Improve health outcomes with patient engagement reinvented

HIPAA-compliant messaging is communication between a patient and provider that meets HIPAA requirements to keep patients’ protected health information secure and private.

For covered entities, HIPAA-compliant messaging must:

• Ensure the confidentiality, integrity, and availability of all ePHI (electronic protected health information) they create, receive, maintain, or transmit
• Identify and protect against reasonable anticipated threats to the security or integrity of the information
• Protect against reasonable anticipated, impermissible uses or disclosures
• Ensure compliance by their workforce

When it comes to SMS & HIPAA and how to handle texting at a medical practice, we advise that you take additional steps to stay in compliance with HIPAA requirements, like getting explicit opt-in from patients, providing warnings that texting is not guaranteed to be secure, verifying phone numbers when they enter your system, and periodically re-verifying numbers. And of course, it helps to use a HIPAA-eligible messaging service that is built with HIPAA requirements in mind.

Secure messaging in healthcare means you’re taking additional precautions to protect patient privacy as you communicate about care plans, symptoms, and appointments. 

This is critical for healthcare messaging use cases because text messages aren’t inherently 100% secure. They’re delivered in an encrypted manner and there is no guarantee that the right person is the one who views the message once it’s delivered.

To keep messaging secure, there are some steps you can take to reduce the risk of unauthorized access to protected health information, like:

• Encrypting messages that contain PHI during transmission and storage
• Setting up access controls through user authentication and role-based permissions
• Creating detailed logs of who accessed PHI, when it was accessed, and what actions were taken
• Using secure communication protocols (such as TLS) to protect data while it is being transmitted over networks
• Authenticating user identities through multi factor authentication
• Establishing policies for data retention and deletion so PHI is only accessible as long as necessary.

Patient consent for text messaging is when patients give explicit permission for healthcare providers to send them text messages.

To secure patient consent for text message communications, healthcare providers should:

1. Clearly explain the purpose of the communications and the types of information included. 

2. State the potential risks of text messaging related to privacy and security.

3. Let patients opt in or opt out of communications and indicate their preferences for delivery method

4. Document patient consent