.png)
The COVID-19 pandemic forced many healthcare providers to switch to
telehealth, or virtual care. Despite pandemic restrictions having been lifted, much of the public has come to prefer telehealth over visiting an office. Studies show that the use of virtual care is 38 times higher now than it was pre-pandemic, leading to a surge in the use of video conferencing tools like Zoom, Microsoft Teams, and Cisco WebEx.
While these tools can be a convenient way to see patients, it's important for health professionals and organizations to ensure their communication with patients remains HIPAA compliant. As a refresher, HIPAA is a federal law that protects the privacy and security of patient health information (PHI).
Let's dive into a few essential tips for remaining compliant while seeing patients virtually.
Choose a HIPAA-compliant video conferencing tool.
Not all video conferencing tools are HIPAA
compliant. Using the wrong platform could be detrimental to your organization and practice if discovered during a HIPAA audit. The best way to do this is to ensure the tool you choose has a Business Associate Agreement (BAA) in place with your practice. This agreement will ensure that the tool will protect your patients' PHI and protect your organization from any potential HIPAA fines or malpractice.
Set up a secure meeting space.
When you're seeing patients virtually, it's important to set up a secure meeting space. This means ensuring that the room is free from distractions and there is no unauthorized access to the video conference. Part of this is ensuring the above point is taken care of by using a compliant conferencing platform. The other piece is ensuring that only the authorized person is hearing the conversation between the medical professional and the patient. Having enclosed meeting rooms and only authorized personal in the room during the call is the best way to address this.
Encrypt your communications.
All communications between you and your patients should be encrypted. This
will help to protect your patients' PHI from being intercepted by unauthorized individuals. One example is when communicating with patients through online chat, it's crucial to have encryption that renders your data unreadable to any unauthorized individuals on the internet.
Here are some tips for patient best practices when communicating online:
- Only enter your personal information on secure websites with a lock icon in the address bar
- Keep your devices protected with updated antivirus software
- Protect your wireless connection with a password
- Avoid using public Wi-Fi to access telehealth services
- Avoid accessing telehealth on devices shared with people outside of your home or family
- Don’t set up a telehealth appointment or share your information with a provider you don’t know or with information you don’t recognize. Call your regular provider’s main phone number to confirm their identity first.
Use strong passwords and two-factor authentication.
When you're setting up your video conferencing account, be sure to use strong passwords and two-factor authentication. This will help to protect your account from unauthorized access. There are no set password policies implemented by HIPAA, but the recommendation is to follow the password guidelines set by NIST Cybersecurity Framework (CSF).
The Department of Health and Human Services suggests there are three ways in which users can verify their identity:
- With something only known to the user, such as a password or PIN,
- With something the user possesses, such as a smart card or key, or
- With something unique to the user, such as a fingerprint or facial image.
Train your staff.
Train your staff on how to use the video conferencing tool and
how to protect patient PHI. This training should cover topics like the ones discussed above; setting up a secure meeting space, encrypting communications, and using strong passwords.
By following these tips, you can help to ensure that your patients' PHI is protected when you see them virtually.
Which Virtual Meeting Providers Are Most Secure?
There are a number of video conferencing providers that offer HIPAA-compliant solutions. Some of the most popular options include:
These providers offer a variety of features that can help to protect patient PHI, such as encryption, strong passwords, and two-factor authentication.
When choosing a video conferencing provider, consider your specific needs and requirements. If you have any questions, be sure to contact the provider directly.
Telehealth is a convenient and effective way to see patients. By following the tips in this blog, you can help to ensure that your patients' PHI is protected when you see them virtually. If you're looking for assistance in becoming compliant with HIPAA, reach out today to see how Charles IT's services can help you!
