The Health Insurance Portability and Accountability Act, enacted in 1996, was established to protect patients’ health information and set regulations on how health records are accessed. Healthcare providers now are required to provide electronic access to each patient’s health information. With the rise of electronic communication, many healthcare providers have started to use email and text (SMS) messaging to communicate with patients more quickly and easily. With the increased dependence on electronic communication, many people are concerned with how HIPAA applies to electronic communication.
As a result of the rapid pace of electronic communication development, many people have been confused on how the HIPAA Security Rule applies to modern electronic communication such as emails and text (SMS) messaging. The new HIPAA rules now tell healthcare providers to “[i]mplement technical security measures to guard against unauthorized access to [electronic protected health information (ePHI)] that is being transmitted over an electronic communications network”. To prevent unauthorized access to ePHI, healthcare providers must confirm that there is secure transmission of patient health information.
Healthcare providers can offer secure access to healthcare information online through encrypted messages and emails or using a password protected patient login. Unencrypted messages may be read on a public Wi-Fi network so encryption provides protection in the event that a message is intercepted. Patient portals that require patient login provides password protection of patients’ health information. These methods allow healthcare providers to share health information with their patients in a protected and convenient way.
While the new HIPAA regulations do not specifically prohibit text (SMS) messaging as a way to communicate patient health information, most text message communication is not encrypted or password protected and is therefore not compliant with HIPAA. In order to be HIPAA compliant, healthcare providers must first confirm that the text (SMS) messaging feature that is being used meets, or is exempt from, the safety regulations imposed by HIPAA. Otherwise, text (SMS) messaging without proper safety measures is not permitted.
Healthcare providers may be able to communicate health information via unsecure email and text (SMS) messaging if the email and text (SMS) message communication is from the patient to the healthcare provider. HIPAA states that its rules “[do] not apply to the patient. A patient may send health information to you using email or texting that is not secure. That health information becomes protected by the HIPAA Rules when you receive it”. Therefore, healthcare providers must be aware that they should alert the patient of the risks of using unencrypted email or text message communication. The patient can choose to decide whether they would like to continue using this form of electronic communication, and the healthcare provider can continue using email or text (SMS) messaging, as long as it is acceptable for the patient.
HIPAA rules not only apply to communication between patient and healthcare providers, it also applies to communication between providers, employees, and third parties such as insurance companies. If the communication does not include the patient, all forms of electronic communication of patient health information must be encrypted or have a password protected system such as a user login.
The evolving healthcare environment affects every healthcare provider, including anesthesiologists. After the introduction of new regulations such as the changes in HIPAA, anesthesiologists should contact their employer, or the anesthesia management company they work for, in order to reevaluate their plan to provide the best anesthesia service for patients and ensure a sustainable business model. All healthcare providers must stay up to date on any new revisions to the HIPAA regulations. As people continue to rely heavily on electronic communication, it is essential for healthcare providers to continue discussing both how to best meet the needs of their patients and how to best protect their health information.