| HOME | HELP | E-MAIL ALERTS | SEARCH |
|
CLINICAL REPORT |
| ABSTRACT |
|---|
|
|
|---|
Key Words: electronic communications health care delivery medical liability e-mail pediatrics
Abbreviations: HIPAA, Health Insurance Portability and Accountability Act PHI, protected health information
The American Academy of Pediatrics Periodic Survey of Fellows No. 51 documented that of the 1616 active US members reporting from October 2001 to February 2002, 14% already use e-mail to communicate with patients. Reasons cited for using e-mail included managing requests for prescription refills (54%), communicating test results (41%), and scheduling appointments (37%). Reasons for not using e-mail to communicate with patients included lack of physician time (52%), lack of office staff time (42%), concerns about privacy or confidentiality (45%), lack of interest in communicating via e-mail (38%), and too few patients with e-mail (34%).1 The volume of e-mail sent daily in the United States was expected to exceed 9 billion messages in 2003.2 A Harris Interactive survey reported in April 2002 that "about 90% of US adults who use the Internet say they would like to communicate with their physicians online ... ."3 The study went on to report, "56% said that ability to communicate with their physician online would help influence their choice of physician."
The popularity of e-mail is attributable to some of its unique characteristics, namely its ability to allow asynchronous communication and rapid message transfer, making it a hybrid of the telephone and the written letter.4 As it is used, e-mail is a more informal means of communication than the letter, but more rapidly transmitted. Like a letter, it can be sent or read by the recipient at convenient times, avoiding "telephone tag." In addition, it is "self-documenting," providing a lasting copy for future reference. Thus, it is no surprise that pediatric patients and their families share the desire to use e-mail to communicate with their pediatricians.35 E-mail would seem to offer physicians and patients obvious benefits for facilitating communication. Therefore, it may seem somewhat surprising that there has been relatively slow adoption of e-mail as a patient communication tool by pediatricians and other physicians.4 There are many reasons for this, including but not limited to concerns about maintaining the confidentiality of e-mail, physician concerns about the potential volume of e-mail correspondence, and potential legal issues.1,5
| BACKGROUND: E-MAIL TECHNOLOGY |
|---|
|
|
|---|
By design, the Internet is a very robust communication system with an architecture that was structured to maintain communication in case of national disasters that might result in the destruction of significant amounts of the national communications network (such as in the case of nuclear war). Messages transmitted across the Internet are not normally encrypted; nor is there typically authentication of author identity. Lack of encryption allows those with access to the Internet network to intercept, read, or potentially alter messages as they pass to their final destinations. These risks are not unique to e-mail. Telephones can be tapped (legally or illegally); scanners can monitor portable telephone communications; traditional mail can be intercepted, read, or altered, and letters can be forged. Despite potential confidentiality and security risks, it seems on the basis of volume alone that most people are comfortable using e-mail, particularly for relatively trivial or mundane communication needs. The perceived benefits of this fast, asynchronous, and relatively inexpensive form of communication appear to outweigh the risks to most users.
| PRIVACY AND SECURITY RISKS |
|---|
|
|
|---|
Pediatricians have the legal responsibility, whenever health information is requested by or communicated to an individual, to ensure that: 1) the individual has a legitimate right to release or gain access to that information before releasing or communicating that information by letter, by phone, in person, or by e-mail; 2) the information is directed only to those having a right to receive it; and 3) the information is accurately transmitted and received. These are the requirements to ensure the authenticity, confidentiality, and integrity of information exchange.8,9
Authenticity refers to a recipients ability to positively know the identity of an individual sending a communication.10 Anyone can send e-mail with virtually anyones name attached to it. The inability of e-mail to provide methods of authentication presents a significant risk to patients and physicians. E-mail authentication has been one of the more difficult issues to address when using e-mail for medical communication. Two general solutions to the authentication problem, digital certificates and secure networks, will be discussed briefly later in this report.
Confidentiality refers to the need to protect information from those who have no legitimate right to the information presented.11 Risks to patient confidentiality occur when multiple individuals (eg, family members) share the same e-mail address, when access passwords are not used or are not kept secured, when computers are left on and unattended without logging out of e-mail, or when e-mail at work or at school is used for personal communication. Using e-mail on systems that belong to employers, other organizations, or schools presents particular problems. Many e-mail users do not know that most organizations and companies, as policy, consider organizational e-mail to be their property and reserve the right to read e-mail on their systems. Another threat to confidentiality results from the ease with which e-mail messages can be misaddressed and erroneously sent to unintended recipients, instantaneously broadcast to multiple recipients, or forwarded by others to unintended recipients.
Integrity of message transmission refers to having absolute knowledge that the message received was unaltered and identical to the one transmitted and that the message was sent and received by the appropriate person.11 Because e-mail messages can be intercepted, especially by hackers who break into an e-mail server but also by individuals who might gain access to anothers personal electronic mailbox, there may be justifiable concern about integrity of messages. Of more concern is that a message sent to one individual might be altered by the recipient. The altered message, its intent perhaps drastically changed, might then be forwarded to another person.
| E-MAIL IN THE PHYSICIAN OFFICE ENVIRONMENT |
|---|
|
|
|---|
Another concern beyond identification is that of e-mail attachments. E-mail attachments can cause a variety of problems, including the transmission of computer viruses (potentially paralyzing the computer system), the use of excessive memory, the need to read and print messages and attached documents for inclusion in patient records (using staff resources), or the need for versions of software that are not available on the office system. To rectify this issue, pediatric offices can consider restricting the use of attachments as part of patient messages. Attachments might be restricted to reports or attachments from professional sources, such as other physician offices, emergency departments, and hospital medical records departments. Having the ability to control which users may append attachments can lend a lot of flexibility to an e-mail system.
Occasionally, situations occur in which an office may want to have the ability to block the receipt of e-mail from certain individuals. E-mail systems that allow the office the ability to inactivate passwords or block e-mail from specific individuals can effectively restrict e-mail system access for selected patients by the office when necessary.
It is very important for practices to set realistic expectations for e-mail and communicate those expectations to families. Patients must understand what the office considers a reasonable response time for nonurgent messages and must understand that emergency communication is appropriately handled by telephone, not by e-mail. Communications that are usually appropriate for e-mail include routine appointment requests, billing questions, routine prescription refill requests, provision of follow-up information, and chronic disease management questions. By providing patients with office e-mail policies in written form before they receive an e-mail password, posting the policies on the practice Web site, and verbally reinforcing these policies, pediatricians and their staffs can help patients to understand and adhere to the appropriate use of e-mail.
There are other considerations the pediatrician needs to address before providing pediatric patients with e-mail access to the office. Policies can address the age at which pediatric patients can begin to send e-mail to the office themselves. Will children and parents receive the same brochures and sign the same consents (or assents)? Will parental permission be required before a child can receive a password to access office e-mail? Although there are not necessarily any right or wrong strategies, patients and their parents must know and understand office practices and policies.
Patients typically desire to communicate by e-mail with their physicians office to schedule appointments, refill prescriptions, resolve billing questions, request referrals, obtain test results, get forms or immunization records completed, ask nonurgent medical questions, or provide medical follow-up. Most of these tasks can be delegated to an appropriate office staff member. Patients must understand who in the office will read and triage e-mail as well as the limits to privacy that messages will have in the office. Patients must know when, for example, messages addressed to a particular individual in the office, even about personal matters, may be first subjected to clerical or nurse review. E-mail systems that can automatically triage messages to the appropriate office staff member, depending on the type of message, can improve efficiency and patient confidentiality. Patients can be informed that by restricting e-mail messages to one issue per message, message triage efficiency and patient confidentiality might be enhanced. The office also needs to have policies and processes to address messages that arrive when a pediatrician or designated office staff person is unavailable or has elected not to have the messages forwarded to them, and to address e-mail received on weekends, holidays, or whenever the office is closed. Routine policies can be incorporated into a patient e-mail brochure, and the policy can be reinforced using the "auto reply" feature included in most e-mail software, stating when action will be taken on messages and telling the patient to call the office for more urgent matters. Copies of e-mail messages with responses can be incorporated into patient charts. Patients can be advised to retain copies of e-mail sent by the office to avoid their forgetting or misunderstanding the intent of messages.
A well-constructed patient brochure outlining office e-mail policies and the appropriate use of e-mail will help control patient expectations and prevent misuse of e-mail by patients. Although some offices may require patients to sign a consent form allowing e-mail communication, it is more important that patients and parents clearly understand the differences among, and appropriate use of, each available form of communication. It is a good practice to document that each patient has been provided with written information that addresses the appropriate use of e-mail and office policies and procedures that support e-mail. This information can be provided before office e-mail addresses or access passwords are given to patients.
Drawing an analogy to telephone communications, e-mail communication is another way to enhance patient communication and satisfaction and to build goodwill. Just as there are no regulations that preclude charging patients for telephone advice, except as may be contained in insurance contracts, there are no restrictions on charging patients for advice rendered by e-mail. Some insurers have begun to consider e-mail an important part of chronic disease management and have started to selectively reimburse physicians for e-mail communication related to disease management.12,13 More plans are expected to begin reimbursing clinicians for online consultation for both acute and chronic conditions. Because e-mail self-documents, it can provide the evidence of medical work that telephonic communication does not offer. Thus, insurers have been more willing to consider reimbursement for e-mail interactions. Current Procedural Terminology14 codes for care plan oversight (99374-99380) already exist and are reimbursable under some insurance plans.15 Case management services telephone calls (99371-99373) presently are restricted to telephone use but might be broadened in the future to include e-mail services.
| LEGAL STATUS OF E-MAIL IN HEALTH CARE |
|---|
|
|
|---|
Just as for telemedicine, issues related to medical licensing and jurisdiction can be raised when communicating with patients and providing patient care or advice across state lines by e-mail. Although it is unlikely the pediatrician would be in jeopardy of prosecution for practicing medicine without a license by giving medical advice to an established patient via e-mail, it is important that pediatricians check their states law on this issue. Some states have begun to address this issue in their state medical practice legislation, with the possibility of requiring a state medical license for such transactions.
There can also be medical liability risks related to providing "medical care" by e-mail or Internet communication. Before medical liability can exist, one must demonstrate that a patient-physician relationship has been formed. The establishment of the patient-physician relationship, or "duty," has not been well clarified when using e-mail or the Internet exclusively to provide advice in the absence of any physical contact. Arguably, an analogy can be drawn to the situation in which a physician provides general information on a local radio or television broadcast. In such cases, in which information is general in nature and not meant to diagnose or treat a specific individual, there is no relationship or duty established. Although case law has not been well established, there have been concerns raised as to whether a patient-provider relationship would be initiated when advice is given in an online forum ("bulletin board" or "chat room"). However, in cases in which there is a previous patient-physician relationship or in which a Web site is created to solicit patient queries, the risk of medical liability is greater.
Failure to meet patients service expectations or follow ones own office policies and procedures can result in liability. The situation in which a physician fails to respond in an appropriate time frame to a patient e-mail, resulting in an adverse outcome, for example, might present a liability risk, emphasizing the need to educate patients about the appropriate use of e-mail and about appropriate response time expectations. Patients must be instructed and must understand when it is appropriate to escalate queries by telephoning the office directly. Although e-mail is widely used, neither the legal nor medical liability communities have significant precedents for dealing with potential e-mail communication risks. Pediatricians should monitor for the development of such precedents in the future.
| E-MAIL TECHNOLOGIC SOLUTIONS |
|---|
|
|
|---|
The secure server solution is analogous to doing banking online. The pediatricians office must initially authenticate the identity of the patient, such as at the time of an office visit, and provide a sign-on code and temporary password specific to that individual. When the patient logs on to the system for the first time, he or she then changes the temporary password to a new and confidential one known only to the user. When a message is sent to that patients system mailbox by the office, a secondary nonsecured notice is sent to the patients identified home e-mail account alerting the patient to log on to his or her secure mailbox on the system. Logging on is accomplished securely using the patients confidential password and via the Web browsers secure socket layer. Secure socket layer transmission across the Internet is encrypted between the mail server and the patient. Only the individual with the password to that account has access to it. From the secure mailbox, patients can also securely send messages back to the pediatric office. Such messages reside on the server, and the office logs on to the mail system securely, as does the patient. In this type of system, unencrypted messages containing medical information never travel on the Internet.
Digital signatures rely on the use of "keys" to encode (encrypt) messages sent across the Internet. The sender of a message has a private key that is used for coding the message. The receiver has a complementary public key to decode the message, thus making it readable.18 These keys are not physical devices but rather strings of random characters that are used in the mathematical encrypting algorithm. Authentication of identity occurs before a key is released to a user, and a certification authority handles management of public and private keys. Authentication can still be an issue depending on the identity control mechanisms used.17,18 Presently, these systems are complex to administer and cumbersome to use. However, in the future, perhaps by using smart cards or biometric forms of authentication (eg, fingerprint readers), these systems may grow in popularity.
Commercially available e-mail systems can provide added value beyond simply the ability to transmit and receive e-mail. They can provide e-mail encryption, authentication, and password management; can facilitate automatic triaging of messages on the basis of message type; and can provide the ability to "auto-fax" prescriptions to pharmacies. Some systems can assign "rights" to certain users (such as to append attachments) or allow for associated business transactions (charges for communications) to be handled online. Costs of these systems can vary widely, but for a very modest cost, most offices can implement basic secured messaging.
| CONCLUSION |
|---|
|
|
|---|
| Task Force on Medical Informatics, 20012002 |
|---|
|
|
|---|
| Staff |
|---|
|
|
|---|
| FOOTNOTES |
|---|
| REFERENCES |
|---|
|
|
|---|
160, 164 (2000). Available at: http://www.hhs.gov/ocr/hipaa/finalreg.html. Accessed August 9, 2003Statement of reaffirmation:
This article has been cited by other articles:
![]() |
P. Rosen and C. K. Kwoh Patient-Physician E-mail: An Opportunity to Transform Pediatric Health Care Delivery Pediatrics, October 1, 2007; 120(4): 701 - 706. [Abstract] [Full Text] [PDF] |
||||
![]() |
J. R. Thomas and U. Shaikh Electronic Communication With Patients for Breastfeeding Support J Hum Lact, August 1, 2007; 23(3): 275 - 279. [Abstract] [PDF] |
||||
![]() |
M. Y. Mann, M. A. Lloyd-Puryear, and D. Linzer Enhancing Communication in the 21st Century Pediatrics, May 1, 2006; 117(5/S1): S315 - S319. [Abstract] [Full Text] [PDF] |
||||
![]() |
T. Kind E-mail and Parent/Physician Communication AAP Grand Rounds, September 1, 2005; 14(3): 34 - 34. [Full Text] [PDF] |
||||
![]() |
G. McConnell AAP clinical report gives tips for minimizing e-mail risks AAP News, July 1, 2004; 25(1): 16 - 16. [Full Text] [PDF] |
||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||
| HOME | HELP | E-MAIL ALERTS | SEARCH |