The Messaging App Nobody Vetted
A twelve-clinic orthopedic group wants clinicians to use a free consumer-grade messaging app to send wound photos, imaging, and patient names to one another and to outside physical therapists. The vendor offers only a click-through 'HIPAA compliance' addendum and notes in its FAQ that it stores messages on a third-party cloud and that messages older than 30 days sit in an offshore data center. Meanwhile, marketing wants to text appointment reminders, a post-visit satisfaction survey, and a promotion for a cash-pay laser service; the laser promotion is jointly funded by the device manufacturer. The group also wants to sell de-identified data to that manufacturer but has no statistician on staff.
1. Is a business associate agreement required, and what must be examined before launch?
Read the worked answer
The vendor is not a conduit. The conduit exception is narrow - pure transmission, like an ISP or the postal service. This app stores messages and images for 30 days, so it creates, receives, and maintains PHI on the group's behalf. It is a business associate, and a BAA is required.
Before launch:
- Read the click-through addendum. It is acceptable only if it contains every required element: permitted and required uses, safeguards, subcontractor flow-down, breach reporting to the covered entity, return or destruction at termination, and the vendor's obligations when it knows of a use or disclosure violation. A 'HIPAA compliant' FAQ entry is marketing, not a contractual term.
- The cloud provider is a subcontractor. Either the vendor has executed BAAs with its subcontractors or the group has none of the assurances it needs. Get the flow-down in writing.
- Offshore storage is not per se prohibited, but it triggers a documented risk analysis: which jurisdiction, what government access rights, what breach-notification duties, and whether state law restricts the transfer.
- Do not launch until the BAA is executed, encryption in transit and at rest is confirmed, and a minimum-necessary rule for photo content is written - no faces in wound photos, no identifying background.
- Outside physical therapists who are separate covered entities exchanging PHI with the group for treatment do not need a BAA; that is covered-entity-to-covered-entity communication.
2. Analyze the three marketing text campaigns under the Privacy Rule.
Read the worked answer
Three messages, three analyses:
- Appointment reminders. Treatment or health care operations. No authorization required. Keep content minimal - time, place, and a request to call - not a diagnosis or service description.
- Satisfaction survey. Not marketing if it does not promote a product or service and the group receives no payment from a third party for it. If the vendor funds the survey, or the results are sold, re-analyze: remuneration plus promotion tips it into marketing.
- Laser promotion jointly funded by the manufacturer. This is marketing. It promotes a product or service, and the group is receiving payment in cash or in kind. It requires a valid authorization that specifically identifies the remuneration, and the communication must disclose that the group was paid. The authorization cannot be conditioned on obtaining the laser treatment.
Also confirm TCPA consent for texting and review any state-law restrictions on promotional health communications. A HIPAA authorization does not cure missing message consent, and a text campaign launched without it creates a separate litigation exposure.
3. The group wants to sell de-identified data to the device maker. What are the viable routes?
Read the worked answer
'De-identified' is a standard, not a label, and twelve clinics is a small enough population that the usual shortcuts fail.
Three viable routes:
- Safe harbor. Remove all 18 identifiers and have no actual knowledge that the remainder could re-identify the individual. At this scale, service dates, 3-digit ZIPs, and rare orthopedic combinations can re-identify; the group must document the no-actual-knowledge analysis rather than simply deleting name and MRN.
- Expert determination. A qualified statistician must determine that the risk of identification is very small and document the methods and results. The group has no statistician, so it must retain one - and the documentation, not the conclusion, is what survives scrutiny.
- Limited data set with a data use agreement. This permits dates and ZIP codes but no direct identifiers, and it may satisfy the manufacturer's real analytic need without full de-identification.
Whichever route is chosen, the contract must prohibit re-identification attempts and impose downstream obligations. Do not let the sales team describe the data as de-identified before one of these three routes is documented.