Secure Texting in Healthcare

By Padma Priya R

Texting (aka SMS) is the easiest way to communicate with patients, providers and staff members when it comes to healthcare. A recent survey has found that 81% of doctors use texting for conveying work related messages. It is mainly used for scheduling appointments, making decisions about treatment options, follow up reminders, and transmitting medical device readings (such as blood pressure and heart beat rate) to a care provider.

SMS (Short Messaging Service) can be sent from a software application to mobiles and also from mobile to mobile over a cellular network.

Unfortunately, text messaging has its own drawbacks in healthcare, as it is not secure and non-compliant with HIPAA privacy regulations because of the following reasons:

• ePHI information can be misused by reading and forwarding to non-intended recipients.
• Information can be open, as it stays unencrypted in the sender’s and receiver’s mobile phones and also in the service provider’s server.
• Exchange of delicate Information between the provider and patient is not updated in the EHR.

With texting becoming prominent due to the increased use of smartphones in healthcare delivery, it was imperative for the industry bodies to establish guidelines that would avoid concerns of non-compliance and provide directions for vendors.

For a message containing PHI (Protected Health Information) being shared via SMS, below are the HIPAA guidelines to be adhered to:

• Mobile devices should be locked to avoid unauthorized access to personal data.
• Messages should be encrypted.
• Encrypted messages shall be decrypted and stored in a network provider’s system, so that any unauthorized person should not be able to access it.
• Business associate agreement with the network providers that facilitates message transmission.

While the regulations specified by HIPAA are comprehensive, healthcare vendors of today face some of the below practical challenges while implementing it:

• Mobile network providers not signing up for HIPAA business associate agreements.
• Reliability of networks transferring messaging securely and ensuring to protect the stored transmitted messages.

With digitalization and mobility becoming a critical part of the entire healthcare delivery service, the industry will have to look at channels to overcome the challenges presented. At the same time, it is also imperative to ensure security requirements are not compromised upon.