When it comes to e-mail and patients, where should doctors draw the line?
By Deborah Gesensway
PHILADELPHIA—Patricia L. Hale, ACP—ASIM Member, allows computer-savvy patients to e-mail questions to her about general medical issues, such as advice they have read on the Web. When it comes to more specific questions about their own health, however, she draws the line.
"At this point, I don't think we really can have an e-mail relationship with our patients," said Dr. Hale, a general internist in upstate New York. At an Annual Session workshop, "Practicing Medicine by Telephone and Computer: Legality, Safety and Security," she outlined some of the pitfalls of exchanging e-mail with patients and some tips to protect the confidentiality of information communicated electronically.
While computer experts like to point out that personal medical information can more easily be kept confidential in electronic form than on paper, physicians insist that e-mail is a big exception. They note that security on the Internet can easily be breached by hackers who intercept messages or break into computers linked to the Internet. Dr. Hale said that even a simple error, such as typing a wrong letter in an e-mail address, can put sensitive information into the wrong hands.
Consider one popular use of e-mail: "mailing lists" where physicians send an e-mail giving updates to all patients with a disease like AIDS. If you send messages to groups of patients using the "carbon copy" button, everyone who receives the message can identify your other patients who are being treated for a disease. If that information falls into the wrong hands, confidentiality could be breached. (To avoid this problem, send e-mail to groups of patients using the "blind copy" feature so recipients cannot identify each other.)
E-mail can also compromise confidentiality if you send messages to patients at work. Charles Safran, FACP, clinical associate professor of medicine at Harvard Medical School, said that employers usually store all e-mail on their system, and that they have the legal right to read all e-mail. "You may be exposing your patient to problems at his employment," Dr. Safran said.
If you're going to use e-mail to communicate with patients, Dr. Hale offered a number of suggestions to stay out of trouble. A good starting place is a guideline on the clinical use of patient e-mail published in the January/February 1998 issue of the Journal of the American Medical Informatics Association. Dr. Hale also offered the following tips to help protect the privacy of medical information sent via e-mail:
- Explain the risks. When patients want to communicate via e-mail, Dr. Hale said, start with a face-to-face meeting. Talking to patients in person allows you to spell out confidentiality concerns that patients may not have thought about. You can also verify the e-mail address the patient will use, which gives some assurances that any mail you receive from that account is from your patient and not someone else.
Dr. Hale said she tells patients that there are confidentiality risks of using e-mail to talk about their health.
Dr. Hale also suggested using your face-to-face meeting to have patients sign a statement saying that they understand the risks and will follow certain procedures when sending e-mail to physicians. Specify that e-mail should not be used for emergencies, other time-sensitive issues or sensitive information. (Tell patients that they cannot assume e-mail is confidential.)
Take this opportunity to specify how patients should address their e-mail to the physician. (Dr. Hale asks for the patient's name and patient ID number.) Dr. Hale also asks patients to keep copies of e-mail they send her. She tells patients that she will print out any correspondence she receives and file it in their medical records.
- Set up a separate e-mail account for e-mail from patients. Be careful, Dr. Hale said, about mixing e-mail you've received from patients with messages from your colleagues and family. For one, it's easy to mistakenly forward a message to the wrong person. In addition, when you store different types of e-mail in the same account, you increase the odds that someone will come across a clinical message when they're looking for other information.
- Use your address book function. A common problem, Dr. Hale said, is typing the wrong information when addressing e-mail. Very little e-mail is truly undeliverable these days, she said. If your message didn't reach your patient, it probably was delivered to someone else. To guard against such typos, Dr. Hale recommended entering patient e-mail addresses into your e-mail address book once, then selecting the address from there instead of typing it.
- Don't use Palm Pilots or other wireless computers to attend to patient e-mail. Because these devices use easily intercepted cellular signals to access the Internet, they are even less secure than accessing the Internet via computer modems.
- Install password-protected screen-savers. Do this for all desktop workstations in the office, hospital and home, Dr. Hale said. If you are interrupted when reading a patient's e-mail, someone else is less likely to be able to read it or anything else on your computer.
- Never use a patient's e-mail address in marketing. Proposed federal health information privacy regulations take a harsh view of such uses. Dr. Hale said that physicians who use patient lists to market services could face fines and even jail time if the current proposed regulations are finalized.
- Watch your language. Whatever you do, do not write anything negative about insurance companies or colleagues in e-mail messages. In addition, she said, avoid anger, sarcasm and harsh criticism. Dr. Hale said to remember that because e-mail is written communication, it will be saved. Anything you say could come back to haunt you in a lawsuit.
Deborah Gesensway is a freelance writer in Abington, Pa.
Internist Archives Quick Links
Sign-up for Physician & Practice Timeline® text alerts and never miss another regulatory deadline!
Triggered text alerts aimed at keeping you on top of upcoming deadlines and details related to regulatory, payment, and delivery system requirements are available FREE of charge!
See sign-up instructions.
Pre-order MKSAP17 Complete and Save 15%!
Enter priority code PR58 when ordering. Limited time only. Order now.