Guidelines for Secure Texting in a Healthcare Environment
In order for organizations to be compliant with the new regulations, guidelines for secure text messaging in a healthcare environment have been produced. The most important item within the guidelines is that all electronically-stored protected health information (ePHI) must be encrypted to NIST standards, and maintained on a system which facilitates secure text messaging.
The reason for ePHI being encrypted to such a high standard is that, if a breach of ePHI occurs, any data which is copied from or removed from the secure messaging system for healthcare organizations will be unusable, unreadable and indecipherable to any third party who accesses it.
The centrally-monitored system of secure messaging is intended to replace SMSs, pagers and emails – which are often copied on routing servers and are therefore neither “secure” nor HIPAA-compliant – and the integrity of the secure messaging system should be inspected regularly to ensure that healthcare professionals comply the guidelines for secure texting.
Research has shown that many healthcare professionals use their own personal mobile devices (Smart phones, tablets, PDAs, laptops etc) to access and transmit ePHI, and the secure text messaging healthcare guidelines state that it should be impossible for patient data to be saved to mobile devices or any other external device.
Furthermore, there should be a protocol in place for healthcare professionals to report a theft or loss of their mobile device so that the individual user can be deleted from secure messaging system for healthcare organizations and any sensitive data on their mobile device remotely removed.