Is HIPAA compliant file sharing possible with popular messaging apps like WhatsApp and Facebook Messenger and native text messaging apps on smartphones? It’s an important question.

Today, practically everybody uses these apps for everyday communication. In fact, by 2025, nearly 6 billion people will have access to text messaging.

But are messaging apps HIPAA compliant for file sharing? Can dentists use them to communicate with patients and colleagues and send files that contain protected health information (PHI)? Unfortunately, when it comes to regular consumer-grade messaging apps, the short answer is no. However, there are instances when using messaging apps is HIPAA compliant.

HIPAA Compliant File Sharing Overview

Before we delve into why messaging apps are mostly not HIPAA compliant, here is a quick primer on HIPAA compliant file sharing. If you store, transmit, or deal with healthcare data in any way, your company is subject to HIPAA compliance regulations.

HIPAA sets national standards for private and public healthcare providers sharing information, either directly or through health insurance companies. The law also describes the steps that covered entities must take to keep this data secure. This is to guard against abuse and unauthorized access to sensitive PHI.

Digital healthcare data is often referred to as ePHI (electronic Protected Health Information). ePHI can include the following:

• Names and dates of birth
• Addresses and contact details
• Phone numbers and email addresses (or any other information that in combination could lead to identifying a person)
• Medical record number, medical history, family history, past illnesses, present condition, treatment plan, medications taken in the last year (any information related to past or current health status)
• Photos of people
• Anything else considered sensitive personal information

When dealing with PHI, three safeguards must be in place to be HIPAA compliant. These are technical safeguards, physical safeguards and administrative safeguards.

• Technical safeguards: The principles for maintaining ePHI include measures to prevent cybersecurity breaches. The way sensitive healthcare data is stored, shared, accessed and utilized is crucial to the overall protection of ePHI. This category of safeguards includes a variety of security methods, such as having administrative access controls available, data encryption and authenticating users thoroughly.
• Physical safeguards: Physical access to ePHI needs to be limited to authorized individuals. In addition, there should be a system in place that logs and monitors activity relating to the handling of ePHI.
• Administrative safeguards: Administrative measures need to cover training staff members on how PHI is handled and other requirements such as assigning responsibility for compliance and documenting policies and procedures.

Reasons Messaging Apps are Not HIPAA Compliant for File Sharing

There are many reasons messaging apps like WhatsApp and Messenger are not HIPAA compliant for file sharing. Some of the main reasons include:

Lack of Access Controls

One of the main reasons messaging apps are not HIPAA compliant for file sharing is because they lack access controls. Many HIPAA-compliant file sharing systems require multi-factor authentication to log in and out, access specific folders, or copy files with PHI. This is an important control that can help prevent unauthorized disclosure if someone’s computer is hacked or data is lost somehow.

Messaging apps don’t offer any multi-factor authentication. This means anyone who gains physical access to your phone can potentially retrieve files with PHI on it. With HIPAA compliant file sharing systems, you have to enter a passcode before being able to view anything.

Lack of Audit Controls

Another reason messaging apps are not HIPAA compliant for file sharing is because they lack audit controls. This means there’s no way to know who accessed what data, when this access occurred and where the data went after it was exported. Messaging apps don’t offer any audit controls. There’s no way to monitor or control how files with PHI are being used after they leave your device.

With HIPAA compliant file-sharing systems, on the other hand, you have a log that shows precisely who accessed each file and what changes were made to that file. You can also see which folders a user has had access to and what actions they took within those folders (whether downloading/uploading/copying).

Poor or Non-Existent Data Encryption

Another reason messaging apps are not HIPAA compliant is because they lack data encryption. Many messaging apps use a variety of protocols that don’t support end-to-end encryption, meaning anyone can intercept your files in transit and access them. For example, even though a few messaging apps use end-to-end encryption, any protections afforded are lost as soon as chats backup to the cloud. As a result, anyone who manages to hack the cloud storage can access the unencrypted conversations. Some companies like WhatsApp are working on a fix, but it will be optional when implemented instead of the default setting.

With HIPAA compliant file sharing systems, military-grade encryption ensures your sensitive data stays protected from prying eyes no matter what happens.

When Are Messaging Apps HIPAA Compliant for File Sharing?

We mentioned that there are circumstances when messaging apps are HIPAA compliant for file sharing. This is made possible by purpose-built HIPAA-compliant text messaging and file sharing apps, which are now easily available to healthcare providers. The beauty of these specialized apps is that on the surface they work in the same way as popular messaging apps like WhatsApp. Under the hood, however, they run on a fully secure encrypted network and have all the necessary access and audit controls to bring them in line with HIPAA.

As well as texts and file sharing, the best HIPAA compliant messaging apps on the market today also enable voice calls, video calls and group chat – again, just like you and your patients’ favorite apps.

Utilizing HIPAA compliant messaging apps unleashes a whole host of benefits for all parties. You can easily communicate with patients in a manner you and they are familiar with, improving efficiency and workflows, allowing for quick sharing of appointment details and test results – and all while patient data is completely protected in full compliance with HIPAA guidelines. 

Get Started with HIPAA Compliant File Sharing

Protecting files and messages has never been so easy or affordable. The Encrypted Sharing HIPAA compliant messaging and file sharing solution from Central Data Storage offers secure messaging and file sharing for your business, making communicating with your clients, teams, and partners completely safe, simple, and cost-effective. Start your free trial today.