What is HIPAA compliant texting?

Today, five billion people across the globe can access and receive text messages. What’s more, 90 percent of text messages are read within three minutes. Orange is the new black. Texting is the new email. Many organizations are beginning to find ways to tap into this market and reach people more directly. The challenge faced with this type of messaging, however, is compliance. 

MAY 2020: In light of the recent COVID-19 pandemic, remote healthcare communication has never been more essential. Medical facilities must find ways to communicate virtually with patients to deliver faster results. This will help reduce the spread of the disease. But compliance for these communications is vital to data security. HIPAA-compliant texting, then, is a fast and effective solution.

Let’s run the numbers

In the healthcare sector, compliance is one of the biggest road blockers to texting. Despite the fact that 64 percent of people prefer text over voice as a customer service channel, many clinicians, doctors and pharmacists are unable to send protected healthcare information (PHI) via text.  

But the times, they are a-changing! In 2018, 45 percent of pharmacists and 35 percent of nurses said texting was used in their facilities, and many centers are now beginning to deploy HIPAA-compliant instant messaging (IM) as a way to improve communication between healthcare facilities and patients. According to a Gallop Poll, texting is the primary way that those under the age of 50 communicate.

What exactly is HIPAA compliant texting, though? And how can healthcare facilities ensure they are compliant?

What is HIPAA-compliant texting?

HIPAA-compliant texting is a form of secure messaging that allows doctors, physicians, clinicians and other medical staff to send protected health information between one another and to patients via secure messages.  Importantly, HIPAA-compliant texting does not have to be built on top of the traditional SMS network, but can also leverage newer technologies like instant messaging.

By opening up this line of contact, medical staff can begin improving communication channels and increasing operational efficiencies, sending faster results to patients and delivering a higher standard of care.

Simple, right? Not quite. For example, SMS wasn’t designed with the healthcare system in mind. Workers can’t just ‘send texts’ to patients. If they do, sensitive information like patient records and test results won’t be secured in-line with the Health Insurance Portability and Accountability Act of 1996 (or HIPAA).

Because of HIPAA, there are many technical procedures and safeguards in place to make sure that sensitive information doesn’t end up in the wrong hands. To send text messages securely, medical facilities must find ways to make their communications compliant.

Why is HIPAA compliance important?

HIPAA compliance is important for one main reason: it ensures that healthcare providers, medical facilities, clinics and pharmacists are safeguarding patient data and sensitive health information.

In short, HIPAA compliance:

• Safeguards privacy and confidentiality
• Reduces fraud and the risk of data leaks
• Improves cyber security measures taken by healthcare centers
• Increases operational efficiency at medical facilities
• Advances the speed and quality of healthcare provided to patients

For healthcare centers, HIPAA provides a robust and consistent framework that limits who can access and view health information. These restrictions keep confidential information away from the wrong people.

From an administration standpoint, HIPAA streamlines the communication between healthcare centers and patients. It’s also an effective way to standardize data regulation and compliance measures across the industry, ensuring all healthcare facilities abide by the same rulebook.

Why will your patients care?

HIPAA compliance is arguably more important for patients than it is for healthcare facilities. After all, it's their information being passed around. In 2018, for example, a hospital in Oklahoma was sued for an alleged HIPAA violation. According to the lawsuit, a boy’s biological mother was informed of his passing, even though she had ‘consented to the termination of her rights’ after putting him up for adoption. Sadly, cases like these are all too frequent. 

No healthcare facility wants to expose sensitive data or be the newsworthy subject of a data breach. Without best practice compliance in place, there would be no standard to adhere to, and no repercussions if facilities failed to keep sensitive information safe.

This regulation also gives control to patients and helps reduce human error, too (things happen if you're 14 hours into a busy shift). Healthcare centers can make mistakes and record information incorrectly, for instance, and patients who wish to obtain copies of their health information can check that this information. Not only does this improve transparency, HIPAA-compliant texting helps reduce error rate and reaffirms patient trust.

The four pillars of HIPAA compliance

Achieving HIPAA compliance isn't easy, but the good news is there is no weird initiation ceremony. In fact, there are four main rules that you need to understand in order to become HIPAA compliant. They are:  

• The HIPAA Privacy Rule
• The HIPAA Security Rule
• The HIPAA Enforcement Rule
• The HIPAA Breach Notification Rule

HIPAA Privacy Rule

This rule gives patients the right to obtain and view their healthcare records, and to request corrections. It also requires adequate safeguards of personal information and sets disclosure conditions of information shared without patient agreement.

HIPAA Security Rule

The HIPAA Security Rule is more technical and ensures that everyone involved in viewing patient records (including administrative teams, doctors, clinicians and physicians) does so with confidentiality and integrity to ensure personal health information remains secure.

HIPAA Enforcement Rule

The HIPAA Enforcement rule explains the investigative procedures and hearings that may be incurred should there be a breach of patient data. According to the HIPAA Journal, the penalties that you could face include:

• A violation as a result of negligence, which can lead to a $100 – $50,000 fine.
• A violation which occurred despite reasonable vigilance, which can attract a fine of $1,000 – $50,000.
• A violation due to ‘willful neglect’ which is corrected within thirty days. This can result in a fine between $10,000 and $50,000.
• A violation due to ‘willful neglect’ which is not corrected within thirty day. This will lead to the maximum fine of $50,000.

It’s important to remember that fines reflect the number of records exposed in a breach, the risk posed by the exposure of that data, and the level of negligence involved. 

HIPAA Breach Notification Rule

The HIPAA Breach Notification rule ensures that, if a breach occurs, the responsible healthcare facility notifies the patients involved. If a breach involves more than 500 patients, it also requires healthcare establishments to notify the media and the public. Ouch.

HIPAA compliance and Trillian

Trillian is a modern and secure HIPAA-compliant instant messaging platform that improves communication between healthcare facilities and patients. It's like texting, but better. We provide:

• Secure individual or group messaging
• Confidential file sharing
• Priority messages (like urgent messages)
• Encryption of messages while at rest and in transit
• Data retention periods
• The option for on-premises solutions, run behind the firewall

We help teams of all sizes improve clinical communication without breaking the bank. To find out more, visit the Trillian website today.