Consider a scenario where a company operates a service which is HIPAA compliant. This service requires storing patient emails which may contain personally identifiable information (PII). This PII is redacted and encrypted when the email is stored at rest.

One day a problem occurs—the system crashes for certain emails, in a way that cannot be reproduced with the redacted emails.

To debug this problem engineers require the original email text.

What is the right procedure to expose it in a controlled manner? Is it even allowed?

  • What does encryption "at rest" mean? It is unclear why the task of debugging would require a patient's plaintext. Can't the analyst(s) create records for purposes of debugging? Dec 5, 2021 at 14:32
  • 3
    @IñakiViggers It means what it says. To quote the wiki, "Data at rest is used as a complement to the terms data in use and data in transit which together define the three states of digital data". To me this is a perfectly clear question that boils town to the situation when (1) those with the clearance cannot redact the email in such a way that it still reproduces the problem and (2) those who can do that lack the clearance. Then how do you proceed in this situation assuming that the defect is not to be tolerated. Dec 6, 2021 at 12:14

1 Answer 1


The HIPAA Privacy Rule governs disclosure of protected information. What you are describing is a business use of protected information by a covered entity that already possesses said information, which is not prohibited. In the case that an external company were assisting with the troubleshooting and support of the system, that company would have already signed a business associates agreement, which is what is required to allow them to access protected information under the Privacy Rule.

The Privacy Rule requires that the organization maintain a written policy for this sort of access, which would dictate things such as when this access is permitted, by whom, and any additional protections must be used (ex audit requirements, delete unredacted information from storage as soon as possible, don't save it at all, etc.).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .