CMS Clarifies that Texting PHI Through Secure Platforms Is Permissible – But Not Orders!

Published by: Hall Render

In a December 28, 2017, a memo (“Memo”) to state survey agency directors, CMS made clear that texting patient information is allowed as long as a secure texting platform is used, recognizing the importance of texting as an “essential and valuable means of communication among the team members” caring for patients. Providers must comply with HIPAA and meet the applicable Conditions of Participation (42 C.F.R. §489.24) to ensure that patient confidentiality is upheld and documentation requirements are met.

In the Memo, CMS highlighted the need to:

Use secure, encrypted platforms to limit the risk of exposing patient information; and
Develop and adhere to policies and procedures that ensure the security and integrity of the secure texting platform.

Texting Orders Still Prohibited

CMS also restated its prohibition on texting orders, stating that orders should be entered into the patient medical record “via a handwritten order or via CPOE.” CPOE is Computerized Provider Order Entry, an electronic method of placing orders. CMS emphasized that CPOE orders that are immediately downloaded into the electronic health record, dated, timed and authenticated are allowed.

Practical Takeaways

This Memo provides welcome relief to the health care industry’s concern that CMS’s earlier position could be interpreted to mean a prohibition against texting. For more history, see our prior blog.

In light of this Memo, consider the following.

Document your organization’s risk assessment of its secure texting platform.
Evaluate your organization’s current policies and procedures on texting and confirm that such policies and procedures are clearly communicated and enforced.
Verify that your organization’s secure texting platform ensures the confidentiality of information and that any required documentation is performed in accordance with the CoPs.

For more information, please contact: