer system to ensure it has proper encryption.

I understand personal health information is defined in PHIA. What is considered CDHA confidential sensitive business information?

CDHA confidential sensitive business information includes for example, employee financial information, performance reviews and disciplinary actions, and sensitive credentialing committee documentation. For more information, see CDHA’s Email Acceptable Use Policy, which is available on the intranet:

So basically I have to use my CDHA email account to communicate CDHA confidential information…but I’ve heard under Nova Scotia’s new health privacy legislation (PHIA) we can’t email personal health information to clinicians anymore.

PHIA requires us to first use de-identified information if it can achieve the purpose; otherwise, only the minimum amount of personal health information to achieve the purpose can be used. Please remove patient identifiers (e.g. patient name, MRN, HCN, etc ) if they are not required to achieve the purpose of the email and only send emails containing patient information to those colleagues who need to know. Think about whether the information is available to the recipient on a clinical information system rather than emailing it.

Also we are legally required to ensure emails containing personal health information are secure. At this time, emails sent from a cdha.nshealth.ca email account to another nshealth.ca email account are considered secure as they travel within the internal nshealth.ca firewall. You may also send emails securely from your “cdha.nshealth.ca” account to a recipient with a “gov.ns.ca” email account.

What do I do to transfer personal heath information to clinicians or researchers in Nova Scotiawithout an nshealth.ca/gov.ns.ca account, Canada or elsewhere? Healthcare is crossing boundaries.

  • Use send.nshealth.ca:
  • You can invite individuals from the outside to use this service and download files securely. However, the subject line and the body of the SEND message are not secure and should never contain personal health information (i.e. health card number or patient name).

See the “Getting Started” instructions on the login page for details. HITS-NS also has FAQs on their intranet site:

So what are the risks emailing confidential patient information inappropriately? What are the consequences?

Risks include:

  • Unsecure email is more likely to be intercepted or hacked and information used for identity theft. Email can be forwarded to 3rd parties, circulated, stored and even changed without your knowledge or permission.
  • It is easier to falsify an email than a handwritten or signed hard copy. It is impossible to verify the sender’s true identity and whether an email account was created to impersonate a clinician or patient or is a result of a phishing scam.Healthcare does get targeted. Recently, CDHA procurement card holders were sent emails from individuals pretending to be the BMO, which asked users to update personal/ credit card information online to get a security update.
  • Email senders can easily misaddress an email to the wrong individual or distribution list, often due to the email system automatically filling in a contact based on the first letters you type.Attaching the wrong electronic file to an email has also resulted in large privacy breaches involving hundreds of patients’ personal health information in the US recently.
  • While email is often felt to be timelier, clinical information that needs to be communicated urgently if emailed may not be checked right away by the user, either because they are unavailable, technical delays occur in delivering the message, or they no longer use the account, resulting in compromised patient care.
  • Clinically important email communications may not be documented in the patient’s health record and are unavailable to colleagues who need to know this information.

Possible Consequences include:

  • In the case of a privacy breach or unsafe information practices, patients can make a complaint to the Privacy Officer, the Provincial Review Officer, or your professional college, which can result in suspension or fines. They may also choose to start a lawsuit. For example, a health region in Ontario is being sued by patients after a staff member lost an unencrypted USB stick.
  • If patient care is compromised due to a lack of email documentation on the patient’s legal health record or ineffective email communication, professional liability may result.

The CMPA has also released guidance for physicians regarding the legal risks of email use for communicating patient information:

I’ve also heard that our cdha email account can’t handle large files.

Cdha.nshealth.ca email accounts, like all corporate email systems, have limits on what can be stored and transferred via email. If you try to send an attachment via email that is too large, you will receive an undeliverable message in your cdha email inbox. For larger files, use the send.nshealth.ca service at: is encrypted and can handle files up to 2 GB in size. It is used by healthcare institutions, such asHarvard Medical School and Beth Israel Deaconess Medical Center, and other organizations (e.g. NASA).

If you are repeatedly sending large files that cannot be sent via regular cdha email, contact IT at 473-3399 to discuss possible alternate solutions.

If an individual is trying to send you a large file and is encountering difficulties, it may be because your cdha.nshealth.ca email account is full. Your cdha email account can store up to 2MB. It is important that you save large attachments securely on your cdha personal or shared drives as appropriate after receiving them, and then delete them from your email account to save space. You should also save or delete old emails to maintain space on your email account. An outside email message may also be undelieverable to you because of the sender organization’s email set up or the nshealth.ca network firewall rules. Please contact IT at 473-3399 if the sender believes the problem is related to our firewall.

Colleagues have also told me that their cdha email account gets a lot of announcements/spam.

If you are concerned about getting unwanted emails/notifications, Outlook has some filtering capabilities. Accompanying this document is a step by step guide, including screen shots, developed by CDHA IT to explain how to route unwanted mail into separate folders instead of your main email inbox.

However, be careful about what you filter as both the organization and your departments use CDHA email to communicate significant events that may affect you and your patients, such as the recent mock power outage or the gas leakage in South End Halifax. For example, emails sent from CDHA with the title LIFELINESare designed to communicate urgent time-sensitive information.

I need to be able to access my email on my mobile devices. Is my cdha.nshealth.ca email account available on apple or android devices, as well as Blackberry devices?

Your cdha.nshealth.ca email is currently available for use on blackberry and apple devices. CDHA IT Services is working on enabling cdha.nshealth.ca email accounts securely on android devices and anticipate availability of this service in the next two months. Contact IT for more information.

What if I want to work from home? I often email research and clinical documents to my home email address rather than use a USB stick or print paper I might lose.

Request a remote access account if you need to access files or clinical information systems on the nshealth.ca network outside of office hours. See CDHA’s Remote Access Policy (CH50-070) for details.

What about emailing personal health information to patients? I get a lot of requests.

Capital Health is working on a policy and consent form regardingemail communications with patients. We have a legal duty to explain the risks of emailing personal health information to patients and many patients and providers do not understand these risks fully. In the interim, Legal Counsel and Privacy have developed guidelines that restrict emailing personal health information to patients to the most exceptional of circumstances. For more information, contact the Privacy Office.

How do I document clinically relevant information contained in emails?

Any email communications should be treated in the same manner as progress notes or other clinical documentation, and should be placed on patient's health record where related to care and not otherwise documented in the chart. Email communications should not, however, replace other documentation required in keeping with professional practice standards.

What about the privacy of my emails sent using my cdha.nshealth.ca email account? Who can view them and in what circumstances?

CDHA’s Email Acceptable Use Policy, CH50-045, outlines the process by which a user’s emails may be accessed as part of an investigative process. The policy is in line with other similar institutions, such as Dalhousie University.

1