Securing Healthcare Communication: Comm100’s HIPAA Compliant Messaging

All healthcare organizations in the US need to comply with HIPAA, a law that protects patients’ personal data and safeguards their privacy. To communicate digitally with their patients, organizations must only use HIPAA compliant messaging software. Failure to do so can lead to serious monetary and reputational implications. 

In this blog, we will break down what HIPAA compliant messaging is, why it matters, and why healthcare providers around the world are using Comm100’s HIPAA compliant messaging software. Alternatively, learn more about Comm100 HIPAA compliant live chat, email & messaging platform here. 

What is HIPAA compliant messaging and why does it matter?  

HIPAA-compliant messaging is a critical aspect for all healthcare operations that communicate with their clients online. HIPAA, the Health Insurance Portability and Accountability Act, is a US federal law that sets privacy and security standards for safeguarding sensitive patient information. 

To follow these rules, HIPAA-compliant messaging software leverages a number of technical and administrative measures, including encryption, access controls, two-factor authentication, and audit logs. Collectively, this helps healthcare organizations to comply with HIPAA’s privacy and security regulations. 

If a US healthcare organization is found to not comply with HIPAA and is failing to protect the electronic protected health information (ePHI) of its patients, it can face serious consequences including: 

• Fines: The US Department of Health and Human Services’ Office for Civil Rights (OCR) can impose fines ranging from $100 to $50,000 per violation, up to an annual maximum of $1.5 million per year. 
• Legal action: If a patient’s ePHI is compromised, legal action can be taken against the organization. 
• Damage to reputation: A HIPAA violation can significantly damage an organization’s image as patients lose trust in the security of their data. 

How is Comm100 HIPAA compliant?  

As well as offering HIPAA compliant live chat, Comm100’s complete messaging is HIPAA compliant, including email, SMS, and social media. Below are the key ways that we ensure HIPAA compliant messaging to all of our healthcare customers. For more information, take a look at our Solution Sheet: HIPAA Compliant Digital Engagement for Healthcare Providers. 

“The ability to enable us to be compliant with our rigorous, security and privacy are absolutely critical to everything we do. We had to find a live chat vendor that could meet these high standards. There were many that couldn’t demonstrate this, or even speak to it — but Comm100 ticked every compliance box that we needed. Their security is next-level.”

– Denny Michaud, Customer Relations Manager, Canadian Blood Services 

Encryption of ePHI

Data encryption is a critical aspect of PHI security. In the unlikely event of a breach, it ensures that the data would not be legible or identifiable to an individual. This is achieved by encrypting data ‘at rest’ and ‘in transit’. Data ‘at rest’ is encrypted through Amazon Web Services (AWS) RDS encryption algorithm which utilizes AES 256-bit encryption. AWS servers feature state-of-the-art SSAE 16, CSAE 3416, and ISAE 3402 security standards. Data ‘in transit’ is securely encrypted through HTTPS and TLS 1.2 protocol, depending on which browser version your client is using at the time.

ePHI Access and Authorization

Comm100 operates an ePHI least-access principle – our people are only authorized to access information that they absolutely need to in the course of their work. User access is reviewed on a regular basis and any requests for increased access are reviewed and approved on a case-by-case basis. Our business systems are also secured using multi-factor authentication to further reduce the risk of unauthorized access.

Third-party annual assessment

Every year we undergo a third-party HIPAA Compliance Assessment. While some communication software vendors perform internal assessments, we contract a third party to ensure that we hold our data security to the highest standards.

Information security management

Our Information Security team is responsible for enforcing all Comm100 security and privacy policies spanning our network, software, and people. We have an extensive range of security management policies to ensure HIPAA compliance that includes:

• Ensuring the secure configuration and maintenance of system environments
• Running regular risk assessments including penetration testing
• Maintaining and regularly reviewing system logs
• Monitoring file integrity
• Management of intrusion detection and prevention systems
• Completion of risk analysis and management reports
• Management and configuration of firewalls
• Administering the security awareness program
• Reviewing and qualifying partners and third-party relationships

What Healthcare providers use Comm100 – and why? 

Comm100 has many healthcare customers around the world for our HIPAA-compliant messaging, as well as the platform’s suitability for healthcare organizations. Healthcare customers include: 

• Canadian Blood Services 
• Health Advocate 
• Peninsula Community Health Services 
• Versiti 
• Niagara Region 

Comm100’s communication platform contains every key digital channel that healthcare providers must offer to adapt to changing patient expectations. The platform offers HIPAA compliant live chat, chatbots, ticketing and messaging, and knowledge base all under one roof. 

“Our mission is to exceed the typical pharmacy experience. Live chat was a condition to start working towards that mission and be a better pharmacy than what customers are accustomed to. Our strategy is to have very personalized communication with our customers, so we set up Comm100 Live Chat to enable customers to pick and choose who they want to talk anytime they visit our site.”

– Gianni De Gaspari, Co-founder, Viata

With Comm100, healthcare providers can build stronger relationships, improve patient satisfaction, and reduce support costs. If you want to learn more about Comm100 and its HIPAA compliant messaging software, take a look here.