Latest Technologies, Industry Trends & Best Practices

Startel Secure Messaging: Achieving Privacy & HIPAA/HITECH Compliance

Text messaging (sending and receiving alphanumeric messages) is ubiquitous. Since 1982, mobile phones have had texting capability. Mobile phones utilize the mobile cell phone network and have access to the Public Switched Telephone Network (PSTN). Each message utilizing SMS (Short Message Service) is limited to 160 characters, and uses telephone protocols, such as GSM, CDMA, etc.

The advent of the smartphones in 1994 (basically any phone with an operating system that can manage an application) brought the opportunity for phones to access the Internet (opened for public use in the 1990’s), which was a completely different channel of communication from the mobile cell phone network controlled by an oligopoly of carriers. This is why when most smartphone users begin service they have both a voice plan (for mobile cell phone network access) and a data plan (for Internet access). Now with the convergence of smartphones and the Internet, text messages can be sent via the public Internet, and use Internet protocols, e.g., TCP/IP, thus bypassing the carrier cabal. 

Why am I bringing you down this road?
Because to understand today’s world of secure messaging it is important to know which highway text messages flow through and how those messages might be made HIPAA/HITECH compliant. Sending a text message via telephone protocols built by the carriers offers no guarantee that access of the messages will be protected from anyone with despicable intentions and means. In contrast, sending a text message via the Internet makes the use of “direct” encryption options possible. Using the Internet as the platform for sending and receiving text messages places control of whether to encrypt, or not encrypt, in the hands of the application developers and users. Using the mobile cell phone network to send and receive text messages, users are at the mercy of carriers with little incentive to encrypt messages, e.g., it adds cost and complexity to their model. In addition, carriers are designated “conduits” by HIPAA/HITECH and therefore do not share any potential liability in the case of breaches of ePHI (electronic protected health information). It should be noted that no carrier guarantees that SMS messages are encrypted during the time the message is running through their network. Since communication (including texts) most often traverse multiple carriers in the standard process of going from point A to point B, the issue of ensuring security is even less possible.

So what is the answer to protecting ePHI while texting?

What is the best way to guarantee that a text message containing ePHI is encrypted?
The solution lies in an application that utilizes both the Internet and encryption algorithm technology. 

A few years ago, while discussing the concerns of Startel customers and their clients, we anticipated the need for a solution that would help prevent breaches of protected health information (PHI), or more specifically ePHI, and other private information. Soon after that discussion Startel launched a “cloud-based, device access only” secure messaging solution that is fully integrated with Startel’s Contact Center solution, the Startel Contact Management Center (CMC). Startel Secure Messaging is an application that can be downloaded onto any smartphone utilizing the following smartphone operating systems, such as iOS®, BlackBerry® OS and Android® OS. Once downloaded, the user is required to have a registration ID, which they can purchase from one of Startel’s telephone answering service customers or contact centers. Once the registration ID is entered, the application becomes fully operable for use either between the host (TAS or Contact Center) and the smartphone user, or two smartphone users in a peer-to-peer situation.

The Startel Secure Messaging application employs password protection, registration Id’s and Secure Socket Layer (SSL) technology to ensure that secure messages get where they are suppose to go, and only to their intended recipients. At a minimum, 128-bit encryption is utilized throughout the transport layer. Only the Startel Secure Messaging application has the ability to unencrypt a message encrypted by Startel’s Secure Messaging application. If someone intercepted a Startel Secure Message during transport and they used the fastest super computer on the planet – it would take them using brute force over 1.3 quadrillion years to break the message (source: http://www.kotfu.net/2011/08/what-does-it-take-to-hack-aes). Needless to say, the security of the ePHI is assured using the Startel Secure Messaging application. 

Though the user of a smartphone would see no difference between a regular text message and a Startel Secure Message, the differences as noted above are tremendous. In today’s tech world, the power is to the people. No longer do a few carriers control whether the messages you and I send to one another can be read by a third-party. Currently, we are free to move about as we wish and encrypt at will.

A final note on HIPAA/HITECH compliance: Technology itself is not enough to be HIPAA/HITECH compliant. Technology can only assist in creating the environment where a user of ePHI can comply with HIPAA/HITECH. 

At a future date, I will provide details of an active Startel project whose result will be a cloud-based version of Startel Secure Messaging with Web Access, versus just device access only. Please stay tuned. 

HIPAA in the Contact Center: PHI and Encryption

To ensure that your organization and your clients are acting in accordance with the HIPAA Security Rule as it relates to ENCRYPTION of ePHI, I did some extensive research and found a resource written by the American Medical Association titled “HIPAA Security Rule: Frequently asked questions regarding encryption of personal health information.” The document addresses a number of questions among physicians and other health care professionals as well as other HIPAA-covered entities and business associates. Consider the below points as it relates to your usage of ePHI: 

To Begin with, What Information Should You Encrypt?

Any systems and individual files containing PHI/ePHI should be encrypted. Examples include electronic medical records, claims payment appeals, scanned images, emails containing ePHI, etc.

Emails containing ePHI. If you or your clients (physicians) correspond with health insurers or other health care professionals via email and those emails contain ePHI, then you could be accused of failing to protect ePHI for which you are responsible.

Encrypt all devices containing ePHI. Passwords are not enough, especially in the event that a hard drive was removed from a laptop containing ePHI. All devices that contain ePHI, including laptops, PCs, smartphones and tablets, need encryption technology, preferably “whole disk encryption” technology.

If ePHI is accessed via the Internet, encrypt those sessions. Since data that is published on the Internet is available to the public, you need to check with your Web service provider to ensure that any PHI that travels across the Internet is protected by secure sockets layer (SSL) or similar technology.

Encrypt any other remote access sessions. If you have a situation in which physicians/staff connect to the home office remotely to read email or access other resources containing ePHI, then this access may constitute a vulnerability to unauthorized snooping. It is important that these sessions be conducted using encrypted tunnels, or VPNS.

What Happens If a Security Breach Occurs at an Organization That Uses Encryption Technology?

If the ePHI is stored and transmitted in encrypted form, then you do not need to notify patients. This only applies to HIPAA-covered entities and business associates that use encryption technologies that render ePHI unusable, unreadable, or indecipherable to unauthorized individuals.

How do Startel’s Solutions Help Organizations Protect ePHI?

Businesses that handle sensitive information are not only morally obligated to protect sensitive, private and personal information of their clients; they are legally obligated to do so. Startel’s Encrypted Email Service enables compliance with HIPAA by utilizing Secure/Multipurpose Internet Mail Extensions (S/MIME) encryption protocol. This protocol converts email messages from a readable plaintext format to a scrambled cipher text format. Only the recipient using the private key that matches the public key used to encrypt the email message can decipher the message. If someone intercepts the message without access to the private key the email message would appear only as garbled text.

The private and public keys are the means for both encoding and decoding email messages. Essentially the unique private/public key acts as a distinctive digital signature bound to a particular email address.

In addition, the Startel Encrypted Email Service is encoded utilizing the Advanced Encryption Standard (AES) 128 Bit block size. This level of cryptography ensures security is maintained for all encrypted messages. Any attempt to “break” an encrypted message secured at 128 Bit encoding would take billions of years to try every possible combination.

Users of Startel’s Encrypted Email Service have peace of mind knowing that their messages remain secure and private during transmission and storage.

In my third blog post of this topic, I will address how Startel’s Secure Messaging application handles ePHI and specifically, how it complies with HIPAA.

Source: http://www.ama-assn.org/resources/doc/psa/hipaa-phi-encryption.pdf

Request More Information