Anyone who has spent time advocating for Healthcare IT has no doubt heard some variation of, “You can’t send medical records over the Internet.” There seems to be a prevalent belief that electronic communications are somehow less secure than other forms of communication and that using tools like the Internet is inherently dangerous. Let’s take a look at the processes used for four types of communication (phone, mail, fax, and web) and compare how they stack-up against the measure of protecting health information (PHI).
US Mail – The old tried and true method of sending PHI has always been the US Mail. You drop that letter in the box with the utter 100% assurance that it will reach the intended recipient each and every time and never be misrouted or intercepted. Really? You take PHI, print it on a piece of paper, stick it in an envelope, seal it with spit, drop it into the hands of the Federal Government and hope it gets to where it’s going.
Here’s what you don’t know. You don’t know who handles the PHI in transit. Did the PHI actually reach the intended address and was the address correct? Can anyone out there say their contact database is completely accurate with only correct addresses? You don’t know who opens the envelope and who handles that piece of paper along the step from envelope to chart. There is no audit trail to ensure authorized individuals only viewed the PHI.
All this trouble yet US Mail seems to remain as the leading form of communication in use today for the exchange of medical information. We can do better.
The Phone – You call the patient/physician directly and share PHI with the individual on the other end of the phone. This method seems a bit more secure, as long as you verify the identity of the individual on the other end of the line, make sure they are not using a speaker phone, and that no unauthorized individuals are within earshot of the call.
Here’s what you don’t know. You don’t know if that call is being intercepted. Is the call placed on a cordless phone? If so, someone with a simple radio receiver could be listening to your conversation. If a cell phone is being used, you may have the same problem. What if the person is not there? Heaven forbid you leave a message on a voicemail box or answering machine for anyone to hear.
While the phone seems to be a better solution for exchange of PHI, it requires both parties be willing and available at the same time in order for the transfer to take place. Ultimately, this proves to be the biggest problem with the phone approach.
FAX – The FAX machine was invented in the mid-80s and quickly dominated the business landscape. The ability to instantly transfer documents to locations around the world has great appeal and it seems like a natural fit for exchanging PHI. Simply place a document on the FAX machine, dial the number, and hit send. Instantly, the information is sent to the hands of the intended recipient and everyone is happy.
Here’s what you don’t know. You don’t know for sure if the number you dialed was the correct number. Yes, you can get a confirmation page, but you have to request and review the confirmation page and if that confirmation comes back with the wrong name, you cannot recall the FAX you just sent. The damage is done. With the explosion of mobile devices, phone numbers are changing constantly and having the correct FAX number is a bigger nightmare every day. Can anyone honestly say their contact phone numbers are 100% accurate?
You also don’t know if anyone is standing at the FAX machine when the document is being sent. Yes, you are supposed to know, but who really takes the time to confirm the correct individual is standing by the correct machine at the correct time?
These are the three standard and accepted forms of communication for PHI and all three of them have serious security concerns for patients and providers. To be more secure, all three require more resources. Mail can be registered. Phone call can be planned and scheduled to ensure security. FAX messages can be scheduled, tested, and confirmed. All of these measures have significant cost increases for healthcare organizations. What else is there and is it better?
Internet Communications – You make PHI available via a secure web site, require users to be authenticated, encrypt the transfer of information, log every instance of PHI access with unique user, date, time, location, IP address, operating system, web browser, etc., and run audits periodically to ensure security is maintained. If done right, this form of communication is far and away the MOST secure and cost effective way to exchange data.
Here’s what you DO know – You know who logged in, when, how long, from where, and exactly what they viewed. You know communication was encrypted and could not be intercepted during the coarse of the transaction. You have the added ability to limit or end access to PHI on a per user basis if a patient decides to stop communications with a given provider.
You have also provided access to information outside of the demands for a scheduled information exchange time. You can send records to individuals on the opposite side of the globe and do it during regular business hours. You are falling in line with other industries who recognize the power of Internet transactions such as banks, retailers, and everyone else doing business in the world.
Are there any risks with Internet access to PHI? Of course there are. My qualifying statement was, “if done right.” There are HIT professionals who can design and build systems that accomplish all the security goals for electronic PHI exchange. Those individuals need to be engaged in the design and deployment of any electronic system. You also need to engage information security professionals.
There is also the issue with forgetting passwords or sharing passwords. Both of those ultimately fall on the end user, but a well-designed system would minimize the “forgots” and eliminate the sharing.
The only true secure way to exchange PHI is in-person face-to-face. After that, using a web-based secure system is the ONLY way to go.