A nurse needs to reach a physician quickly. An aide wants to tell a colleague about a change in a resident's condition. A manager needs to find someone to cover a shift. The fastest tool in every pocket is a text message, and that is exactly why staff use it, whether or not policy allows it.
Standard text messaging was not designed for protected health information. Messages can sit on lost phones, be forwarded, be backed up to personal cloud accounts or travel through carriers with no controls you manage. Banning texting without offering an alternative usually just pushes it underground.
Lost or stolen phones with messages and photos stored in plain view.
No central control. If an employee leaves, the messages stay on their personal phone.
No audit trail. You cannot see what was shared or with whom.
Misdirected messages. One wrong digit sends a resident's details to a stranger.
Photos. Pictures of wounds, medications or residents often end up in personal photo libraries and cloud backups.
Retention problems. Information relevant to resident care may not be captured in the medical record.
The HIPAA Security Rule requires appropriate safeguards for ePHI, including transmission security. Messaging apps that are not under your control make that difficult to demonstrate.
Work with your privacy officer, director of nursing, medical director and administrator to write a clear policy. Many facilities define tiers:
Never by standard text: resident names, diagnoses, medications, photos or anything that could identify a resident.
Allowed by standard text: non-identifying logistics, such as asking someone to call the nurse station or to arrive early for a shift.
Allowed through approved secure tools: clinical communication, including orders if your medical staff and regulations allow it.
CMS and other regulators have expressed concerns about orders sent by standard text, so involve your medical director and review current guidance on order communication before permitting it.
A policy only works if staff have something practical to use instead. A secure messaging platform typically offers:
Encryption in transit and at rest.
User authentication tied to your accounts.
The ability to remotely wipe messages from a lost device.
Message retention and audit logging.
Secure photo and file sharing that does not save to the phone's gallery.
A business associate agreement with the vendor.
Group messaging for teams and shifts.
Some EMR systems include secure messaging. Ask your vendor before buying a separate tool.
Many staff use personal phones. Decide whether to allow this, and if so under what conditions:
Require a screen lock and an up-to-date operating system.
Use mobile device management or a managed app container so work data is separated from personal data.
Make clear what the organization can and cannot see or erase on a personal device.
Have a process for reporting a lost phone immediately.
If you provide facility phones, you have more control but also more cost and logistics.
Explain the reasons, not just the rule. Staff are more likely to comply when they understand the risk to residents and to themselves. Include examples such as a message sent to the wrong number. Give new hires a short orientation and review the policy at staff meetings.
An employee will eventually send something they should not have. Set up a clear, no-blame path to report it quickly. Your privacy officer can then assess whether it was a reportable incident under the HIPAA Breach Notification Rule.
Review your messaging platform's usage and ask managers whether the tool is meeting needs. If people still revert to texting, find out why. The tool may be too slow or missing a feature.
UnityCare IT helps healthcare and senior living organizations choose and configure secure messaging, mobile device management and the policies around them. We can help you build a plan that staff will actually follow.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172