Emailing MDs for orders

I found this....

Unfortunately, traditional SMS messaging is inherently nonsecure and noncompliant with safety and privacy regulations under the Health Information Portability and Accountability Act (HIPAA). Messages containing electronic protected health information (ePHI) can be read by anyone, forwarded to anyone, remain unencrypted on telecommunication providers’ servers, and stay forever on sender’s and receiver’s phones.

In addition, senders cannot authenticate the recipient of SMS messages (ie, senders cannot be certain that the message has been sent to and opened by the right person). Studies’ have shown that 38 percent of people who text—including me—have sent a text message to the wrong person.

As a result, The Joint Commission has effectively banned physicians from using traditional SMS for any communication that contains ePHI data or includes an order for a patient to a hospital or other healthcare setting. A single violation for an unsecured communication can result in a fine of $50,000; repeated violations can lead to $1.5 million in fines in a single year, not to mention the reputational damage done to an organization and its ability to attract patients.

A recent case, for example, resulted in a $50,000 fine to the provider. In addition, the provider was required to “implement security measures sufficient to reduce risks and vulnerabilities to ePHI to a reasonable and appropriate level for ePHI in text messages that are transmitted to or from or stored on a portable device.”

HIPAA‐compliant texting

The Joint Commission did not ban all text messaging solutions, however. Instead, it established Administrative Simplification Provisions (AS) that serve as guidelines for developing secure communication systems. Under the AS guidelines, the following four major areas are critical to compliance:

• Secure data centers—Healthcare organizations typically store patient information in either onsite or offsite (cloud) data centers. HIPAA requires these centers to have a high level of physical security as well as policies for reviewing controls and conducting risk assessment on an ongoing basis.
  
• Encryption—AS stipulates that ePHI must be encrypted both in transit and at rest.
  
• Recipient authentication—Any communication containing ePHI must also be delivered only to its intended recipient. A texting solution should allow the sender to know if, when, and to whom a message has been delivered.
  
• Audit controls—Any compliant messaging system must also have the ability to create and record an audit trail of all activity that contains ePHI. For a text messaging system, this includes the ability to archive messages and information about them, to retrieve that information quickly, and to monitor the system.
  

Standard consumer-based messaging systems fail most of these requirements. The data centers are often not designed with the highest levels of physical and data security. Messages can be intercepted and are not encrypted. Recipient authentication is not available and, although messages and delivery details may be stored indefinitely, they are not designed to provide a fully functional audit trail.

Secure text messaging solutions

By using a private, secure texting network, doctors, nurses, and staff can not only send and receive patient information, but also potentially achieve the following goals:

• Shorten response times
  
• Improve the accuracy of decision making by having better information
  
• Allow multiple parties involved with clinical decision making to be looped in on the same message
  
• Allow for quicker interventions and improve patient outcome
  
• Securely communicate lab results, imaging results, patient procedures, and medical histories, allowing the physician to have more information readily available.
  
• Speed up on-call notifications
  
• Eliminate the hassle of callbacks
  
• Integrate with scheduling systems to create automatic notifications of pending events
  

In today’s increasingly mobile world, technology will undoubtedly continue to be a massive driver of greater efficiency. Physicians are typically eager to embrace and adapt new technologies. Used properly, texting technology has the potential to revolutionize the quality of how health care is delivered to patients.

Standards FAQ Details | Joint Commission

On Friday, the Joint Commission issued a statement saying that physicians and other health care professionals should not use text messages as a way to share patient health information.

The statement said, "It is not acceptable for physicians or licensed independent practitioners to text orders for patients to the hospital or other health care setting," adding, "This method provides no ability to verify the identity of the person sending the text, and there is no way to keep the original message as validation of what is entered into the medical record."

I'm not going to comment on the security of the system, but like others, I'm concerned that some believe it is better to use only room number to avoid a HIPAA violation, rather than using the name for pt safety reasons.

We use a secure text paging system on the intranet to hospital-issued pagers. Thank goodness I always use first initial and last name for my text pages because just the other day a resident called me back and said, "You paged me about John Smith in 1302, right? You put the room number as 1502." I float, it was early morning, and the day before, I had been working the 15th floor.

Lesson: If you continue to use this system, please use a patient identifier other than room number!