Weighing the Pros and Cons of IM: Instant Messaging Offers Instant Conveniences, Instant Complicationsby Angela K. Dinh, MHA, RHIA
Communications technologies such as mobile devices and e-mail have taken healthcare and its practice into uncharted territory. Now organizations can add to this list instant messaging, or IM. More and more businesses are using IM in their daily operations.
According to America Online’s most recent survey, 26 percent of its users use IM at work. Of that 26 percent, 58 percent use IM to communicate with colleagues, and 49 percent use it to get answers and make business decisions.1
Because IM allows communication in real time, it has the potential to increase productivity, reduce time on the phone, fax, and e-mail, and reduce errors in the translation of messages. However, its use in healthcare has both pros and cons, and organizations must consider the risks carefully and mitigate them accordingly.
The Bright Side and Dark Side
There are two schools of thought on IM use for business operations. Some believe that IM poses limited risks, while others believe IM opens doors to dangerous risks.
IM allows users to transfer files and images, which can be dangerous. IM was originally designed for entertainment purposes. The software did not take into account the possible transfer of sensitive data such as electronic personal health information.
IM software has a very basic technology structure, which creates many security issues. Users who are logged on to IM broadcast a signal to the Internet showing they are online. Hackers and other users can find that signal and attach themselves to it. IM creates a door into a user’s computer, exposing it to worms, viruses, and other harmful malware.
These dangers can also find their way into a system through messages, file attachments, or transferred or shared drives. IM is capable of bypassing a computer’s firewall and other security settings, unintentionally permitting a full view of a user’s computer.
On the other hand, IM in the workplace offers several conveniences. It allows for easy communication between employees and reduces time spent on the phone, fax, and e-mail. Since IM is immediate, employees can get what they need quickly and proceed with their day.
For management, IM can be an easy way to communicate and monitor staff to see who is available and online and who is away from their desk. IM can provide easy, real-time access to remote staff.
The Effects of IM on HIM
Managing records of IM chats is tricky and exists in a gray area legally. Are IM chats part of daily business records and thus the patient’s record? Depending on the content of the discussion, certain messages may need to be kept. Activity that contains electronic personal health information or involves a patient and that’s passed between users should be logged and audited.
How does the new federal electronic discovery rule affect IM chats? By definition and based on content, IM could be included as discoverable information.2 Therefore organizations must determine what information discussed through IM would be released as part of a request and be prepared to provide IM records if required during discovery.
IM clearly presents privacy and security obligations. If personal health information is exchanged, the need for privacy safeguards is a given. When it comes to security, physical and technical safeguards must be active.
The HIPAA security rule requires organizations to maintain audit logs and perform data audits. Some IM software has the ability to automatically log content of an IM conversation, but not all have this function. Legal counsel should be consulted when it comes to determining what IM conversations must be kept and what can be disregarded.
Safety and Security of IM
The reality for many organizations is that IM is already in use, regardless of the threats involved. Ways to reduce risk do exist, but there is no guarantee of full security. Microsoft and Symantec, two vendors of popular IM software, offer useful guidelines.3,4 The best way to ensure protection is to use the best practices possible. Below are some recommendations:
To IM or not to IM, that is the question. IM has its advantages and disadvantages. Do the risks outweigh the benefits or do the benefits outweigh the risks? Every organization should carefully consider both when deciding whether or not to use IM.
If an organization chooses to use IM, it must develop policies on its use, outline processes, and continuously monitor employee use. Healthcare organizations must ensure the safety and security of patient information in any and all formats.
Angela K. Dinh (firstname.lastname@example.org) is a professional practice resource manager at AHIMA.