Messaging apps have become the most common way for people to communicate. There are more messages sent than phone calls (more than 2 trillion messages were sent last year in the US). In fact, many choose to message rather than call for just about all types of communications. Messaging apps make it easy to send along attachments such as documents, pictures, and videos. Because of the pervasiveness and ease of use, it is very tempting to use messaging apps to send patient information to staff members within a practice. This would be a huge mistake.

HIPAA Regulations

Let’s go over the parts of the HIPAA regulations that relate to messaging. These are:

• All access to PHI must be limited to only authorized users who also need access to the information to do their job
•  Monitoring must be in place for authorized users are when they access PHI and how it used
• All data that is transmitted outside of an organization’s network must be encrypted

Nearly all messaging apps fail on all, or most, of these points. SMS, in its standard form, is completely unusable for PHI. The data isn’t encrypted and is easy to intercept along the way. In addition, sending messages to the wrong person is a real danger and if that data isn’t encrypted, then you have sent PHI to an unauthorized party. This is similar to leaving a message on voicemail for someone with PHI and finding out it is the wrong number.

Sending PHI via messaging apps

Generally, there are two scenarios for using messaging apps with PHI. These are messaging patients and internal practice communications.

If your practice wants to send messages to patients, then you must use a system that is set up to be HIPAA compliant. Each message sent through a non-compliant system is a violation on its own. Normal SMS, WhatsApp, Facebook Messanger, etc. are not compliant and cannot be used. After setting up a compliant messaging system, you also must get each patient’s permission, in writing, to message them via the system.

Internal communications are a more common use of messaging apps in healthcare. This is possible through a variety of services, but just like with email, you must have a Business Associate Agreement in place with the service provider.

Take away

• Generally, do not use any type of messaging app to send PHI.
• If your practice’s policies and procedures allow for this, ensure that the system offers end-to-end encryption.
• You must have a Business Associate Agreement with the service provider.
• Do not send patients PHI, even if you have a secure system until you have their written permission.