A nurse needs to ask a physician a quick question. A CNA wants to tell a charge nurse that a resident has a new concern. A manager wants to send a photo of a wound to a wound care nurse. The fastest tool is the one already in everyone's pocket: standard text messaging. And that is precisely the problem.
Texting is convenient, but ordinary SMS and consumer messaging apps raise real HIPAA and security issues. The solution is not to ban communication; it is to give staff a secure way that is as easy as texting.
No guaranteed encryption. Standard SMS messages are not designed to protect content in transit or on carrier systems.
Messages live on personal phones. They can be backed up to personal cloud accounts, viewed on lock screens, synced to other devices or forwarded.
No central control. If a phone is lost, or an employee leaves, you cannot remove the messages.
No audit trail. You cannot easily show who saw or sent what.
Photos linger. Images sent or taken for clinical reasons can end up in personal photo libraries.
Wrong-recipient errors. A mistyped number sends information to someone outside the organization.
The HIPAA Security Rule requires safeguards for ePHI in transit and access controls, along with audit controls and integrity protections. Consumer texting makes most of these hard to demonstrate.
CMS has addressed text messaging of patient information and orders, and its position has emphasized secure platforms. Facilities should follow current CMS and Joint Commission guidance, state rules and their own policies, and involve clinical and compliance leadership in deciding what may be communicated this way. Do not assume that because physicians text, it is acceptable.
A secure messaging platform for healthcare typically provides:
Encryption in transit and at rest
Individual accounts with strong authentication and MFA
Remote wipe of messages if a device is lost, or when an employee leaves
Message expiration and retention controls
Audit logs
Secure photo and file sharing that stays out of the personal camera roll
A business associate agreement with the vendor
Ability to group by unit, role or shift
Check whether your EHR or phone system already offers a secure messaging feature that staff are not using.
Keep it short enough that people will read it. Cover:
Which tools are approved for communicating about residents
What may and may not be sent by standard SMS, such as scheduling logistics versus clinical details
Rules for photos and videos of residents and wounds
Use of personal devices, passcodes and updates
Requirements for reporting lost phones immediately
Consequences for violations, applied consistently
Explain the reason behind the rules. Staff follow policies that make sense.
Policies fail when the compliant option is slower. To encourage adoption:
Choose a tool with a simple interface that works on both iPhone and Android
Provide facility-owned devices on units where personal phones are discouraged
Train staff in brief sessions, and have champions on each shift
Set up groups and contacts in advance so people do not have to search
Turn off the unofficial channels over time, and respond when people request better tools
If you allow staff to use personal phones, require passcodes, current operating systems and a managed work profile or app container. Be transparent about what the organization can see and what it cannot, which helps with trust.
Many facilities want to text families with updates. Use a platform designed for that purpose, minimize the clinical detail sent and obtain preferences and consent according to your policies and applicable rules.
Periodically ask staff what they are really using. Anonymous surveys often reveal workarounds that are not in the policy. Review logs from the secure platform to confirm it is being adopted.
UnityCare IT can help evaluate secure messaging options, configure them with your phone and EHR systems and train staff, so the secure option feels as natural as sending a text.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172