Text Messaging: Guidelines for Behavioral Health ProvidersPart 2

Roy Huggins, LPC, NCCPerson Centered Tech

Webinar Basics• All are muted. Chat your questions to “ALL PANELISTS” throughout the webinar

• Links to resources will be posted in the chat box• Please complete the survey following the webinar• Slides, recording, and resources will be posted on the CTAC website www.ctacny.org

Chat

Text Messaging: Guidelines for Behavioral Health Providers

Roy Huggins, LPC NCC

Our Educational Objectives● Describe the relevant ethical and legal standards that pertain to text

messaging in behavioral health care.

● Identify boundary considerations when utilizing text messaging in behavioralhealth care.

● Detail the standard(s) for the maintenance, storage, and retrieval of textmessages.

● Gain an understanding of how to communicate with individuals and theirfamilies about the use of texting.

Unit 1:Texting in Behavioral

Health

Clinical Texting: A Confluence of Disciplines● Legal-Ethical: liability risk management and regulatory (e.g. HIPAA)

compliance○ Attorneys. The privacy officer and risk management officer/consultant are generally attorneys.

● Technical: choosing the right services and devices that provide whatclinicians and clients need while keeping it secure.○ Information Systems/Information Technology Pros. The security officer is generally an IS/IT

professional.

● Clinical: using these modern communications to meet clients wherethey are while also maintaining health therapeutic boundaries.○ Clinicians. Obviously.

How is Texting Used in Behavioral Health?

1. Appointment reminders and other admin communications

○ Contains minimal clinical information

○ Can improve attendance and reduce admin stress

○ Some agencies limit texting to only these types of messages

2. Open-ended texting

○ Contains a lot of clinical information

○ Would generally be regarded as a telehealth activity

○ Can improve sense of clinician-client connection, and facilitateopenness in some reticent clients.

What We Want to Achieve With Email and Texting● Communicate with clients in a medium where they are comfortable

and open.

● Use methods of contact that clients and their families actually respondto and use themselves.

● Reach clients who would normally ignore the existence of services.

Meet clients where they are

Unit 2:Texting Services

Confidentiality w/ Texts: “Transmissions”Counselors take precautions to ensure the confidentiality ofall information transmitted through the use of any medium.

ACA Code of Ethics, 2014, B.3.e

Psychologists have a primary obligation and take reasonableprecautions to protect confidential information obtainedthrough or stored in any medium, recognizing that the extentand limits of confidentiality may be regulated by law orestablished by institutional rules or professional or scientificrelationship.

Ethical Principles of Psychologists and Code of Conduct,2010, 4.01

Social workers should take reasonable steps to protect theconfidentiality of electronic communications, includinginformation provided to clients or third parties. Socialworkers should use applicable safeguards (such asencryption, firewalls, and passwords) when using electroniccommunications such as e-mail, online posts, online chatsessions, mobile communication, and text messages.

NASW Code of Ethics, 2017, 1.07.m

34. NCCs shall protect the confidentiality and security of testsor assessments, reports, data and any transmission ofinformation in any form.

National Board for Certified Counselors Code of Ethics,2016

“Transmission Security”

Standard: Transmission security. Implement technical security measures to guardagainst unauthorized access to electronic protected health information that is beingtransmitted over an electronic communications network.

45 CFR § 164.312 (e)(1)

“electronic communications network” = The Internet

What is “Texting?”● SMS: Actual “texting”

○ What old cell phones and Androidphones do. Nonsecure for policy-making purposes.

● Proprietary apps: Other ways todo texting, or “mobile textualcommunication,” to put it moreprecisely.

○ iMessage, OhMD, TigerConnect,WhatsApp, Signal, etc. Each servicemust be evaluated to see if it is secureor not. Most are not secure for ourpurposes.

SMS on an iPhone

iMessage

Client Desire for Nonsecure Emails and Texts?● Yes, HIPAA allows it.*

● Need to inform the client of therisks.

● Often referred to as “alternativecommunication.”

● Does not change your requirementto follow HIPAA standards,including the Business Associaterule

Is the client’s decision informed andautonomous if there is noreasonable secure alternativeavailable?

HIPAA is happy. But what if theclient lives with an abuser? Or theiremployer or school can monitortheir emails or texts? What is ourethical responsibility there?

*Attorneys, see guidance here: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html

When to Use SMS / Nonsecure Texting?

● The client doesn’t have a smartphone or can’t install apps on theirs.

● The client wants appointment reminders by SMS from your HIPAA-securescheduling service or practice management system.

● There’s a client emergency and, for some reason, SMS is absolutely the onlyway you’re able to reach them.

● Agency policy allows for it.

Service Choices and Client SES● Every secure option requires a computer

○ Remember: smartphones are computers!

● Low-SES people rarely have smartphones, or they may have them but don’t havevery much room on their data plan. (But they may have unlimited SMS.)

● They usually access desktop/laptop computers through public services such aslibraries.

○ Nonsecure texting is sometimes the most private and compassionate way tocommunicate with low-SES people

General Rule: Texting solutions intended to reach low-SES peopleusing will almost certainly need to be based on nonsecure services!

(i.e. SMS)

Informed Consent and Texts● Inform clients that texts are part of their record

○ The client’s text messages will not disappear into the ether

● Third parties may be able to view messages being exchanged, or simplyknow who is exchanging messages with whom.

● Inform clients of your turnaround time for responses (more below)

● Talk to clients about people around them reading texts

● When using SMS, inform clients of risks

○ SMS messages can be intercepted while travelling over the Internet orthe phone system, as they are generally not encrypted

Unit 3:Boundaries and Professionalism

Some Major Clinical-Ethical Considerations

● How does mobile, textual communication affect boundaries?○ Where is this healthy/unhealthy? Therapy affirming/interfering?

● How do you address multicultural concerns in email and texting?

● When and how quickly should you respond to clients?

● When and how should you use personal devices to text with clients?

What Are Reasonable Boundaries?

● What does it mean for theclinician-client contact locale toextend beyond the office (physicalor online) walls?

● What are the client’ssubculture/age-bound expectationsabout boundaries around textingand email?

● How quickly do clients expect aresponse to messages?

Client expectations regarding reasonableboundaries in texting may very well

differ from the therapist’s expectations

Poll: Have you ever had a client get upset at your slow response to messages? Choose all that apply.

● Yes, but it was fine.● Yes, and it was rough to work out.● No, but I’m a compulsive answerer.● No, it has never come up.

Suggestion for Boundary Setting

● Office Policies! E.g. Social Media Policies. Some things you might put in there:

○ It will be up to 24 hours

○ It will be more than 24 hours

○ Weekends and holidays don’t count towards the time

○ I don’t text people back

● Talk to the clients about these policies. Keep the conversation going as muchas needed.

Personal Phones and Clinician Boundaries● The agency should provide apps which are separate from personal phone

services!!!

○ E.g. your personal text messages should not be accessed via tapping the same iconas your agency text messages.

○ Internet phone services make this possible through the use of “softphone apps.”

● Your phone is with you all the time, so set boundaries.

○ If the agency texting service can pause notifications after certain hours, and yourclient population can be left waiting safely, pause those notifications when you’redone with work!

Unit 4: Documenting Texts

Ethics Codes/Guidelines on Documenting textsRegardless of the medium, counselors include sufficient andtimely documentation to facilitate the delivery and continuityof services. Counselors take reasonable steps to ensure thatdocumentation accurately reflects client progress andservices provided.

ACA Code of Ethics, 2014, A.1.b (Emphasis mine)

When keeping records of email, online messaging and otherwork using telecommunication technologies, psychologistsare cognizant that preserving the actual communication maybe preferable to summarization in some cases depending onthe type of technology used.

APA Guidelines for the Practice of Telepsychology, Securityand Transmission of Data and Information, Application,2013

Social workers who gather, manage, and store informationelectronically should take reasonable steps to ensure theprivacy and confidentiality of information pertaining toclients or research participants. Federal and state statutesand regulations may dictate how electronic records are to bestored and social workers are responsible for being aware ofand adhering to them. Organizations in various practicesettings may have additional policies regarding the storageof electronic communications.

Standards for Technology in Social Work Practice, 2017

NCCs shall include all electronic communications exchangedwith clients and supervisees, including those through digitaltechnology and social media methods, as a part of therecord, even when strictly related to clerical issues such aschange of contact information or scheduling appointments.

National Board for Certified Counselors Code of Ethics,2016

HIPAA and Documenting texts...covered entities must:

1. Ensure the confidentiality, integrity, and availability of all e-PHI they create,receive, maintain or transmit;

2. Identify and protect against reasonably anticipated threats to the security orintegrity of the information;

45 C.F.R. § 164.306(a).

Texts are Records

● HIPAA requires we protect theavailability of PHI

● Professional associations andboards seem inclined to want fullretention of text messages

● Courts may subpoena originalemails and text messages

● Clients need to be informed thattexts are in their record

Some Retention Strategies:

● Use texting services which retainmessages in a way that is easilyaccessed by agency admins for auditsand releases

● Copy text messages and paste theminto the EHR using the EHR’s app onyour phone

● Use a wireless printer to print from thephone

● Do not send the message to yourself inan ordinary email, even if it’s ascreenshot!

Unit 5: Creating texting

Solutions

What We Need So We Can Achieve Our Goals

Solutions which meetlegal, ethical, andclinical standards

“Solutions” are:● Service choices +● Device choices +● Policies

Standards That Texting Solutions Must Meet:Privacy/Security Standards ● Encryption and authentication when

sending, OR● Client’s desire for the communication

despite the lack of technical security

Service Provider RelationshipStandards

● Business Associate Agreements(HIPAA) / State or County-DefinedVendor Contracts (Not HIPAA)

Record Maintenance and AccessStandards

● Messages and call logs are reliablymaintained, with backups, whereagency administrators can access them

Additional Standards That Texting Solutions Should Consider:Client Safety Standards ● Message exposure to dangerous

individuals in life/household● Employer/school viewing messages or

message “metadata”

Clinical Boundary Standards ● When do we talk/text?● What do we talk about?● How do we talk about it?● What documents do we exchange?● What’s the clinician’s turnaround time

for responses?

Telehealth Standards ● Highly dependent on state requirements● Sometimes vaguely defined

Any Texting Solution Will Consist Of:Telecommunications Service Provider(s) ● Phone company, VoIP service, Email service

● Agency-provided services vs. clinicians’ personal services

Clinician Devices ● Smartphone, flip phone, tablet, computer● Agency-provided devices vs. clinicians’ personal

devices● Is it “hardened”*? Does the agency have

security policies for handling these devices?

Client Communications Policies (for Clients +Clinicians/Agency)

● Policies that clients (and/or guardians) agree towith regards to email or texting with the agencyand clinicians.

Agency Security & Privacy Policies(Clinicians/Agency Only)

● Internal policies for managing security andprivacy of client information; security ofdocuments, devices, and user accounts.

* IT people, some info on hardening devices: https://personcenteredtech.com/2019/04/16/computer-smartphone-hipaa-security-checklist-therapists/

Some Service Provider Options

Proprietary Messaging Apps

● OhMD

● TigerConnect

● Spruce Health

● Your EHR’s patient portal app

● Your teletherapy platform’s mobileapp

VoIP Services (for SMS texting)

● RingRX

● iPlum

● A local phone company which is willingto execute a HIPAA-compliant BAA (orappropriate vendor contract) whichcovers their SMS services

Let’s Examine Some Forms and Worksheets

● Texting Solution Worksheet

● Sample Communications Policy

● Request for Nonsecure Communications Form

Q&A

Some Final Risk Management Points

● Be wary/aware of crossing into telemental health territory

● Make sure that all use of texting is done with intention, and is not reactive orunplanned

● Be sure clients are aware of how you will use texting -- especially SMS!

References● American Counseling Association. (2014). Code of Ethics . Alexandria, VA: Author.

● American Psychological Association. (2010). American Psychological Association Ethical Principles ofPsychologists and Code of Conduct . Washington, DC: Author.

● American Psychological Association. (2013). Guidelines for the Practice of Telepsychology. Author.

● Chiad, M. O. (2008). Structural and Linguistic Analysis of SMS Text Messages. Journal of Kerbala University ,6 (4).

● National Association of Social Workers. (2017). Code of Ethics . Washington, DC: Author.

● National Board for Certified Counselors. (2016). Code of Ethics . Greensboro, NC: Author.

● US Dept. of Health and Human Services. (2006). HIPAA Administrative Simplification . Washington, DC:Author.

● US Dept. of Health and Human Services. (2013). HIPAA Omnibus Final Rule . Washington, DC: Author.

Upcoming CTAC Events‣ Eating Disorders: Evidence Based Practices and Tools for Effective

TreatmentWednesday, September 30 - 1:00 PM

‣ Employee EngagementThursday, October 1 - 11:00 AM

‣ Befriending Stress: A Neurological PerspectiveThursday, October 15 - 12:00 PM

Visit registration.nytac.org to register

Thank you!If you have questions about CTAC, please contact

ctac.info@nyu.edu.

Visit www.ctacny.org to view past trainings, sign up for updates and event announcements, and access resources.

Please take a moment to fill out the feedback surveyas you exit the webinar.