Texts and HIPAA: Communication and Healthcare
The medical field is full of time-sensitive, vitally important communication. It can be difficult to worry about how everyone will receive information, especially if you’re already worrying about how everyone will receive the proper treatment or the correct diagnosis.
What’s the fastest way to notify a patient that their medication has been recalled? Or to ensure that the nurses in ICU know to expect a transfer within the next ten minutes? Or to alert clients to a measles outbreak? Or to remind a patient of their appointment?
These days, the answer is often text messages.
This kind of communication is useful to those in most professions, but perhaps most so in healthcare. Those working in or receiving services from the medical field often have the most to gain from instant, clear, recorded information.
But the decision to use SMS communication isn’t only up to doctors. HIPAA (the Health Insurance Portability and Accountability Act) regulations and patient preference also govern this decision. Fortunately, there are many ways that healthcare professionals and patients can use text messaging to their benefit, even within these guidelines.
Here, we discuss what types of communication are regulated by HIPAA, as well as three of the ways healthcare professionals can make use of SMS text messaging.
HIPAA Text Messaging Regulations
In general, using traditional, unencrypted text messages to transmit protected health information (PHI) – such as details about specific medical cases – between professionals or between a professional and a patient is not considered HIPAA compliant. While HHS does not prohibit electronic communications with patients, including texts, the HIPAA Security Rule requires that appropriate safeguards be in place whenever electronic PHI is transmitted. Standard SMS lacks the encryption and access controls necessary to meet these requirements.
There are many things that can happen to a phone or message that make it difficult to ensure a message’s integrity and privacy. For example, it’s common for smartphone owners to misplace or lose their phones. Other times, phones are stolen. Even more frequently, texts are sent to the wrong number.
All of these possibilities increase the likelihood that someone ends up with another person’s health information, which is what HIPAA works to prevent. There are compliant approaches to texting in healthcare, however. The HIPAA Security Rule is technology-neutral, meaning it does not prohibit any specific communication method — but it does require that appropriate administrative, physical, and technical safeguards be applied to any electronic transmission of PHI. Using a HIPAA-compliant secure messaging platform, for example, can provide the encryption, access controls, and audit capabilities needed to protect patient information.
Still, there are other parts of running a medical practice or otherwise working with patients that can be handled over texts within the confines of HIPAA regulations.
Importantly, healthcare providers should obtain and document patient consent before initiating text communications. Under HIPAA, patients also have the right to request that their provider communicate with them through alternative means or at alternative locations (45 C.F.R. § 164.522(b)). If a patient initiates a text conversation with a provider, the provider may generally treat that as the patient’s preference for that communication method, but documenting consent remains a best practice.
HIPAA Compliant Appointment Reminders and Patient Communication
One way that doctors and medical practices can communicate with patients via text messaging is through reminders. These can be reminders about prescription pick-ups, medication dosage, appointments, or other aspects of their care.
Many of these reminders are so general that they don’t fall under the category of information protected by HIPAA. A doctor’s office could, for example, send a reminder text message that flu season is coming up and flu shots are available at a discounted rate on certain days. A pharmacy could send a message detailing that a patient’s prescription refill is ready for pickup.
Other reminders are more specific, but still allowed through HIPAA because the protected information itself is not included in the message.
In these cases, the messages often include a link to a website or other contact information for the patient to follow up. This could include a reminder for an appointment with a link to the practice’s secure website to update current health info. It could also include a reminder that some sort of test results are ready, and advise the patient to call the included number to talk with their doctor. Neither of these examples send the information directly, but they do allow the patient to access it quickly and easily.
Ensuring HIPAA Compliance in Text Messaging for Employee Communication
Another way that those in the healthcare profession can use text messaging is for communication to and between employees. Many internal communications – such as scheduling, staffing updates, and administrative notices – do not involve protected health information and therefore fall outside HIPAA’s requirements.
Some of this employee communication has little to do with their connection to the medical field and much more to do with the basics of employee communication in any field. This includes mass notices like those for staff meetings or fun activities.
Other employee communication can serve as reminders about general activities that affect staff. However, care should be taken with any message that could identify a specific patient – even a text noting that a patient is being transferred to a particular unit could constitute PHI if it identifies the individual. The HIPAA minimum necessary standard (45 C.F.R. § 164.502(b)) applies to internal workforce communications, so messages should be limited to only the information needed for the recipient to perform their role.
HIPAA Compliant Texting for Emergency Updates
Hospitals and other medical practices serve an important role in the community. One way that they can make the most of this important role is to keep the community informed during disasters or emergencies. This ability can be crucial because many medical practices hold a unique position where they can engage many different community demographics.
This places hospitals on the front lines when the community may need them most. If hospitals have a fast and consistent way of communicating with the community, they can help those who trust them to make the best decisions.
For example, during particularly hazardous weather, a hospital could send out a mass text message advising patients not to travel. If a patient replied, the hospital could perhaps put the patient on the line with a doctor who could help weigh the potential risks or benefits of leaving their home to seek treatment.
Similarly, the medical practice could send out alerts about recalled food and drugs, disease outbreaks, and other crises that could potentially put their patients at risk within the community.
HIPAA Compliant SMS Text Messaging Solution
While the HIPAA Privacy and Security Rules do not prohibit text messaging, they do impose requirements on how protected health information may be transmitted electronically. With the right tools and practices, texting remains a valuable communication method in healthcare.
With DialMyCalls, using SMS text messages for your medical practice or other healthcare related company is easier than ever. Our services allow users to send personalized individual or mass text messages to any number of contacts from a predetermined list at any time — scheduled or at the spur of the moment.
What’s more, the response or replies to these messages can be tracked and recorded to let you know what your recipients most need or want from you.
Important: This article is for informational purposes only and does not constitute legal advice. Healthcare organizations should consult with qualified legal counsel to ensure their communications practices comply with HIPAA, applicable state privacy laws, and the Telephone Consumer Protection Act (TCPA).
