The common violations are everyday habits: texting PHI, sending it over unsecured email, and sharing one login across a team. The rules are clear about each of them.
Who HIPAA applies to
HIPAA is not limited to clinics and hospitals. Physical therapy, personal care, home health, wellness, behavioral health, assisted living and more all handle protected health information. Providers, full-time and part-time staff, contractors and third-party partners who come into contact with PHI are all subject to the law, its violations and its penalties.
“We are too small to be noticed”
Size does not protect you. The Department of Health and Human Services and its Office for Civil Rights enforce the HIPAA Privacy and Security Rules, and OCR learns of possible violations through complaints: from current or former staff, patients, clients, business partners, or anyone who says they saw a breach. That includes a disgruntled employee or a whistleblower. Home health, assisted living, hospice and palliative care, mobile imaging, rehabilitation and behavioral health teams are all in scope.
Where communication has to be compliant
Any discussion of PHI needs a degree of confidentiality. HIPAA requires protection of sensitive patient data whenever it is shared or discussed.
- Providers and patients. Any communication that is not face to face with a patient, resident or client has to meet HIPAA standards.
- Professionals among themselves. Inside a department and with outside collaborators.
- Providers and insurers. Insurers need PHI, and a channel that can be intercepted has to be fully compliant.
- Organizations and third-party associates. IT consultants, collections agencies and vendors must protect patient data. Have them sign a business associate agreement (BAA) and, where relevant, a data processing agreement.
- Organizations and public health authorities. Mandatory reporting, such as the COVID-19 data reporting during the pandemic, calls for stringent security.
What a violation costs
The cost goes beyond a fine.
- Penalties. Civil penalties are tiered by how much the organization knew and what it did about it, and the amounts are adjusted for inflation each year. Not knowing about a violation is not a defense. See HHS enforcement for the current tiers.
- Reputation and trust. Patients lose confidence when their information is compromised.
- Lawsuits and criminal charges. Affected patients can sue, and willful neglect can bring criminal charges.
Why HIPAA-compliant communication matters
HIPAA is the foundation of ethical communication in healthcare. Every exchange, whether provider to patient, among professionals or with a third party, has to meet its standards to guard against breaches, unauthorized access and misuse.
It protects patient privacy
PHI includes medical histories, test results and appointment details. Encrypted messaging and secure file sharing keep that information available only to the people who should see it. Patients who trust that their information is safe tend to engage more openly. See how to boost patient satisfaction with real-time communication.
It speeds up communication
Secure messaging moves information between patients, providers and care teams without phone tag, which shortens delays in diagnosis and treatment and improves the patient experience.
It strengthens team care
Quality care involves teams: a hospital placing a patient in rehab or home care, with intake, care teams and providers all coordinating. HIPAA-compliant tools let them share critical information securely, which cuts miscommunication. Staying off SMS and consumer apps gives the team one dependable channel. Read more on streamlining workflows with collaboration tools.
It keeps you in compliance
Prevent unauthorized access to PHI, use HIPAA-compliant methods and encrypted, secure messaging, and you avoid penalties while showing your commitment to patients and the community.
The communication methods that need to be compliant
- Email. It must be encrypted and may need written patient consent. See whether email is HIPAA compliant.
- Messaging. Notifications, texts and alerts that involve the EHR or PHI belong on a secure messaging platform.
- Voice calls. A call that covers patient information needs the same protection as a message.
- Video visits. Telehealth tools have to be compliant too.
- Patient portals. Two-factor authentication is a common safeguard.
- File sharing. Every file shared among professionals or with service providers.
One person, one login
HIPAA expects each person who touches PHI to be uniquely identified. A shared login breaks that, because nobody can tell who saw what. Every team member needs their own account.
Getting there
Choosing a solution takes commitment. Expect to audit what staff use today, adjust access controls and stop texting patient information. An all-in-one platform makes the move easier, though personal habits are the hardest part to change.
A bit about Buzz
Buzz is a real-time HIPAA-ready communication and collaboration platform for care teams, on desktop, tablet and mobile: in the office, at a patient’s home or on the road. Teams use it to coordinate home visits, connect with referring agencies, update families, and reach clinicians about questions, lab results and prescription requests, with BuzzChat, BuzzVideo, BuzzLightning clinical answers and BuzzDrive for documents. Skyscape signs a BAA. The Buzz FAQ answers the common questions.