HIM 350 Module 6 Digital Privacy Short Paper Example

Convenient, Kind and Risky: Privacy and Professionalism in Sandstone's Digital Communication

[Student Name]

Southern New Hampshire University

HIM 350: Communication and Technologies

Module Six Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Convenient, Kind and Risky: Privacy and Professionalism in Sandstone's Digital Communication

Case managers at Sandstone Behavioral Health text clients because it works. A quick message reminds a client of an appointment, checks in after a hard week or shares a food bank's hours. But those messages travel on personal phones, outside the record and outside the agency's control. This paper examines the privacy and professionalism risks in Sandstone's digital communication and proposes safeguards that keep the benefits.

How HIPAA Applies to Texting and Email

HIPAA does not ban texting or email with patients. Its Privacy Rule permits providers to communicate with patients electronically, and patients may choose to receive unencrypted messages after being told of the risks. Its Security Rule requires reasonable safeguards for electronic protected health information that the organization creates or sends, such as encryption, access controls and audit trails, and business associate agreements with vendors who handle it. Personal phones typically lack all of these, and messages on them are not captured in the record or retained by policy.

What Research Shows About Personal Devices

Tran et al. (2014) surveyed medical students and found that most used personal smartphones in clinical work, frequently exchanging patient information by text, with inconsistent security practices and uncertainty about the rules. The pattern extends well beyond students. Sandstone's staff survey found the same habit: close to two-thirds of case managers message clients on their own phones, sometimes mentioning symptoms or medications. When a case manager leaves the agency, those conversations leave too.

Email With Clients

Some clinicians email clients from agency accounts, which are covered by the agency's security controls but do not encrypt messages to outside addresses by default. Clients may use shared family email accounts. Sandstone's policy should require that clinical communication happen through the portal's secure messaging, that email be used only for logistics unless a client has chosen unencrypted email after an explanation of the risks, and that any clinically relevant email be saved to the chart.

Substance Use Disorder Records

Sandstone's outpatient substance use disorder program is subject to federal confidentiality regulations at 42 CFR Part 2, which protect records that could identify someone as receiving substance use treatment more strictly than HIPAA does. A 2024 federal rule aligned Part 2 more closely with HIPAA, allowing a single patient consent to cover future uses for treatment, payment and operations, while keeping special protections such as limits on use in legal proceedings. A text confirming a group session time could itself disclose program participation.

Part 2 and Coordination

The rules protect clients but have complicated care. McCarty et al. (2017) interviewed stakeholders and found that Part 2 was widely seen as a barrier to coordinating and integrating care, with some organizations keeping substance use information out of shared records altogether. For Sandstone, the lesson is to use the updated consent options carefully, train staff on what may be shared and with whom and make sure digital messages about program participation are sent only through secure, consent-appropriate channels.

Social Media and Professional Boundaries

Social media creates different risks. Chretien et al. (2009) surveyed medical school deans and found that most responding schools had seen students post unprofessional content online, including some cases that violated patient confidentiality. Greysen et al. (2010) argued that social media reflects professional identity and called for clear guidance. Sandstone's page has drawn client comments disclosing diagnoses, and two staff replies confirmed that commenters were clients. Staff also receive friend requests from clients on personal accounts.

A Social Media Policy

The agency needs a written policy. Staff should not confirm or deny that anyone is a client in public comments, should move any client contact to private, secure channels and should not accept friend or follow requests from current clients on personal accounts. The communications manager should monitor the page daily, hide comments that disclose health information and post a notice that the page is not for personal health questions, with the crisis line number.

Keeping What Clients Value

Banning texting outright would harm clients who rely on it. The better answer is a secure texting platform integrated with the record, available on agency-managed phones or an app on personal phones that keeps messages in an encrypted container. Clients enroll and choose their preferences, messages save automatically to the chart and the agency can retain and audit them. Case managers keep their check-ins; the agency gains control and documentation.

Table 1. Communication Channels, Risks and Safeguards

Note. Prepared by the author for the agency's privacy committee.

When a Device Is Lost

Personal phones are lost, stolen, shared with family and traded in. Last year one Sandstone case manager's unlocked phone was left on a bus with dozens of client conversations on it. Because the phone was personal, the agency could not wipe it remotely and had to treat the loss as a possible breach, notifying the clients whose messages might have been seen. Agency-managed devices or an encrypted app container would have allowed a remote wipe and, with encryption, might have avoided notification entirely.

Training and Accountability

Policies change behavior only with training and follow-through. All staff will complete a short module on digital communication with scenarios drawn from Sandstone's own audit, such as a client asking to text about a relapse. The privacy officer will review a sample of secure messages quarterly and report trends to the privacy committee. Violations will be handled through education first, with discipline reserved for repeated or serious cases.

Conclusion

Sandstone's staff use texting, email and social media to stay connected with clients, and clients value that connection. Research and regulation show the risks: unprotected messages, stricter rules for substance use records and blurred professional boundaries online. Secure platforms, clear policies and training can protect clients without taking away the contact they trust.

References

Chretien, K. C., Greysen, S. R., Chretien, J.-P., & Kind, T. (2009). Online posting of unprofessional content by medical students. JAMA, 302(12), 1309-1315. https://doi.org/10.1001/jama.2009.1387

Greysen, S. R., Kind, T., & Chretien, K. C. (2010). Online professionalism and the mirror of social media. Journal of General Internal Medicine, 25(11), 1227-1229. https://doi.org/10.1007/s11606-010-1447-1

McCarty, D., Rieckmann, T., Baker, R. L., & McConnell, K. J. (2017). The perceived impact of 42 CFR Part 2 on coordination and integration of care: A qualitative analysis. Psychiatric Services, 68(3), 245-249. https://doi.org/10.1176/appi.ps.201600138

Tran, K., Morra, D., Lo, V., Quan, S. D., Abrams, H., & Wu, R. C. (2014). Medical students and personal smartphones in the clinical environment: The impact on confidentiality of personal health information and professionalism. Journal of Medical Internet Research, 16(5), Article e132. https://doi.org/10.2196/jmir.3138