# Presentation: 683181

## e-Communication in Longitudinal Care:Guidelines and Policies

- Daniel Z. Sands, MD, MPH
*Beth Israel Deaconess Medical Center and*
*Harvard Medical School, Boston, MA*
*Zix Corporation, Dallas, TX*

## Slide 2

## Guidelines

- American Medical Informatics Association 1998
- Mass Health Data Consortium 1999
- Kaiser Northern California 1999
- AMA H-478.997 & E-5.026 (ethical)
- Medem 2005 (updated)
- This is commercial entity

## Policies: Medicolegal

- Understand appropriate vs. inappropriate use
- Use web messaging or encrypted e-mail rather than insecure e-mail when practical
- Provide e-care only to established patients who agree to this form of communication
- Document agreement in record
- Save messages in the patient’s record
- Log-off of computers & use screen-savers
- Hide recipient names when sending messages to multiple patients (BCC)

## Policies: Social and Practical

- Route messages to appropriate personnel
- Inform patients that other staff or providers might read messages
- Senders must identify themselves and patient
- Establish & enforce message turnaround time
- Include prior communications thread in message replies
- One topic per message
- Revoke access of patients who breach policies

## Policies Other

- When confronted with an electronic message from a patient that does not lend itself to electronic response, explain to the patient (via telephone, when appropriate) that alternative channels of care delivery must be used
- Verify patient e-mail addresses
- like any contact info
- Communicate policies to staff and patients:
- See _http://www.e-pcc.org_)

## Administrative Uses

- Prescription refills
- Appointment requests
- Managed care referrals
- Phone/address/insurance info

## Clinical Uses

- Non-urgent medical issues
- Monitoring:
- Wellness
- Chronic illness
- Therapy
- Agenda setting
- Post-visit follow-up

## Inappropriate Uses

- Medical emergencies
- Time-sensitive issues
- Issues requiring:
- Lengthy messages
- Long volleys of messages
- Communicating bad news
- Sensitive issues
- If weak system security

## Is Text Meant to be Free?

|  | Free Text | Structured Text |
| --- | --- | --- |
| Comfort | High | Low |
| Best for | “Soft” issues | “Hard” issues |
| Problem types | Many/unclear | Single/clear |
| Encounter billing | May require extra step | May be automated |

## Does the HIPAA Security Rule allow for sending electronic PHI in an email or over the Internet? If so, what protections must be applied?

- The HIPAA Security Rule does not expressly prohibit the use of email for sending electronic protected health information (PHI). However, the standards for access control, (45 CFR § 164.312(a)) integrity (45 CFR § 164.312(c)(1)), and transmission security (45 CFR § 164.312(e)(1)) require covered entities to implement policies and procedures to restrict access to, protect the integrity of, and guard against the unauthorized access to electronic PHI. The standard for transmission security (§ 164.312(e)) also includes addressable specifications for integrity controls and encryption. This means that the covered entity must assess its use of open networks, identify the available and appropriate means to protect electronic PHI as it is transmitted, select a solution, and document the decision. The Security Rule allows for electronic PHI to be sent over an electronic open network as long as it is adequately protected.

- http://questions.cms.hhs.gov/

## Is mandatory encryption in the HIPAA Security Rule? 

- No. The final HIPAA Security Rule made the use of encryption an addressable implementation specification. See 45 CFR §§ 164.312(a)(2)(iv) and 164.312(e)(2)(ii). Covered entities use open networks such as the Internet and e-mail systems differently, and no single interoperable encryption solution for communicating over open networks exists. Setting a single encryption standard could have placed an unfair financial and technical burden on some covered entities.The encryption implementation specification is addressable, and must therefore be implemented if, after an assessment, the entity has determined that the specification is a reasonable and appropriate safeguard in its environment. If the entity decides that the addressable implementation specification is not reasonable and appropriate, it must document that determination and implement an equivalent alternative measure, presuming that the alternative is reasonable and appropriate, or if the standard can otherwise be met, the covered entity may choose to not implement the implementation specification or any equivalent alternative measure.

- http://questions.cms.hhs.gov/

## SF 61 yo M Minister with Diabetes and Chronic Pain Syndrome

**I have a lot of medical issues. This email system has left me feeling comfortable and in good hands! Otherwise, I would feel as cold, depleted, and alone, as the lifeless tree in my front yard in the deepest of winter!**

## VK 55 yo M Lawyer with Hypertension, Overweight, Prostatic Hypertrophy

**Exchanges by email are the next best thing to a house call.**

## Questions

**dsands@bidmc.harvard.edu**

**Notes:**
Thank you.