许多医疗保健提供者和工作人员发现，短信可以快速访问他们做出医疗保健决策所需的信息，并且是与其他提供者和患者进行通信的方便方法. Yet, 医疗保健提供者和工作人员在使用文本消息传递时需要了解HIPAA隐私和安全规则，以避免违反这些规则.

典型的短消息服务(SMS)文本不能提供发送受保护的健康信息(PHI)所需的安全性。. 因此，如果未经授权的个人可以查看短信数据，患者的隐私可能会受到损害. Additionally, multiple carriers might be involved in relaying and routing text messages, messages can remain on servers in unencrypted formats, 也不能保证收件人一定会收到并阅读这条信息.¹ 如果不安全的短信导致违反HIPAA，可能会受到昂贵的处罚.

In some situations, standard text messaging may comply with HIPAA. For example, the HIPAA Journal 解释医疗保健提供者只有在短信内容不包括“个人标识符”且符合“最低必要标准”的情况下才能向患者发送短信."² 医疗保健提供者还必须警告患者，通过未加密的通道传递个人信息存在风险.

To ensure HIPAA compliance in texting, 医疗保健组织应该使用安全的消息传递系统，并制定符合HIPAA安全规则的策略和程序 administrative, physical, and technical safeguards. 技术保障措施特别适用于通过短信进行PHI的电子传输. These safeguards address concerns such as access controls, audit controls, integrity control, methods for ID authentication, 以及PHI以电子方式传输时的传输安全机制.³

When evaluating potential messaging systems, 医疗保健组织应该寻求提供多级加密的技术(例如.g.(存储数据、传输数据和应用程序内数据的加密). The technology also should be capable of operating on various devices, such as mobile phones running various operating systems, tablets, and desktop computers.⁴ Other features of a secure text messaging system to consider include:

• Data storage on a secure private server with backup
• 在移动设备丢失或被盗的情况下，用于从移动设备删除/禁用应用程序的远程选项
• Automatic logout after a period of inactivity
• 能够在各种无线频率和Wi-Fi上工作，以避免医院的死区
• The ability to track and confirm message delivery
• The ability to set a maximum message data life (e.g., 30 days)⁵

医疗保健组织还应该考虑综合消息传递系统的潜在好处, rather than single-purpose systems. 综合消息传递系统应该容易地与组织的日历集成, directory, customer relationship management system, single sign-on capabilities, and document-sharing service.⁶

另一个需要考虑的问题是选择能够提供对文档的即时访问的消息传递系统, images, and resources within conversations, 因此，医疗保健提供者和工作人员不必切换应用程序(或上下文)来访问关键信息.

医院和其他医疗保健组织还需要确定如何将短信活动纳入其健康记录文档策略中. HIPAA规定，个人有权查看和修改用于制定有关其护理的临床决策的PHI, which might include information sent via text messages. As such, 允许短信的组织应该制定政策，“要求对通过文本接收的任何ePHI进行医疗记录注释，并用于对患者做出决定。."⁷

Additionally, 医院和其他医疗机构也应该与付款人和认证组织核实，看看他们是否提供了与短信相关的指导或标准. For example, the Centers for Medicare & 如果使用安全平台，医疗补助服务(CMS)允许在医疗团队成员之间发送患者信息, but CMS prohibits texting of patient orders. 同样，联合委员会也不允许用短信来传达病人的命令.⁸

Endnotes

¹ Is text messaging HIPAA compliant? (n.d.). HIPAA Journal. Retrieved from www.hipaajournal.com/is-text-messaging-hipaa-compliant/

² Is texting in violation of HIPAA? (n.d.). HIPAA Journal. Retrieved from www.hipaajournal.com/texting-violation-hipaa/

³ Ibid.

⁴ Jansen, J. (2014). mHealth will drive physician demand for secure text messaging in 2014. HIT Consultant. Retrieved from http://hitconsultant.net/2014/01/08/mhealth-will-drive-physician-demand-for-secure-text-messaging-in-2014/

⁵ Ibid.

⁶ 7 Advantages of HIPAA compliant texting apps. (n.d.). Zinc. Retrieved from http://content.zinc.it/Ebook_eBook-7-advantages-of-HIPAA-complaint-texting.pdf

⁷ Greene, A. H. (2012, April). HIPAA compliance for clinician texting. Journal of AHIMA, 83(4), 34-36

⁸ Centers for Medicare & Medicaid Services. (2017, December 28). 备忘录:医疗服务提供者之间的患者信息短信(参考文献:S&C 18-10-ALL). Retrieved from www.cms.gov /医疗/ Provider-Enrollment-and-Certification / SurveyCertificationGenInfo /下载/ Survey-and-Cert-Letter-18-10.pdf; The Joint Commission. (2021, October 22 [updated]). 常见问题:是否可以使用安全短信来传达病人的护理命令? Retrieved from www.jointcommission.org/standards/standard-faqs/home-care/leadership-ld/000002173/

本文件不构成法律或医疗建议，不应被解释为规则或建立护理标准. Because the facts applicable to your situation may vary, or the laws applicable in your jurisdiction may differ, 如果您对您的法律或医疗义务或权利有任何疑问，请联系您的律师或其他专业顾问, state or federal laws, contract interpretation, or other legal questions.

MedPro集团是指医疗保护公司的保险业务的营销名称, Princeton Insurance Company, PLICO, Inc. and MedPro RRG Risk Retention Group. 所有保险产品均由上述及其他伯克希尔哈撒韦附属公司撰写并管理, including National Fire & Marine Insurance Company. 产品的可用性取决于业务和/或监管部门的批准，不同公司之间可能有所不同. © 2021 MedPro Group Inc. All rights reserved.