Hospital compliance officers have been whipsawed recently over whether the HHS Centers for Medicare & Medicaid Services (CMS) forbids the texting of protected health information (PHI), even when it is secure.

But a new memorandum “clarifying” the issue now states when texting is allowed, giving some assurance to hospitals and other HIPAA covered entities (CE) whose providers rely on this speedy and ubiquitous communication method.

On Dec. 18, Report on Medicare Compliance, a sister publication to RPP, broke the news that officials within a division of CMS had sent emails to at least two hospitals saying that “texting is not permitted”—an edict they said was applicable even when secure text messaging programs are used.

The “hospital team” from CMS’s Survey & Certification Group cited concerns about privacy, security and the integrity of medical records as the reason for the ban, which effectively reversed CMS’s position that secure texting was allowed with one exception.

“After meeting with vendors regarding these products, it was determined they cannot always ensure the privacy and confidentiality of PHI…being transmitted. This resulted in the no texting determination,” CMS said in the Nov. 30 email obtained by RMC.

CMS seemed to make clear that texting was a no-no.

“At this time, CMS does not permit the use of texting. The receiving or sending phones may not always be secure and encrypted, the privacy of the patient and his/her personally identifiable information (PII) cannot be guaranteed, and the sender or receiver cannot always be identified potentially exposing PHI/PII. In addition, the information contained in the text messages would be required to be entered into the patient’s medical record and available for retrieval,” emails to the hospitals viewed by RMC said.