HIPAA Compliant Messaging

Zoom is willing to sign a HIPAA Business Associate Agreement (BAA), which is an important element for HIPAA compliance, but it lacks end-to-end encryption which is the most important step towards achieving HIPAA compliance. At the time of writing, there are multiple security issues preventing HIPAA-compliance.

Read: Is Zoom a HIPAA Compliant Telehealth Software?

Facebook Messenger™ fails to meet all four HIPAA requirements and is not considered a HIPAA compliant telemedicine platform.

Further recommended reading: Is Facebook Messenger™ a HIPAA Compliant Telemedicine Platform?

Apple® is not willing to sign a BAA; therefore, its services, including FaceTime®, are not technically HIPAA compliant.

Further recommended reading:Is Apple FaceTime® a HIPAA Compliant Telehealth Software Platform.

WhatsApp® is NOT a HIPAA compliant telemedicine software and should not be used to share ePHI or deliver online healthcare since doing so would violate HIPAA regulations.

Further recommended reading: Is WhatsApp® a HIPAA compliant telemedicine software?

Yes. Bridge Patient Portal has gone through multiple rounds of third-party HIPAA audits and is ONC 2015 Edition certified. With the ONC 2015 certification, Bridge’s portal meets or exceeds all security requirements pertaining to patient portal software, as set forth in the standards for MACRA/MIPS and HIPAA. Protecting the privacy of your patients’ personal health information is a top priority for Bridge. As a Bridge customer you will also sign a Business Associate agreement with Bridge for HIPAA compliance purposes.

HIPAA-compliant features include:

• HIPAA compliant bill pay
• HIPAA compliant appointment scheduling
• HIPAA compliant appointment reminders

To learn more about security, please see: 8 Security Features You Need in an EHR or Patient Portal

Bridge Patient Portal is committed to the security, compliance and QA of each individual portal installation. Each portal is hosted on a secure Google cloud server with the appropriate firewalls. Bridge undergoes annual third-party HIPAA audits and various other security-related audits, Bridge also staffs a full-time compliance officer.

Offer patients a HIPAA compliant patient portal with Bridge.

Healthcare providers in the US must comply with HIPAA regulations, which were designed to provide privacy standards to protect patients’ medical records and other health information supplied to health plans, doctors, hospitals, and other healthcare entities. These regulations extend to all types of healthcare technologies that doctors might use to store and manage patient information. Although there is no definitive HIPAA certification for any organization, IT companies can be HIPAA-compliant. This means that they adhere to HIPAA regulations and take the necessary steps to ensure their products effectively protect sensitive patient information.

Bridge has a long history in helping healthcare organizations meet and understand HIPAA guidelines as they are developers of a HIPAA compliant patient portal.

To learn more about HIPAA and healthcare applications, please see:

HIPAA and Healthcare Applications, Part 1 of 3: What You Need to Know About User Authentication

HIPAA and Healthcare Applications, Part 2 of 3: What You Need to Know About Auditing

HIPAA and Healthcare Applications, Part 3 of 3:What You Need to Know About Data Transfer

The short answer is yes. That being said depending on the content of the email/sms, who the email/sms is being sent to, or mechanisms put in place to ensure the integrity of Protected Health Information (PHI), email/sms can be in compliance with HIPAA in certain circumstances. The patient also has the ability to sign an opt-in agreement (where they accept the risks of PHI in messages) with a health organization and receive PHI via email/sms. The opt-in agreement is a common practice among Bridge clients.

For more information please see: The Facts about HIPAA and Email/SMS Communication with Patients

While Skype’s® encryption methods are strong, one of the most compelling reasons against the use of Skype® for healthcare provider-patient communication is that Skype® will not enter into a Business Associate Agreement (BAA), which is required under the HIPAA Omnibus Rule. Organizations that use the software to communicate with patients over the Internet should be aware of the risks involved and consider using other video conferencing platforms instead.

For more information please see: Is Skype HIPAA Compliant?

Yes, granted the provider has a direct message address.