How to Share Patient Lab Results via Text in a HIPAA Compliant Way

Sharing laboratory test results is crucial to the medical treatment process. It allows healthcare providers to explain what the test results indicate and what treatment plan is appropriate for the patient. However, providers must take extra precautions in disclosing patient lab results when using communication forms like hipaa-compliant texting and email.

Proactive measures must ensure that any sharing of electronically protected health information (ePHI), such as lab results, remains compliant with the guidelines under the Health Insurance Portability and Accountability Act (HIPAA).

Here’s how you can ensure that your practice is compliant with HIPAA when sharing patient lab results.

1 Although patients prefer text messaging to communicate with physicians, SMS is not HIPAA-compliant by default

The HIPAA Privacy Rule allows covered entities to share protected health information (PHI) for treatment purposes. HIPAA considers lab results to be PHI. That means the rules for disclosing or transmitting lab results must ensure confidentiality, integrity, and availability.

While HIPAA does not strictly forbid using short message service (SMS) to send and receive health information, traditional texting is neither HIPAA compliant nor safe.

For communication methods such as SMS to be HIPAA compliant, the most relevant requirements are the following:

• Data must be encrypted  to allow only authorized person’s access to the information
• The key to the PHI has to be limited to the users that need it
• A system for identification must be in place — every user needs a unique username and password
• The system has to protect PHI from inappropriate changes or destruction

Unfortunately, text messaging typically doesn’t comply with these requirements, making sharing patient lab results via texting very risky. But it doesn’t mean that texting can’t become HIPAA-compliant.

2 For texting to be HIPAA-compliant, a secured text messaging platform is a must

You can use text messaging to share patient lab test results as long as your practice adopts a texting platform that implements the following security to ensure HIPAA compliance:

• Unique User IDs
  Authorized persons within your organization with access to PHI must have a unique user ID or password. That allows the system to track users’ activity while logged into the system to access PHI. It is also a great way to monitor that the sharing of PHI, like lab results, is with the appropriate individual.

Upon receiving the text message, patients click on the link and authenticate their identity using a unique username or password to access lab results or other PHI.

• Automatic Logoff Feature
  To ensure that no unauthorized person can access the system. At the same time, the device is left unattended by medical personnel; the text messaging platform must automatically log off users after a predetermined time of inactivity.
• Messaging Encryption
  Encrypting PHI-containing text messages makes them unreadable by anyone without permission or who does not possess a specific password. Moreover, encryption is needed if you send or share lab results with someone outside your organization’s firewall. That way, even if intercepted, the info is unreadable and unusable.

3 Address text messaging issues with Curogram, a 2-way messaging system that is fully HIPAA compliant

Many healthcare organizations and medical practices implement a secure text messaging system for reliable and efficient access to PHI/ePHI, including lab results.

You or your staff must log in to the secure text messaging system to view or upload ePHI or electronic health records (EHRs). To text lab results in compliance with HIPAA, providers can send a text message to the patient containing the lab results as an encrypted pdf. The patient logs in with a unique username or PIN to access the pdf.

Curogram is the ideal all-in-one communication platform that enables secure and HIPAA-compliant 2-way texting. In addition, Curogram’s system relies on the latest encryption methods and implements an additional layer of security to keep texting HIPAA compliant.

Here’s how Curogram’s text messaging system is fully HIPAA compliant when it comes to texting health information such as lab results:

• Each healthcare provider has a unique user ID on Curogram
• Curogram automatically logs users out of sessions after a period of inactivity
• Third-party integrations encrypt all information
• The system ensures that only the intended recipient’s number receives the text message
• Instead of directly sending sensitive health information, the system sends patients links to documents that only they can access

Aside from sharing lab results, Curogram integration enables texting features that can facilitate clinical tasks such as:

• Scheduling and rescheduling appointments
• Sending patients medical documents
• Reminding patients of their scheduled visits
• Collecting crucial medical data

By using Curogram, healthcare providers don’t have to worry about violating any HIPAA regulations while sending texts to patients. That is crucial to your practice because any HIPAA violation may lead you to pay hefty fines (possibly up to $50,000 for each text message) or even face criminal charges (if a healthcare provider violated HIPAA rules knowingly).

4 HIPAA compliance needs to be at the heart of your entire practice, with lab results and other electronically transmitted health information

File sharing is a crucial aspect of healthcare data management. One of the ways healthcare providers can enforce HIPAA compliance is by ensuring that all staff, affiliates, and third-party applications they use apply HIPAA guidelines for establishing safeguards to protect sensitive health information. Don’t take chances when sending PHI, like lab results, via text or email. Instead, integrate Curogram today and guarantee the safety of all information and communications your practice sends to patients electronically. Patients can also rest easier knowing that the people responsible for providing their care also secure their health data.