Secure Client Communication Guidelines for Health Care Providers

1. BCCDC Staff Guidelines:Email and Text Communication with Clients

2. Agenda • Background • Guidelines • Pilot • Conclusion • Recommendations • Next steps

3. Background - Why • Some clients have indicated a preference for text and email(client centred). • Potentially more cost effective (vs sending letters). • Health care providers are asking about if/how they can email/text clients more and more. • In the BCCDC STI clinic context, it can be more private than a phone call or letter.

4. Background - Status • Currently, PHSA does not have an overarching guidance document regulating the appropriate use of email or texting for direct client communication. • Initial work started with PHSA Risk Management in 2013. • A key obstacle to the progress was Information Management and Information Technology Services (‘IMITS’) policy 140 • Users must not knowingly open or transmit personal identifiable information or PHSA confidential information over external electronic messaging unless the information has been encrypted and authenticated using PHSA standard encryption software.

5. Background – BCCDC work • BCCDC participated in and continued work on the guidelines as BCCDC clinical staff were already using email and text to directly engage with clients. • Goals: • to provide direction to staff/managers to help manage risk while providing client centred care. • Share with other PHSA agencies and interested parties.

6. Guidelines • Created “BCCDC Staff Guidelines: Email and Text Communication with Clients”. • Reviewed initially by: PHSA Information Access and Privacy Office; PHSA Risk Management, PHSA Professional Practice Leader – Nursing; BC Health Care Protection Program; BCCDC Ethicist; and the BCCDC Privacy and Access Committee. • Principle based - intended to frame program specific guidelines.

7. Guidelines

8. Guidelines - Permitted Uses 1. Responding to general inquires for information about BCCDC or its services 2. Health Education or Promotion Purposes • Health promotion messages • Routine screening information • Invitations to health promotion events 3. Administrative Purposes • Scheduling appointments • Testing Reminders • Requests to contact a program or department • Communication with a client that requires the transmission of Personal Information to that client.

9. Guidelines - Principles PRINCIPLE 1: Respect client privacy and confidentiality Staff must take reasonable steps to protect the privacy and health information of a client at all times. PRINCIPLE 2: Use only approved communication tools Staff may only use PHSA approved mobile devices and email accounts to communicate electronically with clients. PRINCIPLE 3: Document client consent when necessary A client must provide their consent in written form prior to receiving Personal Information via email or text message. Staff must document consent. PRINCIPLE 4: Verify client identity when necessary A client’s identity must be confirmed prior to releasing Personal Information to that client. PRINCIPLE 5: Adhere to program specific procedures Programs must develop, and staff must adhere to, operational processes based on this guideline that are specific to their service area. PRINCIPLE 6: Be aware of your professional responsibilities Staff must be aware of their relevant professional and ethical obligations regarding electronic communications with clients. PRINCIPLE 7: Report information incidents Staff must immediately report to their Supervisor or Manager any event whereby a communication has been misdirected, or if an account or device has been compromised, misplaced, lost or stolen.

10. Guidelines - Program Specific Procedures Programs are expected to develop operational processes that are specific to their service area. These processes must, at minimum, specify: • Dedicated email inboxes and/or mobile phones approved for direct client communication • Defined circumstances where Personal Information may be shared unencrypted with a client. • Processes for obtaining and recording client consent • Process for verifying a client’s identity • Approved communication scripts and confidentiality disclaimers • Process for auditing Staff access to dedicated email inboxes and mobile phones

11. Pilot • IMITS policy exemption granted allowing a pilot to proceed. • Pilot Participants • STI clinic nurses • Pilot Duration • Email: October 5, 2015 to December 29, 2015 • Text: December 7, 2015 to January 4, 2015

12. Pilot – Email (sending negative results) Target population: • All nominal clients screened were offered a choice to receive results in person, by telephone or through email. • Non-nominal clients were not included as they were unable to provide signed consent. • Tests that could be received by email included: chlamydia, gonorrhea, syphilis (not previously positive), HIV, and hepatitis C. • Negative STI and HIV results were available though email. • Positive STI and HIV results were available in person, though talking to a nurse on the phone, or with permission from the supervisor/manager by email. Consent Procedure: • Consent form was required to be signed by the client. • Record of signed consent was documented in the client’s chart. • The client’s email address was recorded. • The client understood they must email BCCDC first for results. Results by email Procedure: • The shared “Leslie” email folder was monitored daily. • Nurses responded to client’s emails as per guidelines/templates (used copy and paste). • A fluid survey link for evaluation was sent with test results. • Record of emailed results was documented in the client’s chart.

13. Pilot – Text (to call BCCDC) Target population: • All nominal and non-nominal clients screened were offered a choice to have clinician contact by way of: in person, by telephone, or through text messages. • No personal information was to be shared. Texting was only used to ask clients to call BCCDC*. • Negative and positive STI and HIV results were available in person, though talking to a nurse on the phone, or with text consent and permission from the supervisor/manager by text. Consent Procedure: • If client provide a phone number they were offered to opt out of receiving text messages. • The Client Acknowledgement Statement (CAS)** was provided for the client to review and if client declined receiving texts it was documented in the client record. Text procedure: • Before sending a text, the nurses checked that the client had not declined text communication. • Clients were only contacted though text messaging when it was the client’s only preferred method of contact or at least one other means of contact had been previously attempted. * Text more challenging to communicate larger amounts of information, so kept to request to call only ** Similar to consent but not required to sign

14. Pilot - outcomes • 64% of clients accepted to receive (negative) test results by email (240 of 376 offered) • 70% of clients who accepted to receive (negative) test results by email contacted BCCDC to receive the results (of 240 accepted) • 89% of clients accepted to receive communication by text. (560 of 625).

15. Pilot - outcomes • Qualitative • Client survey: • overall experience with receiving communication from us by email or text: 75% of those that responded to this survey question reported a positive experience. N = 8 (of 168 - 5%). • Staff (before pilot): • overall interest in helping clients receive results by email or text: 81% of those that responded to this question reported that they were interested in helping clients receive results by text/email. N= 16 (of 22 - 73%) • Do you think this will improve our ability to meet our clients' needs: 93% of those that responded to this question reported that they thought this would improve the clinics ability to meet client needs. N = 16 • Staff (after pilot): • overall interest in helping clients receive results by email or text: 85% of those that responded to this question reported that they were interested in helping clients receive results by text/email. N= 7 (of 22 - 32%)

16. Pilot - outcomes • The pilot helped demonstrate the following: • Clients have an interest in receiving results by email/text; • Clients had a positive experience receiving results by email/text; • Staff have an interest in text/email communication with clients; • Staff believe that email and text communication will help meet the clients’ needs; and, • No adverse events were identified during the pilot.

17. Pilot – some challenges • Some consent forms were completed but missing the client’s signature. • Each staff member needs to set up access to the shared email box on every computer in the clinic (no webmail allowed). • Some clients emailed staff using a different email than the one they provided on the consent form. • A few clients stated that they have not received the emailed results from BCCDC. • Clients stated the desire to use emailed results as proof that he/she had negative results.

18. Conclusion • The BCCDC Guidelines have been updated using information from the pilot. • One consent form (vs. client acknowledgment form and consent) • Refined to principles and the need for program specific guidelines. • The Guidelines provide staff and leadership direction on how to more safely communicate with clients by email/text.

19. Recommendations • Update the IMITS policy (140) to allow email and texting clients in accordance with the principles of the BCCDC Staff Guidelines. • Consider allowing the use of webmail. • Consider documenting consent electronically (EMR consent functionality) instead of client signature on paper form.

20. Next steps • Request continued use of BCCDC guidelines in the STI clinic (extension of exemption); • Consider expansion to other BCCDC areas, if needed; • Request IMITS to update policy 140/ webmail use; • Share with others that have expressed interest. • PHSA Risk Management and Privacy office • CST documentation lead • Fraser Health Authority • Northern Health Authority