Texting PHI Policy Checklist for Risk Adjustment Coding Vendors

Use this Texting PHI Policy Checklist for Risk Adjustment Coding Vendors to establish clear, enforceable rules for communicating protected health information (PHI) while supporting accurate, timely risk adjustment coding. The checklist aligns daily texting workflows with HIPAA safeguards, contractual requirements, and proven security practices.

Apply these controls to all texting scenarios—provider queries, coder–auditor discussions, patient outreach, and subcontractor communications—to reduce exposure, speed resolution, and maintain audit-ready documentation.

HIPAA Requirements for Texting PHI

Policy checklist

• Document that texting PHI is permitted only on an approved, secure messaging platform; prohibit native SMS/MMS and consumer apps for PHI.
• Define permissible uses/disclosures (treatment, payment, operations) and enforce the Minimum Necessary Standard for all messages and attachments.
• Execute and maintain current Business Associate Agreements (BAAs) with the messaging vendor and any subcontractors handling PHI.
• Establish Patient Consent rules for texting (opt-in, revocation, and number verification) and record consent status where users can see it.
• Specify retention and records management for messages that become part of the designated record set; ensure messages and Audit Logs are exportable on request.
• Assign responsibility to Privacy and Security Officers for policy upkeep, monitoring, and sanctioning unauthorized texting behavior.
• Address state-specific laws that may be stricter than HIPAA and require additional disclosures or retention obligations.

Encryption Standards

Policy checklist

• Require end‑to‑end encryption for messages in transit and strong encryption for data at rest (for example, AES‑256) across servers and devices.
• Use cryptographic modules validated to FIPS 140‑2 or 140‑3 where feasible; forbid any SMS fallback or unencrypted channels for PHI.
• Mandate TLS 1.2+ for transport layers, modern cipher suites, and perfect forward secrecy; review cipher configurations at least annually.
• Implement centralized key management with rotation, revocation, and separation of duties; protect keys in HSMs or equivalent controls.
• Encrypt backups, logs, and exports; ensure attachment encryption and scanning before delivery and at rest.
• Enforce Device Security: full‑disk encryption, secure keystores, and encrypted offline caches on approved, compliant endpoints.

Secure Messaging Platforms

Selection and configuration checklist

• Only approve platforms that will sign BAAs and support Multi-Factor Authentication (MFA), single sign-on, and role-based administration.
• Enable granular roles, channel restrictions, message expiration, and content controls (e.g., disable copy/paste and file forwarding where practical).
• Activate comprehensive Audit Logs for send/receive, read status, attachments, policy changes, admin actions, and Break-Glass Procedures.
• Integrate with EHR/work queues to tie coder queries to encounters and maintain an auditable trail for risk adjustment justifications.
• Require mobile device management (MDM) for remote wipe, jailbreak/root detection, and configuration enforcement.
• Configure retention/archiving and eDiscovery exports to meet legal, contractual, and operational needs without over-retaining PHI.
• Vet the vendor’s security posture (penetration tests, vulnerability management, uptime/DR commitments) and document results in your risk register.

Access Controls

Identity, device, and session controls

• Issue unique user IDs and enforce least‑privilege, role‑based access aligned to coder, auditor, provider, and admin duties.
• Require MFA for all users, with step‑up authentication for sensitive actions (e.g., exporting logs, adding users, or changing retention).
• Use SSO with automated provisioning/deprovisioning; terminate access immediately upon role change or separation.
• Set session timeouts, re‑authentication for idle or high‑risk sessions, and device binding to trusted endpoints.
• Define Device Security baselines: strong passcodes/biometrics, OS patch levels, no jailbroken/rooted devices, and notification previews disabled.
• Establish Break-Glass Procedures for emergency access: explicit approval, time‑boxed elevation, and post‑event review with detailed Audit Logs.
• Centralize log collection and monitor for anomalous access, off‑hours activity, or unusual data movement.

Employee Training

Curriculum and accountability

• Provide onboarding and annual training tailored to texting workflows, covering the Minimum Necessary Standard and prohibited behaviors.
• Teach Patient Consent practices, number verification, identity confirmation, and safe message templates that avoid excessive identifiers.
• Run smishing/social‑engineering drills; define steps for misdirected messages, including immediate escalation and containment.
• Clarify BYOD expectations, approved apps, screen‑lock rules, and procedures for lost/stolen devices and remote wipe authorization.
• Require attestations to policy, track completion, and test comprehension; apply progressive sanctions for violations.

Breach Notification Procedures

Response workflow

• Define “incident” vs. “breach” and use a documented four‑factor risk assessment to determine if PHI was compromised.
• Contain quickly: revoke sessions, remote‑wipe devices, disable accounts, and preserve Audit Logs and evidence.
• Notify the covered entity per your BAA immediately after discovery and maintain continuous status updates through closure.
• Provide individual notifications without unreasonable delay and no later than 60 days after discovery; include required content and support channels.
• Report large breaches (≥500 residents of a state/jurisdiction) to regulators and media within required timelines; aggregate smaller events for annual reporting as applicable.
• Document investigation, decisions, corrective actions, and lessons learned; update training, controls, and vendor configurations accordingly.

Risk Assessment and Management

Continuous improvement cycle

• Conduct an enterprise risk analysis for texting at least annually and after major changes; map data flows across coders, providers, and systems.
• Evaluate threats like misdirected recipients, SIM‑swap, smishing, screenshot leakage, device theft, configuration drift, and vendor outages.
• Implement mitigations: encryption, MFA, DLP, message expiration, number verification checks, MDM enforcement, and least‑privilege roles.
• Track risks in a register with owners, due dates, and residual ratings; review in governance forums and during BAA renewals.
• Test readiness via tabletop exercises, breach simulations, restore tests for archives, and periodic access recertifications.
• Monitor metrics (incident rates, time‑to‑contain, device compliance, training completion) and adjust controls based on trends.

When you operationalize these controls together—policy, encryption, platform hardening, access management, training, incident response, and continuous risk management—you enable fast, compliant texting that protects PHI and supports accurate risk adjustment outcomes.

FAQs.

What are the HIPAA requirements for texting PHI?

HIPAA allows texting PHI if you implement appropriate safeguards: a secure platform (not native SMS), access controls with MFA, encryption in transit and at rest, Audit Logs, the Minimum Necessary Standard, BAAs with vendors, written policies and procedures, workforce training, and breach response processes. Your policy should make these controls mandatory and verifiable.

How is patient consent documented for texting PHI?

Use an opt‑in process that explains risks and purpose, verify the mobile number, and capture consent in your EHR or consent registry with timestamps and who obtained it. Provide an easy opt‑out, honor revocations promptly, and display consent status to users within the messaging workflow so they can confirm before sending PHI.

What are best practices for securing messaging platforms?

Select a platform that signs BAAs and supports end‑to‑end encryption, MFA, role‑based access, robust Audit Logs, retention/archiving, and MDM integration for Device Security and remote wipe. Disable SMS fallback, control file sharing, enable message expiration where appropriate, and validate the vendor’s security testing and incident response capabilities.

How should breaches involving texting PHI be reported?

Immediately contain the issue (revoke access, remote wipe), preserve logs, and notify your Privacy/Security Officer and the covered entity per the BAA. Perform a documented risk assessment; if it is a breach, send individual notices without unreasonable delay and no later than 60 days from discovery, complete regulatory reporting, and record corrective actions and lessons learned.