Secure mobile communication in hospitals

Messaging services have long been part of everyday life—even in hospitals. Whether it’s a consultation, coordinating with private practitioners, or checking with emergency services, a quick and straightforward exchange of information is essential. But patient data is among the most sensitive data there is.

Read why consumer messaging apps aren’t suitable for this purpose and how clinics can go mobile and GDPRCommunicate in a manner that complies with […].

Key Points at a Glance

• 98 percent of hospital physicians use messaging services, and 54 percent even use them to share test results.
• At the same time, 66 percent consider their messaging app to be insecure.
• According to Article 9 of the GDPR, health data is particularly sensitive—common messaging apps such as WhatsApp do not meet these requirements.
• Decision-makers may be held personally liable for communications that do not comply with data protection regulations.
• A hospital messaging app that uses container technology enables secure communication even on personal devices (BYOD).

Interdisciplinary and cross-site collaboration

Messaging apps enable quick communication between individuals and groups—and are increasingly being used in professional settings to share sensitive data. End-to-end encryption may provide a sense of security in this context. Problems arise when sensitive third-party data is sent: Sending electronic patient data via WhatsApp, for example, does not comply with the requirements of the GDPR. At the same time, the digitization of the healthcare sector makes cross-sector communication platforms and messaging apps necessary.

Typical use cases include:

• internal hospital communication, such as during a consultation
• Collaboration with private-practice physicians as referring and receiving physicians
• cross-sector care, e.g., in tumor boards
• Coordination with emergency medical services, senior living facilities, nursing homes, rehabilitation clinics, and therapists
• increasingly, digital communication with patients and their families as well

Why WhatsApp and Similar Apps Are Out of the Question in Hospitals

The professional use of messaging apps is subject to legal data protection requirements, which common services such as WhatsApp do not meet—or meet only to a limited extent. Health data is subject to special protection under Article 9 of the GDPR. Data controllers must therefore take extensive requirements into account when selecting a messaging app:

• No automatic cloud storage: Transmitted image data must not be stored in just any cloud.
• No messages sent to the wrong recipients: Commercial messaging apps access any contact lists, from which unsuitable recipients may be selected by mistake.
• No Access to the Address Book: Even syncing the address book violates the privacy rights of contacts who have not given their consent—including coworkers. This could result in penalties.

What Hospital Physicians Say

A representative survey by the German Data Protection Institute (DDI) highlights this dilemma:

• 98 percent of hospital physicians use messaging services.
• Two-thirds consider them useful in everyday hospital life.
• 54 percent actively use it to transmit medical findings.
• 66 percent consider their messaging app to be insecure.
• 84 percent blur patient information in photos before sending them—but such manual anonymization is usually ineffective.

The Challenge: Communicating Sensitive Data in Compliance with Data Protection Regulations

Due to the high risk of a data breach, hospitals need an alternative to commercial messaging apps. Medical facilities should provide their employees with secure communication channels—and doctors should not use insecure messaging apps simply because there is no alternative or because prosecution is rare. This is because, under the GDPR, the use of solutions that do not comply with data protection regulations can also make decision-makers personally liable.

Secure Communication in Everyday Hospital Life: Request a demo now —we’ll show you how your team can chat, make calls, and share medical reports in compliance with the GDPR.

The Solution: Secure Mobile Communication with SecurePIM

SecurePIM securely combines email, messaging, voice and video calls, contacts, calendars, notes, tasks, and documents into a single app. Thanks to container technology and the BSI-certified SERA security architecture, sensitive data can be sent and stored on both iOS and Android devices, regardless of the device used. Content from emails and documents can be shared in chat without leaving the app.

Thanks to container technology, employees can even use their own devices to access patient data—enabling BYOD solutions to be implemented quickly and securely.

The Integrated Messenger—The Benefits

• One-on-one chats, groups, and channels for up to 255 people
• Encrypted voice and video calls, sending documents and images, live location
• Easy installation and centralized user management
• All core components developed in Germany; BSI-certified security architecture
• Out-of-the-box GDPR-compliant messaging, intuitive operation requiring no training

SecureCOM: The Stand-Alone Messenger for the Healthcare Market

SecureCOM is the standalone version of the SecurePIM Messenger—with features specifically designed for the healthcare sector, such as advanced location features for emergency physicians and emergency medical services. Employees can download the app from the App Store or Google Play; alternatively, it can be rolled out via MDM or internal app stores. Administrators manage devices and accounts centrally in the SecurePIM Management Portal.

Features: Chats and channels, voice messages, images and documents, live location, screen sharing, audio and video conferencing, apps for iOS and Android, as well as desktop versions for Windows, macOS, and Linux, and synchronization with Active Directory or LDAP.

Security: Messages are end-to-end encrypted; contacts, keys, and PINs are stored in encrypted form; and the algorithms have been evaluated by the BSI. No personal data is stored on the server, which can run either in the cloud or on-premises. Other apps have no access—this allows WhatsApp to be kept separate from work and continue to be used for personal purposes.

Frequently Asked Questions

Are doctors allowed to use WhatsApp for patient data?
No. WhatsApp does not meet the data protection requirements for health data under Article 9 of the GDPR, in part because of the address book synchronization feature.

What features should a hospital messaging app have?
End-to-end encryption, no cloud storage of images, no access to private contacts, centralized user management, and ease of use.

Can hospital staff use their personal smartphones?
Yes, if a container strictly separates work and personal data—for example, using SecurePIM or SecureCOM.

For more information, click here:
KRITIS Industry
Webinar: Ultramobile Communication in Healthcare
White Paper: Ensuring Legal Compliance for BYOD Models