Mobile texting is now a vital part of healthcare communication, but it comes with strict compliance requirements. As a result, providers must follow HIPAA rules to protect patient privacy. In this guide, you’ll learn how to embrace mobile texting securely, avoid common mistakes, and maintain compliance without sacrificing convenience.

After the latest changes to Health Insurance Portability and Accountability Act 1996 (HIPAA), our physicians and health insurance companies have started communicating through text messages. But have you ever thought that “is texting using a mobile phone HIPAA Complaint?”

Is Mobile Texting HIPAA Complaint?

Yes! HIPAA allows text messaging under specific conditions. A covered entity must inform the patient about the risk of unauthorized disclosure and obtain consent before sending texts. In addition, both the warning and the consent must be properly documented.

However, this does not eliminate the risk of HIPAA violations. Text messages can easily expose Protected Health Information (PHI) to unauthorized access. For example, anyone who picks up an unattended phone can read sensitive messages. Moreover, mobile devices can be lost or stolen, giving attackers access to PHI. This information could then be used for identity theft or insurance fraud, creating serious security and compliance challenges.

How to Keep Text Messages in Compliance with HIPAA?

The question arises here: Is the healthcare industry supposed to communicate with patients through messaging? The answer is, of course, because it is easy and quick. But certain protocols should be observed, like the massages must be encrypted (PIN or password or fingerprint etc.), automatic logoffs, unique user IDs, etc. Texting is inherently insecure and that needs to be mitigated and training should be provided to employees on the best security practices.

All the protocols mentioned above are impossible to achieve with standard mobile texts. Still, they can be achieved with text messaging apps such as Google Workspace Chat and Microsoft 365 business-standard. But you will have to sign a proper BAA with office365 to transmit, store and maintain PHI.

Additionally, different service providers offer a go-to solution in the form of HIPAA Compliant text messaging apps that are encrypted, have access and audit controls such as Zinc, TigerText, etc.

In Summary

• HIPAA allows for communication through text messaging, as long as a Covered Entity gets the patient’s consent and documents both the consent and warning.
• There is still a risk of PHI getting into unauthorized hands via mobile phone texting.
  • Examples include: anyone with access to an unattended mobile phone can read its messages; mobile phones can be lost or stolen, exposing PHI to unauthorized access; information contained in the messages might be used to execute identity thefts and insurance fraud.
• To keep text messages in compliance with HIPAA: certain protocols should be observed (e.g., massages must be encrypted, automatic logoffs, unique user IDs), which are possible with text messaging apps such as Google Workspace Chat and Microsoft 365 business-standard but difficult/impossible with standard mobile texts.

Ready to secure your business? Schedule a free cybersecurity consultation with Cybesion today.

References

https://terranovasecurity.com/how-to-prevent-ransomware/

https://tigerconnect.com/about/faqs/hipaa-compliant-texting-app/

Cybesion is a Managed IT Security Service Provider, namely providing business grade cyber security protection.