To Text or Not To Text Patients? The Message from HIPAA.

 

Most of the 1.9 trillion texts Americans sent from their smartphones to friends and family last year wouldn’t be secure enough for healthcare settings. It’s unfortunate, because texting is a quick, easy and effective way to communicate.
It’s probably also no surprise that texting is the most popular smartphone feature, according to a 2015 Pew Research Center survey,  and 97% of Americans use their phones to text.
But like most other things, different rules apply in the healthcare world.
The HIPAA/HITECH privacy and security rules cover any communication with electronic protected health information (ePHI), including e-mail, social media and text messages. In an actual case, providers at a nursing facility requested nurses text them patient information. Even without evidence that an unauthorized person saw the messages, CMS intervened with a 10-point remediation plan to retrain staff, appoint a HIPAA security officer and revise their HIPAA policies and procedures.

Remember that texting leaves a record, unlike telephone calls. Plus it’s easier to know you’re reaching the correct person on the phone. The risk of texting sensitive patient information to another person is not zero – in public surveys, about one-third of people say they’ve mistakenly sent a text to the wrong person.
In addition, HIPAA/HITECH privacy violations can carry hefty fines, up to $50,000. So avoiding the temptation to text a colleague for a quick patient consult could save you money as well.

HIPAA Compliant Texting
Even so, the Joint Commission did not rule out all texting, according to Andrew A. Brooks, MD, orthopaedic surgeon and Chief Medical Officer at Tigertext, a secure mobile messaging firm.  In a piece for the American Academy of Orthopaedic Surgeons, Dr. Brooks points out that minimum requirements for HIPAA compliance include:
* Secure data centers—Onsite or offsite (cloud) data centers must use a high level of physical security and policies to review controls and conduct ongoing risk assessments.
* Encryption—ePHI is encrypted both in transit and at rest.
* Recipient authentication—Confirmation that any communication containing ePHI only goes to its intended recipient.
* Audit controls—The ability to create and record an audit trail of all activity, including text messages containing ePHI.
The sheer volume of text messages indicates an overall preference for this form of communication. The 1.92 trillion texts last year is almost double the 1 trillion sent in 2008, so who knows how many texts Americans will send going forward.
Texting Appointment and Wellness Reminders
Your practice may already send patients text reminders for upcoming appointments. There’s evidence this strategy can reduce your patient no-show rate. HIPAA rules generally do not apply to communications without ePHI.
Text reminders also seem to help patients with medication, healthcare and lifestyle reminders. As examples, researchers show chronic disease text messaging can help patients manage their diabetes, remind African-Americans with high blood pressure to take their medication, and help people increase their exercise and physical activity levels, although some say more research on best practices is needed.
Healthcare vendors offer apps that promise secure texting and would allow physicians and medical professionals to communicate within a HIPAA-compliant platform. Verify information complies with HIPAA because government agencies do not vet many of these apps. Also, if you chose to use a third-party secure texting platform, keep in mind the three requirements for securing PHI: confidentiality, integrity, and availability. Any platform chosen must satisfy all three elements, according to Mellette PC Healthcare Provider Attorneys in Virginia.
Another option, now that more than 80% of physicians use electronic health record systems, is to communicate with patients by sending e-mails through a secure patient portal. As you probably know, secure portals can help eligible providers meet Meaningful Use.
Whatever strategy you use, remind your staff to never transfer ePHI through non-secure methods of communication. And while we congratulate you on moving to the world of quick and convenient electronic communication with patients, here at Power Your Practice we also don’t want to see you financially penalized.
Figured out a great way to reach patients – and hear back from them – without violating HIPAA? Share your tips with colleagues below.

Damian McNamara

Damian McNamara is a Content Marketing Writer & Editor. He brings his journalism experience covering 18 medical specialties to cover practice management, cloud technology and health IT best practices to Power Your Practice readers.

• 
  View all posts by Damian McNamara →

What Disruptive Quality Means to Me & ClaimPay MD

"A disruptive quality about my opportunity is that right now is revolutionary timing for a rapidly changing Industry. The Healthcare  is now one of the top growing Industries, bringing in billions of revenue each year. With updates on Regulations & Laws, Electronic Data & Security Breeches, Insurance Policies & Payment Procedures, to ICD-9 Coding advancing into ICD-10, and electronic health records exchange and patient powered care-we all see in the news that there is a lot of change going on in Healthcare and this can be quiet an Head Ache & costly for Medical Providers.  In order to keep up with the consistently changing trends in this market, there is a lot of training to do.   Innovation in the Healthcare Industry is an  advancing evolution and outsourcing,  has become a new resource for the medical world. With headlines reading that outsourcing is the new choice many providers are making- to cut costs and get rid of their in-house billing department right now is the perfect time to start up ClaimPay MD.. This is a new and trendy innovation that helps create a new value and market in network with this ever growing Industry.  And this will eventually disrupts the existing market of in-house billing and replace the value network by displacing that earlier technology of using in house administration, and becoming a new technology outsource for the future."    

by *Toni Lauren Vossen October 7th, 2015 

Providers and clearinghouses will populate the database by providing information about 10 key metrics:

Providers and clearinghouses will populate the database by providing information about 10 key metrics:

1. Payer name/line of business.
2. Is the payer indicating that it will map from ICD-10 to ICD-9?
3. Is the payer indicating that it will dual code in ICD-9 and ICD-10?
4. Testing type/testing date/returning information/triggering ICD-10 edits/dates of service.
5. The URL from the payer’s website where information on their ICD-10 testing (including the testing plan) can be found.
6. Does the payer allow for the scheduling of future service testing dates?
7. Will a clearinghouse need to set up a new connection for ICD-10 testing?
8. Will the payer be rejecting or denying claims for unspecified diagnosis codes? 
9. Is provider and submitter registration required? 
10. With whom will the payer be supporting testing?

“As more and more payers’ testing information goes online, this will be the most dynamic tool for providers and clearinghouses to have as they plan and execute their testing strategies,” said CE Executive Director Tim McMullen.

2nd-cecosesola-washington-cooperative-exchange