Medical Offices have powerful new tools available to them for reaching out to their patients to describe products and services that patients could be interested in. However, there are limitations on the use of Protected Health Information for marketing purposes and limitations under other laws that limit contacting patients on their cell phones.
As health care providers and their patients increasingly come to depend on electronic communications, there are new demands for communication via e-mail and texting, including communications for healthcare and marketing purposes. But there are limitations on how the information you have about patients can be used for reaching out to them for purposes of continuation of care or for what might be called marketing. Medical Offices need to be aware of not only HIPAA, but also the Telephone Consumer Protection Act of 1991 (TCPA), the CAN-SPAM Act, and other limitations.
Using patient information is a complex issue because how the information may be used depends on what the information is being used for. If the communications are considered to be providing treatment options for a patient, there are no HIPAA limitations. But if the communications would be considered marketing of a different or new service, not related to the continuation of care for the patient, a HIPAA Authorization from the patient is required before the communication can take place.
The reasons for your contacting a patient also come into play when it comes to reaching out to patents’ cell phones. If you’re contacting a patient by voice or text message for payment purposes, you need to have prior consent under the TCPA. Even for healthcare purposes, there are limitations on the length and frequency of voice calls and voice and text messages. Getting consent to contact cell phones is essential.
And even if you have all the authorizations and consents you need in place, you still have to be aware of the limitations on using e-mail for marketing purposes. Marketing e-mails must provide the means to easily opt-out of future communications, and you must honor such requests, or there is a violation.
There are many ways to go wrong when it comes to patient communications, and marketing using texting and e-mails is full of opportunities for missteps. It is important to know what the limitations and requirements are before you start. This session will focus on reaching out to patients to provide them with information about products and services you provide, and understanding how such communications may be conducted, depending on the relationship and the information. The session will explain how to understand which regulations may affect certain communications, and the steps that should be taken to ensure that communications do not run afoul of the many laws limiting such communication.
In order to integrate the use of e-mail and texting into patient communications, it is essential to perform the proper steps in an information security compliance process to evaluate and address the risks of using the technology. The process, including the use of information security risk analysis, will be explained, and the policies needed to support the process will be described.But the process must also include consideration of limitations on using PHI for marketing purposes in the HIPAA Privacy Rule. Reaching out to patients’ cell phones has its own issues and must be done properly or violations result. And e-mail has its own restrictions under laws to reduce spam e-mail. For each kind and type of communication, it is essential to understand what rules apply.
The stakes are high – any improper use of PHI may result in an official breach that must be reported to the individual and to the US Department of Health and Human Services, at great cost and with the potential to bring fines and other enforcement actions if a violation of rules is involved. Likewise, complaints by a patient can bring about HHS inquiries and enforcement actions, so it is essential to find the right balance of communication.
The session will discuss the requirements, the risks, and the issues of the increasing use of e-mail and texting for patient and provider communications and provide a road map for how to use them safely and effectively, to increase the quality of health care and patient satisfaction. In addition, the session will discuss how to be prepared for the eventuality that there is a breach, so that compliance can be assured.
Area Covered In The Session:
- Find out the ways that patients want to use their e-mail and texting to communicate with providers, and the ways providers want to use e-mail and texting to reach out to their patients and enable better patient care.
- Learn what are the risks of using e-mail and texting, what can go wrong, and what can result when it does.
- Find out about HIPAA requirements concerning the use of PHI for marketing purposes and how to understand what is marketing and what is providing patient care or treatment alternatives.
- Learn how the Telephone Consumer Protection Act of 1991 limits how you may reach out to patients’ cell phones for various purposes, and how a simple consent can reduce the issues.
- Find out how the CAN-SPAM Act limits your communications for marketing purposes and how you must respect your patients’ desires to not receive unwanted e-mail.
- Find out what policies and procedures you should have in place for dealing with e-mail and texting, as well as any new technology.
- Find out the steps that must be followed in the event of a breach of PHI.
At the conclusion of the session, participants will be able to:
- Understand the rules surrounding marketing to patients and associated laws.
- Know what is considered marketing as opposed to healthcare communications.
- Learn the steps to take to allow certain patient communications to take place freely.
- Know when secure communications are required and what must be done to secure communications and devices.
- Compliance Director
- Privacy Officer
- Security Officer
- Information Systems Manager
- HIPAA Officer
- Chief Information Officer
- Health Information Manager
- Healthcare Counsel/lawyer
- Office Manager
- Contracts Manager
About Our Speaker:
Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of health care entities. He is a frequent speaker regarding HIPAA, including speaking engagements at numerous regional and national healthcare association conferences and conventions and the annual NIST/OCR HIPAA Security Conference. Sheldon-Dean has more than 17 years of experience specializing in HIPAA compliance, more than 35 years of experience in policy analysis and implementation, business process analysis, information systems and software development, and eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master’s degree from the Massachusetts Institute of Technology.
Our Speaker’s Previous Webinar Snippet: