Am I at risk of HIPAA fines if I use texting to communicate with caregivers?

The short answer: probably.

While texting is an obvious, convenient way to communicate with caregivers, you can get the same benefits without the risks by using a chat system designed to be HIPAA-compliant.

The longer answer:

Mind the PHI

As you’re likely aware, even strictly nonmedical home care agencies are still subject to HIPAA laws like any other part of the healthcare continuum.

HIPAA is designed to protect personal health information (PHI), and many of the ways that home care agencies should be mindful of HIPAA are taken care of simply by using a system like Careswitch to run their scheduling and operations.

However, too many home care agencies are still—knowingly or unknowingly—putting themselves at risk of HIPAA violations by relying on text to communicate with employees, rather than HIPAA-compliant chat systems like the chat features available in our system.

Let’s talk about why this is a problem.

Is Texting Employees a HIPAA violation?

Strictly speaking, no. Texting your employees isn’t a violation of HIPAA in and of itself. However, relying on texting for communications does put you at serious risk.

If any of the following information is ever sent in text messages by people in your company, that's a violation and you could be setting yourself up for major fines:

Name of clients (even just a first name)
Client phone numbers
ANY geographic subdivision smaller than a state. This includes street addresses, city, county, or zip code.
Client email address
Any other unique characteristic or identifier for a client or their property (identifying information about their vehicle, for instance)

More information on what’s considered PHI here and more about the HIPAA risks of text messaging here.

Even if you frequently train and remind your employees not to send this information, it’s very likely that it’s still happening more than anyone would like to admit.

Software helps protect you from human error

HIPAA-compliant chat is designed because human error happens and it’s easier to avoid the risk entirely.

The reason this information can be more freely sent in a HIPAA-compliant chat systems than in text is because these systems are designed with security measures and encryptions that meet HIPAA standards. It’s highly unlikely that any normal texting service or app (such as WhatsApp) would meet these requirements.

What happens if you get in trouble with HIPAA?

HIPAA fines can range anywhere from a few hundred dollars to millions of dollars. The lowest tier of HIPAA fines has a minimum of approximately $100 and a maximum of approximately $60,000.

It’s also important to recognize that 1) individual items of data (for instance, identifying information for separate clients) can count as separate violations, and 2) fines may be recurring, even daily, until the issue is addressed.

Federal litigation against home care agencies has increased exponentially over the last several years in an effort to increase compliance in the industry. (For example, litigation against home care agencies representing almost 10% of all Department of Labor suits last year, according to labor firm Littler.)

While it might be tempting to try and fly under the radar, any inspection, litigation, or audit—some of which happen randomly depending on the state—could shine a light on any HIPAA violations.

Want to be safe, not sorry?

The simplest way to avoid these risks is to use a HIPAA-compliant chat system wherever you can.

Careswitch offers both a basic free option and a paid option with more features if you’re concerned about compliance. If you’re a Careswitch user not currently on our premium chat, here’s a quick piece on how you could be using it.

As with any legal matter, at the end of the day it's best to consult with your legal counsel. This article doesn't take the place of legal advice from someone familiar with your specific situation.

Home Care FAQs