sms in health care: privacy and confidentiality

SMS in Health CarePrivacy & Confidentiality

Iris Thiele Isip Tan MD, MSc, FPCP, FPSEMChief, UP College of Medicine Medical Informatics Unit

Clinical Associate Professor, UP College of Medicine Section of Endocrinology, Diabetes & Metabolism

6 May 2012

http://www.flickr.com/photos/katielips/1430878365/

Saturday, August 4, 12

http://www.flickr.com/photos/katielips/1430878365/

Infographic by @shaneshow for MASHABLEhttp://www.socialhubnotes.com/philippines-texting-capital-of-the-world-2010/

Texting Capital of the World

http://tehspoon.deviantart.com/art/Filipino-flag-56287173?q=favby%3AGrin-Reaper%2F2159272&qo=23

Philippines: 1.39 billion text messages sent (2009)






m HEALTH

http://www.flickr.com/photos/dave-friedel/4158114183/

mHealth, enabled by mobile phones and other wireless computing devices (mDevices), is the revolutionary adoption of new communication patterns in healthcare that is stimulating the introduction of Participatory Health.

mHealth Observatoryhttp://www.mobih.org/observatory/




http://www.mobih.org/observatory/

http://www.mobih.org/observatory/

Participatory Medicine

Image by Liz Gracehttp://www.flickr.com/photos/liz-grace/5078868809/

“Movement in which networked patients shift from being mere passengers to responsible drivers of their health ...

providers encourage and value them as full partners”

Society for Participatory Medicine


http://www.flickr.com/photos/liz-grace/5078868809/

http://www.flickr.com/photos/liz-grace/5078868809/

“As opposed to the doctor-centric, curative model of the past, the future is going to be

patient-centric and proactive.”Elias A. Zerhouni MD, NIH Director

Dec 2007

Image by JD Hancockhttp://www.flickr.com/photos/jdhancock/4100030094/


http://www.flickr.com/photos/jdhancock/4100030094/


Patient Communication

Body Area Network

Pharma/Clinical Trials

Public Health

Access to Resources

Point-of-Care Documentation

Disease Management

Education Programs

Professional Communication

Administrative Applications

Financial Applications

Ambulance/EMS

mHeal!http://www.mobih.org


http://www.mobih.org

http://www.mobih.org

http://www.flickr.com/photos/maczter/3008375479/

Always on and always

with youSaturday, August 4, 12



http://www.sxc.hu/photo/712415

Information is the essence of medicine:

we create it, we collect it;

we search for it; we adapt it;

we drown in it;and at times, we ignore it.

Pauker SG & Stahl JE. WJM 1997;166(2):148–50




Outline

• HIPAA and HITECH

• Risks of use of SMS in healthcare

• SMS policy

• GSMA privacy principles


Original version“All that may come to my

knowledge in the exercise of my profession or in daily commerce with men, which ought not to be spread abroad, I will keep secret

and never reveal.”

Classic version“What I may see or hear in the

course of treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep

myself holding such things shameful to be spoken about.”

http://en.wikipedia.org/wiki/Hippocratic_Oath

http://www.flickr.com/photos/tonythemisfit/3644746113/






“I will respect the privacy of my patients, for their problems are not disclosed to me that the world may know.”

Modern version of Hippocratic Oath

Health Insurance Portability & Accountability Act of 1996

HIPAA

HITECHHealth Information Technology for

Economic and Clinical Health Act of 2009


HIPAA Privacy Rule regulates use and disclosure of

Protected Health Information (PHI)

held or transmitted in any form (electronic, paper or oral)

http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html





HIPAA Patient Identifiers• Names

• All geographic subdivisions smaller than a State (including street address, county, precinct, zip codes)

• All elements of dates (except year) for dates directly related to an individual; all ages over 89

• Telephone numbers

• Fax numbers

• E-mail addresses

• Social security numbers

• Medical record numbers

• Health plan beneficiary numbers

• Account numbers

• Certificate/license numbers

• Vehicle identifiers and serial numbers, including license plate numbers

• Device identifiers and serial numbers

• Web Universal Resource Locators (URLs)

• Internet Protocol (IP) address numbers

• Biometric identifiers (i.e. DNA), including finger and voice prints

• Full face photographic images and any comparable images

• Any other unique identifying number, characteristic, or code


Ensure confidentiality of communications with individuals i.e. call work number instead of home or cell number

http://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act#HITECH_Act:_Privacy_Requirements

HIPAA Privacy Rule







HITECH Act

Establishes a federal breach notification requirement for unencrypted health information






TigerText Survey (US Data, Oct 2011) 73% of MDs are sending work-related text messages

TigerText. "Physician and Hospital Texting Is on the Rise." Press release. October 12, 2011. www.tigertext.com/physician-texting-on-rise.


http://www.tigertext.com/physician-texting-on-rise

http://www.tigertext.com/physician-texting-on-rise

Text Messaging Riskshttps://safermobile.org

SMS can be intercepted

Cloned SIMSIM command to forward SMS GSM interception devices


https://safermobile.org




Filtered for key words







Stored data on phone

includes SMS






Apps may intercept, read or send SMS


Stored data on phone

includes SMS




Are text messages subject to HIPAA?

HIPAA privacy ruleRight to access and amend protected health information (PHI), “used, in whole or in part, by or for the covered entity to make decisions about individuals.”

Text messages if used to make decisions may be subject to above HIPAA privacy rule.

Greene, Adam H. "HIPAA Compliance for Clinician Texting." Journal of AHIMA 83, no.4 (April 2012): 34-36.


HIPAA security ruleRequires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity and security of ePHI


Threats to ePHI

• Theft or loss of the mobile device

• Improper disposal of the device

• Interception of transmission of ePHI by an unauthorized person

• Lack of availability of ePHI to persons other than the mobile device user


Security controls

Administrative policyWorkforce training Password protection


Inventory and proper sanitization of mobile devices

Use of alternative technology i.e. vendor-supplied secure messaging app



www.health.wa.gov.au/CircularsNew/attachments/617.pdf

SMS Policy for WA Health Services Nov 2011

Governance

SMS Policy Oversight Group responsive to both positive and negative consumer feedback

Health Services responsible for the costs and day to day administration of SMS usage

SMS administrator ensures all SMS users are aware of policy

Health Information Network responsible for management of IT and telecommunications components of SMS usage

WA Health Strategic System Support Branch reports WA Health Executive on outcomes of the service


http://www.health.wa.gov.au/CircularsNew/attachments/617.pdf




Automated SMS reminders using Telstra Integrated Messaging Service (TIMS)Use requires completion of a standard SMS approval form

I agree to use the SMS system within the prescribed guidelines for services in my Department that may benefit from this initiative. I understand the cost of SMS messages will be charged to my Department and agree to fund this from the Department budget.






Privacy and ConfidentialityTelco only transmitsWA Health does not hold or collect any informationAll identified information remains with Health Services

www.health.wa.gov.au/CircularsNew/attachments/617.pdfSaturday, August 4, 12





SMS Policy for WA Health Services (Nov 2011)

Patient providing a mobile telephone number is deemed to have agreed to SMS reminders







Consent form for use of SMS texting Lincolnshire Community Health Services

We will get in touch with you approximately 2 weeks before your appointment is due.The text will not identify the sender and will read as follows - Appointment reminder: Date and timePlease let us know if your phone is lost, stolen or you have changed your number.

www.lincolnshirecommunityhealthservices.nhs.ukSaturday, August 4, 12

Consent form for use of SMS texting Lincolnshire Community Health Services

I agree to the service communicating with me by SMSI confirm that the mobile number the service holds on my record is correct and I will notify them of any changesI agree to receive a reminder of my appointment by SMSI am aware that I can withdraw consent at any time by informing the Health Professional either verbally or in writing

www.lincolnshirecommunityhealthservices.nhs.ukSaturday, August 4, 12

http://www.flickr.com/photos/pasukaru76/4368389868/


SMS reminders will NOT be sent to prisoners, estranged (non-custodial) parents, deceased, children






http://www.flickr.com/photos/dpstyles/4058142601/


Standard Message SMS Policy for WA Health Services (Nov 2011)

Reminder: appointment at [xx] Hospital [appt_time], [appt_date]. DO NOT SMS REPLY. Please call [clinic number or OPD number] business hours if you cannot attend.

Reminder: your child has an appointment at [xx] Hospital [appt_time], [appt_date]] DON’T SMS REPLY Call [clinic number or OPD number] business hrs if unable to attend.







SMS Policy for WA Health Services (Nov 2011)Automated SMS reminders will be sent between 9 am-5 pm, 7 days a week, 2 days in advance of appointment






http://www.flickr.com/photos/jurvetson/512412202/


Automated SMS reminders configured so that recipients cannot reply


http://www.flickr.com/photos/jurvetson/512412202/



Mobile and PrivacyGSM Association

http://www.gsma.com

January 2011

Mobile Privacy Principles

April 2011

Privacy Design Guidelines for Mobile Application

Development


http://www.gsma.com

http://www.gsma.com

Mobile and Privacy

January 2011

Mobile Privacy PrinciplesOpenness, transparency and notice

Provide information on identity and data privacy practices

Purpose and useLimited to meet legitimate

business purposes

Data minimization and retentionOnly minimum personal information necessary;

not be kept for longer than is necessary http://www.gsma.com


http://www.gsma.com

http://www.gsma.com

http://www.flickr.com/photos/pasukaru76/4948494811/Mobile Privacy Principles

User choice and controlExercise meaningful choice and control over personal information

Mobile and Privacy




Mobile and Privacy

January 2011

Mobile Privacy PrinciplesRespect user rights

Easy means to exercise rights over use of personal information

Security

Reasonable safeguards appropriate to the sensitivity of the information

EducationInformation about privacy and

security issues and how to protect privacy

Children and adolescentsAccountability and enforcement

http://www.gsma.com


http://www.gsma.com

http://www.gsma.com

Mobile and Privacy

April 2011

Privacy Design Guidelines for Mobile Application Development

Privacy by Design approach

ensures that mobile applications are developed in ways that respect and protect the privacy of users

and their personal informationhttp://www.gsma.com


http://www.gsma.com

http://www.gsma.com

mHealth & Privacy in Developing CountriesPhones are often shared by families

Policy Engagement Network for the International Development Research Center (The London School of Economics & Political Science)“Electronic Health Privacy and Security in Developing Countries and Humanitarian Operations” Dec 2010

http://www.flickr.com/photos/27528906@N04/4152954614/


http://www.flickr.com/photos/27528906@N04/4152954614/

mHealth & Privacy in Developing CountriesSome governments are requiring citizens to register SIM cards with personal information

Policy Engagement Network for the International Development Research Center (The London School of Economics & Political Science)“Electronic Health Privacy and Security in Developing Countries and Humanitarian Operations” Dec 2010

http://www.flickr.com/photos/bfishadow/4931375578/




http://www.flickr.com/photos/london/25783697/

SMS in HealthcareKnow the risks. Follow rules. Have a policy.




Thank Youhttp://www.endocrine-witch.net

@endocrine_witch

Image from http://wthr.frumph.net/


http://www.endocrine-witch.net

http://www.endocrine-witch.net

http://wthr.frumph.net

http://wthr.frumph.net

sms in health care: privacy and confidentiality

Health & Medicine

wa health

hipaa privacy

electronic

sms policy

economics

developing

personal informationsaturday

opd number