I. PURPOSE

 

It is the policy of myPlace PACE to permit the limited use of text messaging to communicate with prospects, participants, or their designated representatives in a manner that is consistent with the Health Insurance Portability and Accountability Act (HIPAA) Security Rules.

II. POLICY DESCRIPTION

 

The policy provides guidance on short message service (SMS) text messaging by myPlace PACE team members with participants and/or their designated representative and addresses security risks and procedural issues presented by SMS text messaging.

 

III. RESPONSIBILITY

National Director of Quality and Compliance Programs

 

IV. DEFINITIONS

 

1. Participant: Individual enrolled in myPlace PACE program
2. Prospect: Individual engaged in enrollment process to become a participant in myPlace PACE program
3. Protected health information (PHI): Individually identifiable health information in any form whether oral, written, or electronic. Individually identifiable health information refers to information that:
   
   1. Relates to the individual’s past, present, or future physical or mental health or condition; the provision of health care to the individual; or the past, present, or future payment for the provision of health care to the individual.
   2. Identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.
4. Short Codes (numbers): Five- or six-digit special telephone numbers used for sending short message service (SMS) messages.
5. SMS (Short Message Service also known as Text Messaging): The sending of 160-character messages over a cell phone or through a web-based interface to one or more cellphone recipients.
6. SMS Vendor: A company that provides a web-based interface to store contact lists and manage the flow of messages from the sender to the cellular phone carriers.

V. PROCEDURE DESCRIPTION

 

1. Consent to contact prospects, participants, or their designated representatives prior to engaging in text messaging.
   
   1. Consent may be obtained:
      
      1. In writing
      2. Opting in through a website
      3. Or through the use of short code
   2. All forms of consent whether written or electronic, will be retained in accordance with medical record retention requirements.
   3. Consent must include the following:
      
      1. Statement that the individual’s cellular service provider may charge the individual a fee for transmitting and delivering text messages.
      2. Information on how to opt-out of receiving text messages. If using a short code, participants, prospects, and/or the designated representatives must be told that they can opt-out of a texting program at any time by texting “stop” or “unsubscribe” to the five- or six-digit short code.
      3. A request that the individual notify myPlace PACE of a change in phone number, and information on how to provide that information.
2. Test messages must only be sent from approved, secure devices or applications owned or managed by myPlace Health
   
   1. Participant, prospect, and/or designated representation contact information should not be stored in the contact lists.
   2. All message must clearly indicate who the message is from.
   3. Approved software must use encryption when PHI is exchanged.
3. Text messages must not contain protected health information (PHI).
   
   1. Examples of approved text message content include but are not limited to:
      
      1. “Keep our community protected against the flu and COVID by getting vaccinated – myPlace PACE”
      2. “This is a reminder that your transportation is scheduled to arrive at [Time] on [Date] – myPlace PACE”
      3. “This is a reminder of your upcoming appointment on [Date] at [Time] – myPlace PACE.
      4. “We have been trying to reach you. Please call us at [Phone number] – myPlace PACE.”
4. If a participant, prospect, or their designated representative provides a message that contains PHI, send a new message requesting that they call myPlace PACE.
   
   1. There will be no PHI in the response.
   2. Clinical escalation will be initiated as appropriate.
5. The use of text messaging does not replace documentation in the electronic medical record or customer relationship management software.
   
   1. Documentation in the electronic medical record will be completed within 24 hours of the sending or receipt of the text message.
6. None of the data collected through participant, prospect, and/or their designated representative consent information or text messages will  be shared with or sold to third parties.
7. All relevant text message exchanges must be documented in the participants electronic medical record (EMR) – THIS IS OPTIONAL
8. Participants, prospects, and their designated representatives can opt-out of receiving text messages at any time.
9. Any security incidents or breaches related to text messaging must be reported immediately to the Compliance Officer.

VI. EXCEPTIONS / EXEMPTIONS

 

Not Applicable

 

VII. DOCUMENTATION

 

• NA

 

Revision date(s):

 

• n/a