This session will focus on reaching out to patients to provide them with information about products and services you provide and understanding how such communications may be conducted, depending on the relationship and the information. The session will explain how to understand which regulations may affect certain communications and the steps that should be taken to ensure that communications do not run afoul of the many laws limiting such communication.
E-mail has long been a staple of people's lives and now texting has become the predominant way of communicating for many people. Doctors are finding that texting is far more flexible, convenient and effective than paging, and patients want to be able to use short message texting for handling of appointments, updates and the like, where even e-mail or the telephone would seem inconvenient. What about marketing to patients? How does this fit into the regulatory landscape, including considerations for Protected Health Information, the use of cell phones and marketing via e-mail?
In order to integrate the use of e-mail and texting into patient communications, it is essential to perform the proper steps in an information security compliance process to evaluate and address the risks of using the technology. This session will describe the information security compliance process, how it works, and how it can help you decide how to integrate e-mail and texting into your organization in a compliant way. The process, including the use of information security risk analysis, will be explained and the policies needed to support the process will be described.
But the process must also include consideration of limitations on using PHI for marketing purposes in the HIPAA Privacy Rule. There has long been a HIPAA requirement for covered entities to do their best to meet the requests of their patients for particular modes of communication, and using e-mail or texting is no exception. Reaching out to patients' cell phones has its own issues and must be done properly or violations result. And e-mail has its own restrictions under laws to reduce spam e-mail. For each kind and type of communication, it is essential to understand what rules apply.
The stakes are high – any improper use or exposure of PHI may result in an official breach that must be reported to the individual and to the US Department of Health and Human Services, at great cost and with the potential to bring fines and other enforcement actions if a violation of rules is involved. Likewise, complaints by a patient can bring about HHS inquiries and enforcement actions, so it is essential to find the right balance of communication.
HHS compliance audit activity and enforcement penalties are both increased, especially in instances of willful neglect of compliance, if, for instance, your organization hasn't adopted the complete suite of policies and procedures needed for compliance or hasn’t adequately considered the impact of e-mail or texting on your compliance.
The session will discuss the requirements, the risks, and the issues of the increasing use of e-mail and texting for patient and provider communications and provide a road map for how to use them safely and effectively, to increase the quality of health care and patient satisfaction. In addition, the session will discuss how to be prepared for the eventuality that there is a breach, so that compliance can be assured.