OhMD and HIPAA Compliance

What Is This Product?

OhMD is a secure messaging system designed specifically for the healthcare industry, that’s oriented to providing efficient and secure texting between both clinicians/providers and clients/patients, as well as between providers. OhMD works with your existing phone number (or they can obtain a new phone number for you, but that number will be used only for messaging — not for voice calls, as they’re not a VoIP service.)

OhMD has 3 different plan tiers, each of which includes a HIPAA Business Associate Agreement (BAA.) Their free “base” tier is ideally suited for solo/solo+ providers (meaning there is only one clinician/HIPAA covered entity within your organization.) For those in group practice (more than one clinician within the organization/as part of the HIPAA covered entity,) their “plus” and “reach” plans are designed for both your security and functionality needs. The “plus” and “reach” plans both include a “chat auditing” feature that’s necessary for retaining data availability — any system that handles Protected Health Information (PHI) on behalf of the practice, should have control over and access to all information handled by said system maintained by the practice (keep it “in the circle.” This chat auditing feature is not available on the base plan — though one can still see all messages exchanged within an individual’s user account, which is why the base plan is best suited for solo/solo+ practices.

OhMD, on both the “base” and “plus” plans, functions as a proprietary messaging app, which does require that the client download it — remember, encryption is a two-party game and both parties must have the decoder ring. However, this is a simple and streamlined process for the client; the provider simply sends them an invitation (which is generic and sent from OhMD, not directly from the provider — which is preferred from a risk management perspective) to download the app and setup a profile. Once the profile is setup, the client can securely communicate with their provider — or if you’re on the “plus” or “reach” plan, you can create a care team or admin team and the messages can be directed to those within that designated group. If you want additional functionality, such as secure chat messaging embedded on your website (with configurable operational hours, away messages, and customized batch messaging) you can opt for OhMD’s “reach” plan. The “reach” plan also includes conventional SMS messaging functionality, so clients don’t have to download the app — however, if you utilize this functionality you must ensure you’ve done the request for non-secure communications and collaborative risk analysis for non-secure communications process with clients before utilizing it (something the company will also tell you. Note, it’s a good sign when a company is willing to step up and partner in your HIPAA Security compliance process needs and inform you of your responsibilities as a user!)