
Providing extreme convenience, smartphones are becoming a popular among physicians for professional use. Being able to communicate and share data instantaneously may seem practical, however there are ways that using a smartphone can violate HIPAA. As a result, there are several arguments that could be made to ban smartphone use in medical practice.
Unsecured Networks
Emailing staff or colleagues about a patient may be an act you have grown not to think much of, however, this data may be abused by others depending on the setting. If on an unsecure network, such as any public Wi-Fi with no password, you are at risk of having information you send being stolen. It is highly recommended that you refrain from sending protected health information (PHI) on any unsecured network, and wait to do so until on a safe connection. If necessary, Total HIPAA Compliance recommends you use a VPN for extra security, ensure that sites you browse have a valid SSL/TLS certificate, and encrypt any info you send.
Texting
Text messaging is arguably the most common task we use our smartphones for, but should also be handled very delicately to avoid violating HIPAA. Any text messages sent containing PHI are immediate violations of HIPAA. Text messaging is not an automatic violation of HIPAA, being that there are certain criteria that deem the message as compliant or not. The Security Rule, published February 20, 2003, specifies a series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality, integrity, and availability of e-PHI,” that apply to text messages, according to HHS. When encryption, policies covering scenarios in which phones are lost or stolen, and other systems ensuring PHI safety are in place, text messages can be viewed as compliant.
Are you being #HIPAA compliant in the way you utilize your cell phone in the #woundclinic? https://t.co/B9tJnDkfb8
— Today’s Wound Clinic (@TWCjournal) May 24, 2017
Cloud Storage
Cloud storage also presents a fairly obvious risk for PHI safety, being that many files are automatically uploaded to a public cloud via smartphone. For this reason, any physician accessing PHI’s on their smartphone should always have their cloud settings turned off due to potentially poor data security.
Photographs
Photos taken from a cell phone may present as a HIPAA violation as well. If a physician is to take a quick picture of a patient radiograph with information present that could allow patient identification, this would be a violation of HIPAA. Additionally, the phone could lack security needed to protect the image as well (ie photo upload to cloud storage, unsecured network usage).
With maximum fines up to $50,000, HIPAA violations are a very serious issue that should be avoided at all costs. The smartphone’s role in medicine could potentially be beneficial, however with HIPAA violations, many argue for banning the devices. For more on smartphones in medicine, click here.
Orlando Firefighter was fired after he violated HIPAA by using his cell phone to record a medical call involving a Commissioner who was a patient. https://t.co/VDWDI2wy5W
— NYC EMS Watch (@NYCEMSwatch) November 22, 2017
Sources: TigerConnect, TotalHIPAA, HIPAA Journal, Pulmonary Advisor