New Patients are vital for growing and sustaining a Health Care Provider's Practice. Patient attraction has become an enormous business resulting in highly visible Internet-based HIPAA violations and risks for providers. Websites, social media, patient satisfaction surveys, email and text messaging sold by vendors including Business Associates are all subject to HIPAA rules that are frequently overlooked or ignored.
HIPAA Rules for the most common patient attraction tools are clear and unequivocal. One look at a health care provider's website can provide undeniable evidence of a HIPAA violation and indications of other violations to be investigated.
There are widespread violations of the HIPAA Rules for communicating with patients for patient engagement as well. These violations are being made by Providers and Business Associates primarily through unencrypted email and text message. A simple appointment reminder is, by definition, PHI even though it may not contain diagnostic specific information. So are Happy Birthday wishes, reminders that a patient is overdue for a checkup or has an outstanding balance on a bill.
You (Provider and Business Associate) must know how you can maximize your use of key patient engagement tools while protecting yourself and your organization from government penalties and patient lawsuits.
Health Care Providers have a mandatory "duty to warn" patients of risks associated with unencrypted email. A patient may refuse to receive unencrypted emails after being warned. Health Care Providers and Business Associates must strictly follow the patient's restriction.
There is a HIPAA "safe harbor" that frees you from:
1. Responsibility for unauthorized access of a patient's PHI during transmission and
2. Responsibility for safeguarding PHI delivered to the patient.
Don’t be the Provider or Business Associate that finds itself in serious trouble simply because you didn’t follow the HIPAA Rules for unencrypted electronic communication with patients!
Whether you have a website, a LinkedIn page, or use Facebook, Twitter, Youtube, Google+ or Instagram, you are exposing your practice/business to a potential Breach. The avenues of electronic communications are growing and we must grow with it in order to maintain HIPAA compliance and keep the integrity and privacy of patients and their protected health information. In this lesson, policies and procedures will be discussed that will help to ensure a compliant understanding of the usage of social media, marketing efforts and website development. This is more than posting a notice or opt-out message. This is an accurate, comprehensive and easy to implement way of patient engagement through examples and recent breaches. Your entire practice/business personnel should be aware of the harmful effects of the misuse of social media, marketing, and websites and the devices used to access these portals.