We work with clinicians and practices to handle messages in whatever way is most convenient for them. Among other things, we can text doctors when they need to be contacted right away. But we do not rely on standard SMS. Instead, we use secure HIPAA-compliant messaging. How about your practice?
HIPAA security rules demand that protected health information (PHI) be treated with the utmost care. This information includes anything that can identify a patient or their health status. It includes names, contact information, health histories, and so on.
Let’s say a doctor is out of the office for the day. A patient calls with a question that would be best answered within a reasonable amount of time. It’s not an emergency, so office staff send the doctor a text via standard SMS. It may seem innocent enough, but there is a good chance that whoever sent the text has just committed a HIPAA breach. Whoever owns the practice is ultimately responsible for that breach.
Standard SMS Is Not Secure
The reason medical answering services do not rely on standard SMS is pretty straightforward: it’s not secure. It violates nearly every HIPAA standard. For example:
- It’s Not Encrypted – Standard text messages are not encrypted during transit. They are sent as plain text messages over cellular networks that are easily hacked. Messages can be intercepted by hackers and telecom employees alike.
- Messages Are Persistent – Even though a doctor can delete messages from his phone, those messages remain persistent on telecom company servers. There is no inherent right to delete said data, and that’s a clear violation of HIPAA.
- Access Is Not Controlled – Access to standard text messages is not controlled in the sense that anyone who picks up a phone could potentially open it and read messages without issue. Even an on-screen notification could reveal sensitive data without anyone having to actually pick up the phone.
- No Audit Trail Is Left Behind – Standards SMS leaves no audit trail behind. There is no way to know when a message is accessed, who read the message, etc. Note that HIPAA compliance requires an audit trail.
Standard SMS is fine for text messages that don’t contain PHI. But if your practice wants to utilize texting to convey messages falling under HIPAA regulations, standard SMS simply will not do. You need a secure, compliant messaging platform.
Sending Messages Securely
Rather than utilizing standard SMS, a typical medical answering service combines a secure app with what is known as the ‘notify-then-log’ workflow. Here’s an example of a common scenario illustrating how the process works:
- The answering service receives an urgent message, triggering a chain of events.
- The doctor receives a standard SMS or push notification urging him to check a secure portal for an urgent message.
- The doctor clicks a link or opens a secure app where the message is waiting.
- The doctor must verify with a PIN, fingerprint, or facial recognition to get into the app.
- Once in the app, the urgent message can be viewed in a secure manner.
Combining a secure app with the proper workflow not only keeps PHI off unsecured networks, but it also forces the clinician to think about HIPAA whenever viewing urgent messages. Both are important because practices can be fined as much as $50K per violation.
There is more we could write on this topic. For now, here’s the question: is your practice using standard SMS texting to send messages that contain PHI? If so, you’re facing a huge liability risk related to HIPAA violations. It’s time to find a new way to send urgent messages.
