Skip to main content

Topic: Compliance, Privacy and Security

Compliance, privacy and security in patient communication: HIPAA, PCI, data protection, fraud prevention and certifications such as SOC 2.

HIPAA Compliant Texting: Are You Doing It Right?

Written on . Posted in Blog.

Simple Ways to Ensure Your Hospital or Clinic’s SMS Text Messages are Satisfying HIPAA and PHI Compliance

Most healthcare providers are aware that the best intentions can occasionally result in disaster. Sending SMS text messages—with colleagues or patients—is a prime example. Did you know that violating rules for HIPAA compliant texting can result in fines of $50,000 to $1.5 million per occurrence? Yes, that’s per occurrence. And think about it: How easy is it have multiple SMS conversations that include multiple text messages? How can you take advantage of using text messaging to provide better healthcare but still be HIPAA compliant? Here are some guidelines.

No Texting Means No PHI or HIPAA Violations

The easiest way to ensure you are sending HIPAA compliant text messages is to just not send non-personal text messages to patients or colleagues. More specifically, that means refrain from sending anything that would be considered protected health information (PHI) by the Health Insurance Portability and Accountability Act (HIPAA). HIPAA’s complete list of what makes something PHI is lengthy, but the general idea is it includes any written or visual information an unauthorized third-party could use to identify a patient, including:

• Names (including family members)

• Addresses

• Dates

• Phone and fax numbers

• E-mail addresses

• Website and IP addresses

• Social Security numbers

• Medical record numbers

• Photographs

• Biometrics (such as fingerprints)

Not accepting or discouraging text messages from patients is another way to ensure HIPAA compliance. This guidance may be overstating the obvious, but the reality is our mobile phones have become such common and convenient parts of our personal and professional lives, it’s tempting to use them. That desire might be even greater at smaller clinics where staff and patients may feel more comfortable exchanging their mobile phone numbers.

Use HIPAA-Compliant Communication Platforms for Texts…and e-Mail, too

If your hospital or clinic is compelled to use text messaging to improve patient engagement and outcomes—either to communicate with patients or for staff to communicate internally—it’s crucial that you are using a secure, HIPAA-compliant text message platforms and servers from providers. The same rules and penalties for HIPAA compliant texting apply for e-mail too, which is another convenient way to communicate with smartphones. Your hospital or clinic can take advantage of using e-mail to engage with patients if you are using secure, HIPAA-compliant technologies and protocols.
As Guideway Care Central/Western Regional Director, Chris Stearns is one of our key healthcare IT experts. Guideway Care is a cloud-based technology and services company that improves profitability and patient outcomes for hospitals and practices through end-to-end patient engagement solutions backed by clinical and non-clinical teams. Its HIPAA-compliant, SaaS platform improves care team workflows, automates patient communication and tracks patient progress to optimize the patient journey. Since 2004, leading healthcare providers have trusted Guideway Care to help acquire, manage and engage patients through complex episodes of care. HIPAA Compliant Texting

Will Chrome 62 TLS/SSL Requirements Affect Your Users’ Experiences or Your Online Rankings?

Written on . Posted in Blog.

Now is the Time to Update Your Hospital Website Encryption to Avoid the Dreaded Chrome 62 ‘Not Secure’ Label

As 2016 came to a close, we published a blog with a title that asked a simple but important question: “Is Your Hospital Website Secure Enough for Google in 2017?” Now in October 2017, the Chrome SSL Warning question is more relevant than ever. This month, Google is expected to release Chrome 62, which will mark Website pages without TLS/SSL encryption as “Not Secure”. It’s never too late to get your Website’s security up to spec for Chrome or all other browsers. But because this update may also impact your healthcare search engine optimization (SEO) and digital healthcare marketing results, there is no time like the present to make sure you are compliant for Chrome 62 and beyond.

Is Your Hospital Website ‘Secure’ for Chrome?

First, test your hospital Website’s security on Chrome:

• Open your Chrome browser

• Type in your hospital Website address

• Let the page load

• Look for the icon that appears in the address bar to the left of the URL

Do you see a green lock icon in the address bar?

• Yes! Hooray, your hospital Website is secure!

• No! Sorry, but your Website is not what Chrome considers “secure.”

Chrome 62’s Greatest Threat: Your Conversions and Patient Acquisition for All Web Browsers

It’s no secret that Google wants you to use TLS/SSL security. Along with the implications of its upcoming Chrome 62 update, even as early as 2014, Google has been clear it would give more SEO juice to secured Websites. There continues to be no hard evidence that not having a secure hospital Website will hurt your Page rank, SERP positions, etc. What is certain is that not having a TLS/SSL will very like hurt your Website conversions—and thus, your patient acquisition rates. This cuts across all Web browsers, too. There are two reasons for this.

• You Must Respect Chrome’s Popularity: Chrome’s status as the most widely used Web browser (estimated to be used by at least 55 percent of all Internet users) means anything that keeps you from using it for patient acquisition is a major disadvantage.

If your Website is not secure, you are potentially discouraging more than half of your entire Website visitor traffic to complete an online form.

• Poor User Experiences Hurts SEO: If Chrome users suddenly start abandoning your Website because they are scared off by “Not Secure” warnings, sooner or later, it will drag your SEO down—which could result in lower traffic, and thus, lower conversions, regardless of browser.

Patient Confidence: A Lesser Threat, but a Threat All the Same

If you need one more reason to improve your Website security, let it be patient confidence in your brand. Although Website and internal EMR/EHR data (and their security) are usually two entirely separate things, with growing public awareness about healthcare cybersecurity risks, your visitors and patients may presume that if your Website is not secure, then the rest of your digital medical information isn’t either.
As Guideway Care Associate Director of Search Engine Marketing, Susan Gullion is one of our most knowledgeable resources for enhancing our healthcare clients’ search engine marketing strategies with SEO, PPC and social media. Guideway Care is a cloud-based technology and services company that improves profitability and patient outcomes for hospitals and practices through end-to-end patient engagement solutions backed by clinical and non-clinical teams. Its HIPAA-compliant, SaaS platform improves care team workflows, automates patient communication and tracks patient progress to optimize the patient journey. Since 2004, leading healthcare providers have trusted Guideway Care to help acquire, manage and engage patients through complex episodes of care.

HIPAA-Compliant Texting a Convenient, Efficient Way to Improve Patient Management and Outcomes

Written on . Posted in Blog.

Last month, we published a blog, “Using Automated Phone Calls and Texts to Improve Patient Outcomes, Hospital Brand Perceptions” that examined some advantages how telephones—including mobile phones and smartphones—can enhance patient management and communications. We also demonstrated the importance of using mobile device communications to engage with patients—in particular, via text messaging—after sharing research that stated approximately two-thirds of American adults own a smartphone, with 62 percent of them having used the device to get information about a health condition. As with so many other matters that relate to patient information, privacy—especially with respect to HIPAA compliance—is of supreme importance. Therefore, to fully appreciate the advantages of using text messages to communicate with patients, it’s crucial that patient text messages are HIPAA compliant.

Ensuring HIPAA-Compliant Text Messages

Ensuring that text messages comply with HIPAA privacy laws is fairly simple: You are essentially in compliance if your messages don’t include any information that identifies the patient (including his/her conditions or treatments). For example, you may send text-message appointment reminders and confirmations, but only if you don’t include the patient’s name, birth date or any similar information. It’s important to note text messages don’t need to be entirely stripped of practical healthcare information to be HIPAA-compliant. For instance, text messages that encourage patients to remain an active participant in their healthcare fit within this concept—so long as they don’t recommend specific tests for the patient or explicitly indicate the patient has a specific condition.

Advantages of HIPAA-Compliant Text Messaging with Patients

• More Convenient for Patients

Many people who have a smartphone use it as more of a mobile office than as a mobile telephone. In some cases, they don’t even answer the phone. Instead, they prefer to use text messaging, e-mail and other messaging platforms. By communication through channels that patients may find more convenient, you might find that you’ll have more success contacting them via text than you might through phone calls.

• Increase Engagement with Patients

 Smartphone users interact with their devices an estimated 2,617 times per day—which includes the times they check for messages, social media and missed phone calls. With such a high volume of daily interactions, HIPAA-compliant texting can help healthcare providers increase engagement with patients—but without having to place time-consuming phone calls that might just go to voicemail.

• Improves Outcomes

Research is routinely finding that text messages can improve patient outcomes. For instance (and as I recently mentioned in an article published by Digital Commerce 360.com, “Automated Texting Can Improve Patient Management and Outcomes”), a study published in the Journal of Medical Internet Research noted patients who received text messages as part of a study related to Type 2 diabetes had improved outcomes.

• Optimizes Staff Resources

Using platform-as-a-service (PaaS) patient management solutions that can send automated messages may free up your staff members’ time that would have otherwise been spent making phone calls to patients. This enables them to more quickly answer inbound calls from patients, which can result in a more productive and positive experience for patients.

Gopi Yeleswarapu is Guideway Care Chief Technology Officer. Guideway Care is a recognized leader for innovative patient engagement solutions—which includes its Platform as a Service (PaaS), Sequence. To learn more about how Sequence can help you take advantage of HIPAA-compliant texting and other automated patient engagement solutions, please contact us.

Google Tips for Hospital Website Admins: January 2017

Written on . Posted in Blog.

One of our final blogs for 2016 was Top 2016 Google My Business Listing Changes for Online Healthcare Marketers, in which we listed key changes and new features that will help hospital Website administrators and online marketers prioritize their workflows and develop strategies for 2017. Due to the positive feedback from busy hospital marketers that can’t or don’t keep up with the seemingly endless updates—whether officially by Google or from a cadre of bloggers that scrutinize every perceived Google change—we thought it would be better to share a monthly digest of the most crucial tips. Along with covering My Business in our Google tips, we will be including all the Google technologies that we monitor, including new SEO algorithms, significant Chrome browser updates and more. [tweet “…our Google tips include new SEO algorithms, significant Chrome browser updates and more.”]

Chrome 56 part I: TLS/SSL “Shaming”

Another of our final 2016 blogs was Is Your Hospital Website Secure Enough for Google in 2017? In which we explained how Google would begin “shaming” Websites that weren’t using TLS/SSL security and how it might influence your SEO rankings. Late in January, Google rolled out the latest version of its Chrome browser, dubbed “Chrome 56.” As expected, the new Chrome shows a “Not Secure” label in the address bar of any Website not in compliance. The takeaway: If your hospital Website doesn’t collect passwords or credit card information, then you are OK—for the moment. However, as Google said in its blog Chrome 56 Beta: “Not Secure” warning, Web Bluetooth, and CSS position: sticky, there’s “a long-term plan to mark all HTTP sites as non-secure,” which means if you are not yet using TLS/SSL, it’s again time to think about updating your Website (for which we provided solutions in our aforementioned blog). [tweet “…if you are not yet using TLS/SSL, it’s again time to think about updating your Website.”]

Chrome 56 part II: HTML5 and Auto-Disabling Flash

The new Chrome also has another twist: Because it uses HTML5, which auto-disables Adobe Flash, as discussed in another Google blog, New in Chrome 56. This should also be of significant concern to hospital Website administrators that use Flash to create a more robust experience for patients and guests. Note it doesn’t eliminate Flash functionality. Your hospital Website users “will be prompted to run Flash on sites they’ve never visited,” which could be a minor nuisance, as well as an unfavorable impression for your brand. The takeaway: If your hospital Website uses Flash, now is the time to think about converting to other technologies and/or evaluating the importance of your Flash-driven content. [tweet “If your hospital Website uses Flash, think about converting and/or evaluating your content.”]

Get Ready for Google’s Interstitial Ad Penalties

As explained in more detail in Site Pro News.com’s Google’s Intrusive Interstitial Update Now Live, Google will soon likely penalize Websites that use interstitial ads, which the article identifies as anything that:

• Blocks a page

• Makes content unreadable

• Pops up without interaction

• Isn’t responsive (meaning it’s difficult or impossible to close on a mobile platform)

• Bothers people

• Annoys people

The takeaway: This is primarily intended to make mobile users’ experiences better. If your healthcare online marketing strategy is dependent on mobile users, then you will most certainly want to take heed. And if your strategy isn’t mobile-centric, then perhaps this is yet another indication of how important it is to have a Website experience designed to accommodate this expanding demographic. [tweet “..how important it is to have a Website that accommodates this expanding demographic.”]
As Guideway Care Associate Director of Search Engine Marketing, Susan Gullion is one of our most knowledgeable resources for enhancing our healthcare clients’ search engine marketing strategies with SEO, PPC and social media. If you already host your hospital Website with Guideway Care, we can guide you through the process of selecting the best SSL certificate. Stayed tuned for more Google Tips. For more information about hosting and other healthcare Website services, please contact us.

Is Your Hospital Website Secure Enough for Google in 2017?

Written on . Posted in Blog.

With 2017 only a few days away, there will soon be a very clear distinction between all hospital Websites: those that have TLS/SSL encryption security and those that don’t. This distinction is not just a matter of whether or not your hospital Website uses TLS/SSL because of its implied security benefits, but it may soon have influence on your SEO rankings and how confidently Google’s Chrome browser presents your Website to visitors. “But, wait, how do I know if my hospital Website—or any Website—is secure?” you might be asking yourself right now. It’s simple:

• Open your Chrome browser

• Type in your hospital Website address

• Let the page load

• Look for the icon that appears in the address bar to the left of the URL

Do you see a green lock icon in the address bar? If yes, and if the Website is yours, congrats, your hospital Website is secure! Do you not see it? Well, as you can guess, your Website is not secure. Another way to check is to look at the complete Website address (URL) after it loads. Do you see a “https://”? If so, it should be secure (but this is not a hard and fast rule, as it depends on whether or not the security certificate is valid). Otherwise, if you only see the more common “http://”, then you can be certain that it not secure. In this context, you are likely in one of two very distinct camps of hospital Website administrators and online healthcare marketers: those that understand what any of this means (and what to do about it) and those that don’t. If you are in the latter camp, you’ll want to read this. But even if you are in the former and haven’t yet made a decision or taken action, you might also want to read on!

Google Chrome to ‘Shame’ Unsecured Websites in 2017

Although Google first announced that it would start giving more SEO juice to secured Websites in 2014, it was uncertain about how much impact this new Google ranking signal would actually have. As virtually anybody that is responsible for their hospital Website SEO knows, there is never any one specific ranking signal that makes or breaks your Page rank, SERP positions, etc.. Rather, it’s a combination of factors and often some unknown algorithm change that you don’t discover until well after the fact! Although still very much up for debate, SEO analysts indicate that the TLS/SSL impacts on ranking are typical in that although it might not hurt you if you don’t integrate it into your hospital Website SEO strategy, there is evidence that it can help you if you do. However, on January 1, 2017, Google will enact a very explicit change that could make a direct impact: It will begin “shaming” Websites that don’t have TLS/SSL certificates by adding a “NOT SECURE” notice to where you’d normally just see the small icon that indicates security status. This will initially only affect Websites that collect passwords or credit card information, but will eventually affect all “http://” Websites. At any Website, visitors are more likely to turn away or not return if they feel that their online security is at risk. Obviously, that not only hurts the SEO, but also the overall ability of the Website to fulfill its goals and objectives. But for hospital Website visitors, that sentiment is likely to be even stronger, no matter if they are just casually browsing to compare you to another hospital they are evaluating or if they are intending to make an appointment or share other personal information.

Securing Your Hospital Website: What are TLS/SSL and Certificates?

Naturally, you want to do everything you can to make your hospital Website visitors feel secure in their online experiences and to relate them positively of your brand. Fortunately, making your hospital Website secure enough for Google Chrome in 2017 is not too difficult to achieve. Without getting into a lengthy examination of how the Internet bridges a visitor to a Website or what the “TLS” or “SSL” acronyms mean or how “TLS/SSL certificates” work, the simplest explanation is your hospital Website visitors’ connections are either encrypted (secure) or they are not. If they are encrypted, it means that nobody can see the data that is passing between them and your Website. “TLS/SSL” is the technology that enables a secure connection; a “TLS/SSL certificate” is what actually binds the visitor and the Website securely.

But What About Mixed SSL Content?

“Mixed SSL content” means that you have some pages with TLS/SSL security and others without. If your hospital Website has mixed SSL content, you’ll need to update it so that the entire Website is secure. Otherwise, you can expect to get the unwelcome “NOT SECURE” label.

How to Convert Your Hospital Website to TLS/SSL

If you are now convinced that converting your hospital Website to TLS/SSL encryption is a best practice that you want to adopt, doing so can be a relatively simple process:

1. Request that the company hosting your site provide you with a Certificate Signing Request (CSR).

2. Visit your domain provider (e.g., GoDaddy) and purchase an SSL for three years or more.

3. Upload the CSR when prompted.

4. Download the SSL certificate, and send it back Web hosting provider.

At some point during this process, you may be asked about what type of SSL certificate to generate. You will likely be given with three options, each with increasing benefits:

• Domain Validated (DV) Certificate: Verifies your ownership of the domain

• Organization Validated (OV) Certificate: Proves that you own the domain and that your organization is legitimate (verification process that you are a legitimate business)

• Extended Validated (EV) SSL: Offers the highest level of assurance to your customers (applicants must pass an extensive vetting process)

When choosing a certificate, be sure to find out if it covers one domain or multiple sub-domains. Once you acquire and install your TLS/SSL, you will now be able to provide a much more secure experience for your visitors and avoid any negative SEO or Chrome impacts.
As Guideway Care Associate Director of Search Engine Marketing, Susan Gullion is one of our most knowledgeable resources for enhancing our healthcare clients’ search engine marketing strategies with SEO, PPC and social media. If you already host your hospital Website with Guideway Care, we can guide you through the process of selecting the best SSL certificate. For more information about hosting and other healthcare Website services, please contact us.

From Waiting Rooms To eVisits

Written on . Posted in Blog.

Nobody likes to drive to the doctor’s office and sit for an hour or more in the waiting room to see a physician, especially if the visit is for something routine like a chronic illness check-up or a prescription renewal. Most physicians aren’t fond of these routine appointments either. They take valuable time away from patients that truly require face-to-face attention and treatment. Why then hasn’t the Internet been leveraged more as an interaction medium between doctors and patients? The technology certainly exists to connect patients with their physicians virtually via email, Web chat, or teleconference. However, these technologies have not been widely adopted in healthcare because 1) several security and patient privacy concerns exist regarding online doctor/patient interaction, and 2) physicians aren’t being paid adequately for these services. Let’s take a closer look at each of these technology adoption barriers. Online Interaction Raises Patient Privacy & Security Concerns While most Americans routinely leverage Web sites like WebMD to search for health information, online interactions with actual physicians carry much tighter security protocols. Doctor/patient interactions via the Internet or telephone must comply with HIPAA (Health Insurance Portability and Accountability Act) privacy rules. This requires a secure Web portal with high-levels of encryption to ensure a hospital or physician’s office does not accidentally expose sensitive patient data to outside parties. Building this infrastructure can require a significant technology investment from the physician community — one that many are reluctant to make due to inadequate reimbursement. Insurers Must Recognize The Value Of eVisits In a recent article in the Los Angeles Times titled “The Doctor’s Inbox,” author Lisa Zamosky states that less than 5% of doctors communicating online with their patients are being paid to do so by insurers. The fact is that most major insurers, including Medicare, don’t currently reimburse physicians for clinical consultations conducted via the Internet or teleconference. However, this is slowly beginning to change. Some larger insurers including Cigna and Aetna are beginning to compensate doctors for online and telehealth consultations. Payment for these virtual services averages about $30 per visit, as compared with $75 to $100 for in-office appointments. This trend is likely to continue as the federal government and state governments are beginning to create new payment incentives for virtual doctor/patient consultations. For example, 12 states currently have laws requiring health plans to pay for telemedicine services. Furthermore, the federal government has provided more than $6 billion in telehealth incentives as part of ARRA (The American Recovery and Reinvestment Act). Online doctor/interactions are typically recognized as part of a telehealth initiative. The Benefits Of eVisits Hopefully, as reimbursement practices for eVisits improve, so will the adoption of the enabling eVisit technologies. Doctor/patient interactions via the web and telehealth have shown great promise in overcoming a variety of healthcare challenges. For example, combining virtual consultations with in-office visits can help physicians see more patients throughout the day. This not only provides the doctor with the potential to make more money, but it also can help physicians address an influx of newly insured patients under healthcare reform. The option for patients (particularly chronically ill patients) to receive virtual consultations from their doctor can also create powerful customer loyalty advantages. Convenient eVisit services can be the differentiator that helps attract new clientele to your offices, while keeping current patients happy. If you’re interested in more information about virtual consultations for your practice, MDnetSolutions is here to help.  We can answer all your questions about virtual consultations for your website and work with you on creating a more effective marketing plan for your practice.  Learn more about virtual consultations by contacting Carol O’Dell at  carol@mdnetsolutions.com or 888.986.3638. Source