{"id":2498,"date":"2018-05-04T11:23:20","date_gmt":"2018-05-04T15:23:20","guid":{"rendered":"https:\/\/www.med.unc.edu\/patientprivacy\/?page_id=2498"},"modified":"2024-08-15T11:38:49","modified_gmt":"2024-08-15T15:38:49","slug":"texting-and-emailing-phi","status":"publish","type":"page","link":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/","title":{"rendered":"Texting and Emailing PHI"},"content":{"rendered":"

Communication of protected health information (PHI) with others both internal and external to UNC Health and to our patients is a critical function necessary to the ongoing operations of our health care enterprise. When PHI is shared in a communication between individuals\/entities, the communication must be secure regardless of the medium in which the communication occurs. The following are summaries of UNC Health HIPAA policies governing the requirements for sending PHI via text message and via email.<\/p>\n

Texting PHI is Permitted as Follows:<\/h4>\n\n\n\n\n\n\n\n\n\n
Purpose of Text Message<\/td>\nSent by & Sent to<\/td>\nPermitted?<\/td>\nRequirements<\/td>\nMore Information<\/td>\n<\/tr>\n
Appointment Reminder<\/strong><\/p>\n

via system-wide automated patient appointment reminder<\/td>\n

Sent by:<\/span> Participating UNC Health areas only<\/p>\n

Sent to:<\/span> patients<\/td>\n

Yes<\/td>\nMust participate via the official UNC Health text appointment reminder application<\/p>\n

Appointment Reminders MAY NOT be sent via any other application or by clinics\/employees independently.<\/em><\/td>\n

<\/td>\n<\/tr>\n
Texting PHI<\/strong><\/td>\nSent by:\u00a0<\/strong><\/span>nurses, physicians or other clinical care staff (internal)<\/p>\n

Sent to:<\/strong>\u00a0nurses, physicians or other clinical care staff (internal or external)<\/td>\n

Yes \u200b\u2013 for limited situations for\u00a0treatment purposes only<\/td>\nTexting PHI for treatment purposes among providers and staff is permitted by UNC Health policy through:<\/p>\n<\/td>\n<\/tr>\n
Texting Pictures of Patients or Patient Care Activities
\nsuch as pictures of wounds<\/em>\u00a0with\u00a0identifying information\u00a0(such as patient’s MRN)<\/em><\/strong><\/td>\n		Sent by:<\/strong><\/span>\u00a0nurses, physicians or other clinical care staff (internal)<\/p>\n

Sent to:nurses, physicians or other clinical care staff (internal or external)<\/td>\n

Yes \u200b\u2013 for limited situations<\/td>\nTexting pictures of patient information such as wounds for treatment purposes among treating providers is permitted by UNC Health policy when<\/p>\n
    \n
  • Using the Epic Haiku application (picture is taken with a cell phone and uploaded to Epic through the approved Haiku application)<\/li>\n<\/ul>\n

     <\/td>\n

Pictures of patient treatment areas may be taken using a cellphone and uploaded via the Haiku application \u2013 only available for institutions that are on Epic. For more information contact your information security helpdesk.<\/td>\n<\/tr>\n
Texting De-identified Pictures of Patients or Patient Care Activities<\/strong><\/p>\n

such as pictures of wounds<\/td>\n

Sent by:<\/span> nurses, physicians or other clinical care staff<\/p>\n

Sent to:<\/span> nurses, physicians or other clinical care staff<\/td>\n

Yes – but preference is to send these photos through Epic Haiku application<\/td>\n\u200bAll patient identifiers must be removed (i.e., no name, MRN, demographic data, dates of services, DOB, SSN, etc.).<\/td>\n\u200bTexting a de-identified picture is not a privacy violation. However, by taking a picture of a wound with a personal cell phone and sending it to another UNC Health provider (such as a resident sending a picture to an attending) may raise questions by a patient on whether their data is properly protected. Additional professional issues may be raised. Therefore, the Privacy Office does not recommend that de-identified pictures of patients or patient body parts be sent outside of the Epic Haiku application.<\/td>\n<\/tr>\n
Texting Patients<\/strong><\/p>\n

for any reason associated with their care – messages sent unencrypted<\/strong><\/em><\/td>\n

Sent by:<\/span> nurses, physicians or other clinical care staff<\/p>\n

Sent to:<\/span> patients or their family\/friends\/or caregivers<\/td>\n

Yes – for limited purposes<\/td>\n\n
    \n
  1. Must have the patient sign the UNC Health Authorization for Electronic Communication<\/li>\n
  2. Must not<\/span><\/strong> text any sensitive PHI (SS#s, DL#, financial info or sensitive medical information)<\/li>\n
  3. Text messages may only be sent to patients for permitted purposes set forth in this policy.<\/li>\n
  4. Patients may not respond with text messages using free text (patients may only respond with preprogrammed replies (i.e., text #1 for yes, #2 for no, etc)<\/li>\n<\/ol>\n<\/td>\n
<\/td>\n<\/tr>\n
Texting Patients <\/strong><\/p>\n

for any reason associated with their care – messages sent encrypted<\/strong><\/em><\/td>\n

Sent by:<\/span> nurses, physicians or other clinical care staff<\/p>\n

Sent to:<\/span> patients or their family\/friends\/ or caregivers<\/td>\n

Yes<\/td>\n\n
    \n
  1. Must have the patient sign the UNC Health Authorization for Electronic Communication<\/li>\n
  2. Must not<\/span><\/strong> text any sensitive PHI (SS#s, DL#, financial info, or sensitive medical information)<\/li>\n
  3. Text messages may only be sent to patients for permitted purposes set forth in policy.<\/li>\n<\/ol>\n<\/td>\n
 <\/p>\n

Must use a third-party vendor approved application to send encrypted communications to the patient. Must have Privacy Office approval for vendor application. Vendor must be vetted through UNC Health ISD Architecture Review Board.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Emailing PHI is Permitted as Follows:<\/h4>\n\n\n\n\n\n\n\n\n\n
Safeguards<\/td>\nUNC Health Internal Message (between UNC Health email accounts @unchealth.unc.edu)<\/td>\nMessages between UNC Health email accounts and SOM email accounts (@med.unc.edu)<\/td>\nMessages between UNC Health email account and external accounts (i.e., gmail.com, gov.com)<\/td>\n<\/tr>\n
Inspect address of intended recipients before sending; avoid sending to distribution lists unless recipient addresses can be inspected.<\/td>\nRequired<\/td>\nRequired<\/td>\nRequired<\/td>\n<\/tr>\n
ALWAYS ensure that recipients are authorized to obtain the PHI<\/td>\nRequired<\/td>\nRequired<\/td>\nRequired<\/td>\n<\/tr>\n
Encrypt the email during transmission<\/td>\nSystem Provided<\/td>\nSystem Provided<\/td>\nRequired<\/td>\n<\/tr>\n
Encrypt the PHI content:<\/p>\n
    \n
  1. In message body<\/li>\n
  2. In file attachment<\/li>\n<\/ol>\n<\/td>\n
\n
    \n
  1. Not Required<\/li>\n
  2. Required if there are more than 499 unique identities in the file<\/li>\n<\/ol>\n<\/td>\n
\n
    \n
  1. Required<\/li>\n
  2. Required<\/li>\n<\/ol>\n<\/td>\n
\n
    \n
  1. Required<\/li>\n
  2. Required<\/li>\n<\/ol>\n<\/td>\n<\/tr>\n
Label the message “Confidential” on the first line within the body of the message<\/td>\nRecommended<\/td>\nRequired<\/td>\nRequired<\/td>\n<\/tr>\n
Type (secure) in the subject line to encrypt the message. Be sure an include the parentheses and add a space after the last parentheses<\/em><\/td>\nNot Required<\/td>\nNot Required<\/td>\nRequired<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Communication of protected health information (PHI) with others both internal and external to UNC Health and to our patients is a critical function necessary to the ongoing operations of our health care enterprise. When PHI is shared in a communication between individuals\/entities, the communication must be secure regardless of the medium in which the communication … Read more<\/a><\/p>\n","protected":false},"author":79870,"featured_media":2541,"parent":2487,"menu_order":4,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":"","_links_to":"","_links_to_target":""},"class_list":["post-2498","page","type-page","status-publish","has-post-thumbnail","hentry","odd"],"acf":[],"yoast_head":"\nTexting and Emailing PHI - Privacy Office<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Texting and Emailing PHI - Privacy Office\" \/>\n<meta property=\"og:description\" content=\"Communication of protected health information (PHI) with others both internal and external to UNC Health and to our patients is a critical function necessary to the ongoing operations of our health care enterprise. When PHI is shared in a communication between individuals\/entities, the communication must be secure regardless of the medium in which the communication … Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/\" \/>\n<meta property=\"og:site_name\" content=\"Privacy Office\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-15T15:38:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp-1024x444.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"444\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/\",\"url\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/\",\"name\":\"Texting and Emailing PHI - Privacy Office\",\"isPartOf\":{\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp.jpg\",\"datePublished\":\"2018-05-04T15:23:20+00:00\",\"dateModified\":\"2024-08-15T15:38:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#primaryimage\",\"url\":\"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp.jpg\",\"contentUrl\":\"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp.jpg\",\"width\":7917,\"height\":3431,\"caption\":\"Panoramic view of UNC Hospitals, School of Dentistry and Manning Drive.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.med.unc.edu\/patientprivacy\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privacy Topics\",\"item\":\"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Texting and Emailing PHI\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.med.unc.edu\/patientprivacy\/#website\",\"url\":\"https:\/\/www.med.unc.edu\/patientprivacy\/\",\"name\":\"Privacy Office\",\"description\":\"UNC Health Care System\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.med.unc.edu\/patientprivacy\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Texting and Emailing PHI - Privacy Office","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/","og_locale":"en_US","og_type":"article","og_title":"Texting and Emailing PHI - Privacy Office","og_description":"Communication of protected health information (PHI) with others both internal and external to UNC Health and to our patients is a critical function necessary to the ongoing operations of our health care enterprise. When PHI is shared in a communication between individuals\/entities, the communication must be secure regardless of the medium in which the communication … Read more","og_url":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/","og_site_name":"Privacy Office","article_modified_time":"2024-08-15T15:38:49+00:00","og_image":[{"width":1024,"height":444,"url":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp-1024x444.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/","url":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/","name":"Texting and Emailing PHI - Privacy Office","isPartOf":{"@id":"https:\/\/www.med.unc.edu\/patientprivacy\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#primaryimage"},"image":{"@id":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#primaryimage"},"thumbnailUrl":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp.jpg","datePublished":"2018-05-04T15:23:20+00:00","dateModified":"2024-08-15T15:38:49+00:00","breadcrumb":{"@id":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#primaryimage","url":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp.jpg","contentUrl":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-content\/uploads\/sites\/524\/2018\/05\/prexd.hospfrontp.jpg","width":7917,"height":3431,"caption":"Panoramic view of UNC Hospitals, School of Dentistry and Manning Drive."},{"@type":"BreadcrumbList","@id":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/texting-and-emailing-phi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.med.unc.edu\/patientprivacy\/"},{"@type":"ListItem","position":2,"name":"Privacy Topics","item":"https:\/\/www.med.unc.edu\/patientprivacy\/privacy-topics\/"},{"@type":"ListItem","position":3,"name":"Texting and Emailing PHI"}]},{"@type":"WebSite","@id":"https:\/\/www.med.unc.edu\/patientprivacy\/#website","url":"https:\/\/www.med.unc.edu\/patientprivacy\/","name":"Privacy Office","description":"UNC Health Care System","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.med.unc.edu\/patientprivacy\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links_to":[],"_links_to_target":[],"_links":{"self":[{"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/pages\/2498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/users\/79870"}],"replies":[{"embeddable":true,"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/comments?post=2498"}],"version-history":[{"count":0,"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/pages\/2498\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/pages\/2487"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/media\/2541"}],"wp:attachment":[{"href":"https:\/\/www.med.unc.edu\/patientprivacy\/wp-json\/wp\/v2\/media?parent=2498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}