The answer to the question are phone calls HIPAA compliant can be dependent on who is making the call, what the call concerns and who the call is to.
Before discussing are phone calls HIPAA compliant, it is important to establish who HIPAA applies to. This is because almost two-thirds of complaints about HIPAA violations are rejected because they allege a violation has been committed by a business that is not subject to the HIPAA Rules. In such cases, HHS´ Office for Civil Rights has no jurisdiction to investigate complaints and so rejects them.
HIPAA applies to most health plans, health care clearinghouses, and healthcare providers (“Covered Entities”), and to Business Associates and subcontractors providing a service for on behalf of a Covered Entity. Healthcare-related calls from these sources to individuals are permissible provided the recipient has given their implied consent to receive a call and the call follows FTC guidelines.
Additionally, to make phone calls HIPAA compliant, Covered Entities and Business Associates are required to comply with the General Rules for Uses and Disclosures of PHI (§164.502 to §164.512), and the Minimum Necessary Standard when making phone calls to someone other than the individual which relate to the individual´s condition, treatment, or payment for treatment.
Implied Consent and FTC Guidelines
Phone calls to individuals from Covered Entities and Business Associates are permissible if the recipient of the phone call has given their implied consent by providing a contact telephone number to the Covered Entity or Business Associate. However, under HIPAA, individuals also have the right to revoke consent or request that communications are either made by voice or by text.
Healthcare-related – but not payment-related – phone calls and text messages from Covered Entities to individuals are FTC compliant if they are made for an allowable reason. Allowable reasons are limited to:
- Appointments and reminders
- Hospital pre-registration instructions
- Health checkups
- The provision of medical treatment
- Lab test results
- Notifications about prescriptions
- Pre-operative instructions
- Post-discharge follow-up calls
- Home healthcare instructions
According to the FTC guidelines, calls to individuals should start with the Covered Entity stating their name and the reason for the call. Calls can last no longer than 60 seconds (text messages must be no longer than 160 characters), and Covered Entities cannot contact individuals more than three times per week. Any additional contact – by voice or by text – requires the individual´s authorization.
Making Other Phone Calls HIPAA Compliant
Other phone calls made by a Covered Entity or Business Associate (i.e., not to an individual for an allowable reason) are only subject to the General Rules for Uses and Disclosures and the Minimum Necessary Standard if the communication involves the disclosure of an individual´s PHI. Any phone calls that do not involve the disclosure of PHI are not subject to the Privacy Rule standards.
Nonetheless, there are many types of HIPAA-related phone calls that are subject to Privacy Rule standards. For example, a phone call made from one Covered Entity to another for treatment, payment, or healthcare operations purposes, a phone call made to local authorities to report a public health issue, or a phone call made to the police to report patient abuse or neglect.
Covered Entities can communicate PHI to a Business Associate in a phone call, but before doing so, a Business Associate Agreement must be in place to stipulate the allowable uses and disclosures of PHI. In states where more stringent privacy protections exist, it may also be necessary for a Covered Entity to enter into a contract with another Covered Entity before disclosing PHI for any reason.
Is PHI Disclosed in a Phone Call Subject to the Security Rule?
One final point about making phone calls HIPAA compliant concerns whether PHI disclosed during a phone call is subject to the Security Rule. According to the definition of electronic media in §160.103 of the HIPAA General Provisions, PHI disclosed during a phone call is not considered to be subject to the Security Rule “if the information being exchanged did not exist in electronic form immediately before the transmission”.
However, if the PHI is subsequently recorded on electronic media, the stored PHI (now ePHI) becomes subject to Security Rule standards. Therefore, if PHI is disclosed during a permissible provider-to-provider phone call, and the information is entered into an EHR or other electronic database, the information has to be protected in the same way as any other PHI relating to the individual that is stored electronically.
Are Phone Calls HIPAA Compliant? FAQs
Can nurses give patient information over the phone?
As members of a Covered Entity´s workforce, nurses can give patient information over the phone for permissible uses and disclosures. However, before nurses give patient information over the phone, it is important they verify the identity of the person they are speaking with in order to prevent unauthorized disclosures or disclosing more than the minimum necessary patient information.
Is sharing patient information with family over the phone HIPAA compliant?
With regards to sharing patient information with family over the phone, patients should be given the opportunity to object to their information being shared with family members. Provided the patient has not objected, sharing patient information with family over the phone is HIPAA compliant. However, it is still necessary to comply with the Minimum Necessary Standard.
If a patient is incapacitated and unable to object to their information being shared, healthcare providers can share patient information over the phone with family members provided that the disclosure of PHI is considered to be in the patient´s best interests. Once the patient is no longer incapacitated, he or she must be given the opportunity to object as soon as possible.
Are cell phone calls HIPAA compliant?
As discussed above in “Implied Consent and FTC Guidelines”, calls to cell phones are HIPAA compliant if a patient has given their cell phone number to the Covered Entity as a point of contact. If a patient has given both a cell phone number and a landline number, Covered Entities can use either number to contact the patient up to the FTC- mandated limit of three calls/texts per week.
What information can hospitals give over the phone?
If they are responding to an enquiry about the well-being of a patient, hospitals can provide “directory information” such as the general condition of the patient and their location within the hospital provided the patient is asked for by name, the identity of the caller is verified, and the patient has not objected to the information being disclosed.
Is a landline HIPAA compliant?
Calling a patient´s landline for an allowable reason is HIPAA compliant provided the landline number has been provided to the Covered Entity by the patient or patient’s representative. However, Covered Entities must take care to verify that the person they are speaking with is the patient, as landlines can be shared among multiple occupiers or – in a business – multiple employees.
Is giving out a phone number a HIPAA violation?
Giving out a phone number can be a HIPAA violation, but only in certain circumstances. Generally, a phone number is an “identifier” that, when included in a patient´s “designated record set”, becomes Protected Health Information. Any protected identifier in a designated record set can be disclosed if the disclosure is permitted by the General Rules for Uses and Disclosures of PHI.
If a patient has objected to their phone number being given out, if the phone number is given out without authorization for a disclosure requiring an authorization, or if the phone number is given out in the course of an impermissible disclosure, these are examples of HIPAA violations – if the phone number is included in the patient´s designated record set. If it is not part of the patient´s designated record set, the phone number is not protected, and therefore no HIPAA violation has occurred.