Health care providers in hospitals and critical access hospitals (CAHs) can now text patient orders to other members of a patient’s care team or into a patient’s electronic health record (EHR), provided certain conditions are met. CMS released a memorandum updating its 2018 guidance on texting patient orders earlier this year.
CMS delivered these updates in light of significant improvements in texting platforms’ encryption and application interface capabilities. Allergists, particularly those practicing in a hospital setting, should familiarize themselves with this guidance to ensure they maintain compliance. Allergists who practice in freestanding clinics are not subject to this guidance.
Background
In 2018, CMS released guidance permitting the texting of patient information among members of a hospital or CAH health care team as long as it was done through a secure platform. The guidance did not, however, allow providers to text patient orders, regardless of the platform used. CMS stated that texting patient orders would violate the Medicare Conditions of Participation (CoPs) and cited concerns related to record retention, privacy, confidentiality, security, and the integrity of existing systems. Accordingly, CMS required providers to either hand write orders into the medical record or enter them through the Computerized Provider Order Entry (CPOE) and then immediately place them into the medical record.
Updated Guidance
In the 2024 updated guidance, CMS notes that since 2018 there have been significant improvements in the encryption and application programming interface (API) capabilities of texting platforms to transfer data into EHRs. While CMS reiterates that CPOE remains its preferred method of order entry, it permits a provider to text patient orders into the record and to text patient orders to other members of the patient’s hospital health care team. Such texting must occur through a secure texting platform (STP) compliant with HIPAA. It also must comply with (1) the HIPAA Security Rule, (2) the Health Information Technology for Economic and Clinical Health (HITECH) Act, and (3) the CoPs.
Both the hospital and CAH medical record CoPs require inpatient and outpatient medical records to be accurately written, promptly completed, properly filed and retained, and accessible. In addition, the hospital must use a system of author identification and record maintenance that ensures the integrity of the authentication and protects the security of all record entries.
Applicability to independent practitioners
This CMS guidance only applies to health care practitioners in hospitals and CAHs. Allergists who practice in freestanding clinics are not subject to this guidance. However, if independent practitioners text patient information or orders, they should also only use HIPAA-compliant STPs that comply with the HIPAA Security Rule and HITECH Act. “Traditional” text messaging platforms (e.g., standard SMS messages) do not comply with the HIPAA Security Rule, potentially exposing providers to significant legal risks if a breach of a patient’s information occurs.
The Advocacy Council – ADVOCATING FOR ALLERGISTS AND THEIR PATIENTS.
