HIPAA Compliance with Mobile Devices Among ACGME Programs

Abstract

To analyze self-reported HIPAA compliance with mobile technologies among residents, fellows, and attendings at ACGME training programs. A digital survey was sent to 678 academic institutions over a 1-month period. 2427 responses were analyzed using Chi-squared tests for independence. Post-hoc Bonferroni correction was applied for all comparisons between training levels, clinical setting, and specialty. 58 % of all residents self-report violating HIPAA by sharing protected health information (PHI) via text messaging with 27 % reporting they do it "often" or "routinely" compared to 15-19 % of attendings. For all specialties, 35 % of residents use text messaging photo or video sharing with PHI. Overall, 5 % of respondents "often" or "routinely" used HIPAA compliant (HCApps) with no significant differences related to training level. 20 % of residents admitted to using non-encrypted email at some point. 53 % of attendings and 41 % of residents utilized encrypted email routinely. Physicians from surgical specialties compared to non-surgical specialties demonstrated higher rates of HIPAA violations with SMS use (35 % vs. 17.7 %), standard photo/video messages (16.3 % vs. 4.7 %), HCApps (10.9 % vs. 4.9 %), and non-HCApps (5.6 % vs 1.5 %). The most significant barriers to complying with HIPAA were inconvenience (58 %), lack of knowledge (37 %), unfamiliarity (34 %), inaccessible (29 %) and habit (24 %). Medical professionals must acknowledge that despite laws to protect patient confidentiality in the era of mobile technology, over 50 % of current medical trainees knowingly violate these rules regularly despite the threat of severe consequences. The medical community must further examine the reason for these inconsistencies and work towards possible solutions.

Parent and Clinician Preferences for an Asthma App to Promote Adolescent Self-Management: A Formative Study

“…Apps are often designed without enough or appropriate security and privacy measures in place to protect users’ health information [26]. There are numerous options for safeguarding health information and creating HIPAA compliant apps that allow for efficient and convenient data transfer [27] and these should be incorporated into new adolescent asthma app designs.…”

Evaluation of Secure Messaging Applications for a Health Care System: A Case Study

“…11 However, the ease and utility of SMS has prompted medical staff to continue to use insecure technology to communicate electronic protected health information (ePHI). 2,12,13 Personal health care information is confidential and has extensive legislative protection against unintentional disclosure. The Health Insurance Portability and Accountability Act (HIPAA) security rules require covered entities to:…”

“…2,5,12 In the routine delivery of patient care, ePHI such as initials, patient names, room, and medical record numbers are commonly included in such text messages. 4,6,12,13 Accidental or unintended disclosure of ePHI through insecure text messaging located on portable devices puts health care organizations at risk for monetary penalties in addition to the direct risk to patient privacy. 12 Although there have not been any reported HIPAA breaches due to insecure SMS to date, many cases of lost or stolen devices have resulted in breach notifications and corrective action plans from the Office for Civil Rights.…”

The danger of missing instructions

“…A variety of approaches have studied health organizations' security requirements in EHRs, medical information systems and mobile devices. For instance, Farhadi et al [3] and McKnight and Franko [13] studied EHRs and mobile devices respectively, in terms of their compliance with HIPAA and Meaningful Use requirements. In another example, Uwizeyemungu and Poba-Nzaou [20] studied health information systems in Europe for their compliance with basic security measures, defined in terms of Confidentiality, Integrity and Availability.…”