Other instances in which text messaging is HIPAA compliant include employers who supply onsite clinics as an employee health benefit, who provide self-insured health plans for employees, or who act as an intermediary between workers, healthcare providers, and health plans. Both the warning and the consent must be recorded. Texting patient information to patients is permitted by HIPAA provided the Covered Entity has warned the patient that the risk unauthorized disclosure exists and has obtained the patient’s permission to communicate by text. It was referred to above there are circumstances in which SMS text messaging can be HIPAA complaint, and the most common circumstance worries in relation to HIPAA compliant texting to patients. There also has to be a way to stop the interception of plain text messages – or extraction of plain text messages from carriers’ servers – which is why the encryption of PHI in transit is strongly advised. It is simply impossible to implement audit trails for HIPAA compliant text messaging because the technology does not exist that can audit every possible operating system.Įven if there was a way to get around the HIPAA texting rules for access controls and audit controls, that would not make text messaging HIPAA compliant. This is why the HIPAA regulations for text messaging – or any other form of electronic communication – state that audit controls are necessary to record when PHI is developed, modified, accessed, shared, or erased. Additionally, mobile devices can be lost or stolen – which not only potentially exposes PHI to unauthorized access, but the data in the messages can be used to commit insurance fraud or identity theft. Reviewing these reasons in more depth, with regards to access controls, anybody can pick up an unattended mobile device and read the messages it contains. These include – but are not restricted to – the lack of access controls, the lack of audit controls, and the lack of encryption – which although an “addressable” requirement of the HIPAA Security Act, is about the only possible way to ensure the security of PHI on the move. There are many reasons why it is more secure for Covered Entities to prohibit texting PHI rather than permit it. There also has to be a strategy in place to manage who can access PHI, and what authorized personnel do with PHI when they access it. HIPAA does not outright forbid sending PHI by text, but – in order for texting to be HIPAA compliant texting – security measures must be in place to ensure the confidentiality of PHI when it is at rest and on the move.

Hipaa compliant text messaging apps