It's crazy-making.

A landline phone call and a fax (to a fax machine over a landline) are considered HIPAA compliant not because they are secure but simply because they are given loopholes in HIPAA regulations. (I guess traditional phone companies had lobbyists.)

Electronic communications require BAA subcontractor agreements whenever data is "at rest". So if the data is sitting in an email box, or a text messaging inbox, or a voicemail box (of a VoIP -- voice-over-IP) phone provider like Ring Central -- then a BAA is needed. [Voicemail sitting in a client's voicemail box has an exception to HIPAA -- I believe -- because its sitting in the voicemail box of a telco excepted from HIPAA... I'm unclear why its okay to leave voicemail for a client if they have a voicemail with a VoIP provider themselves (like Google Voice)...]

I don't think encryption is named in HIPAA or HITECH regulations, but precautions have to be taken to ensure security -- which de facto amounts to needing encryption.

So with text messaging containing PHI (private health information) -- there needs to be an app or website on both sides (client and therapist) in order to maintain the security (encryption) *AND* there needs to be a BAA in force on both sides. So having the client log into a portal (like EPIC or Therapy Appointment) to see messages is one option because the therapist has a BAA with EPIC or Therapy Appointment.

Another option would be for the client to be able to download an app from the company that the therapist has a BAA with and have that app also covered by the BAA. In the case of Ring Central, the client is forced to create a separate free 2nd account NOT covered by the therapist's BAA.

Here are a few websites that talk about message texting apps that are supposedly HIPAA compliant. I don't use any so I don't have a recommendation:
https://www.totalhipaa.com/hipaa-compliant-text-messaging-application-review/
https://www.jotform.com/blog/hipaa-compliant-text-messaging/

A messaging app like Signal would be perfect since its in common use and has great security -- but unfortunately they don't sign BAA agreements.

So there needs to be: a) no/little possibility of interference from anyone else AND b) a legal requirement that the vendor has to keep data in their possession safe. Or c) a loophole escaping HIPAA (like for landlines and banking).

Again -- I'm not a lawyer. And see earlier post this is a response to.

-- Michael

@psychology @socialwork @psychiatry @psychotherapists
#ringcentral