Child-Maltreatment-Research-L (CMRL) List Serve

Message ID: 10801

Date: 2020-04-22

Author:Andrew Benesh

Subject:Re: secure texting with participants

I think Steven's got the right idea. I'd suggest looking at Signal ( https://signal.org/) or pMD ( https://www.pmd.com/). Signal offers end-to-end encryption with password protected access and on-device encryption, and functions exactly like a regular SMS app from the user side; it can even be used to send both encrypted and unencrypted messages so your participants won't have to switch between apps for those functions. It's considered some of the highest quality security you can get; it's commonly used by journalists handling sensitive stories and people communicating in oppressive regimes. The way the messaging is setup it qualifies under the HIPAA Conduit exception, which may be part of your concern. pMD is part of a larger ecosystem of apps that also offers end-to-end encryption with on device encryption and password protected access. They do store data on a server separate from the user devices as part of their larger service, and to address that from a HIPAA standpoint they do offer a free BAA for individual users. This can be useful in that it clearly separates out your research / clinical messages from your normal texts; however it does require participants to use a different app than they normally do which might be an issue for some. Both of these also offer secure options for video and voice calls as well. Hope that helps, On Wed, Apr 22, 2020 at 11:54 AM Silovsky, Jane F. (HSC) > wrote: Thanks Daniel for reaching out – this is part of longitudinal research and we have found the best means to maintain contact with participants is through texting. We use texts to check in on a monthly basis and to schedule meetings with them. We are not sharing any PHI or sensitive information and we are not collecting data through the texts. Jane From: bounce-124574449-6832844@list.cornell.edu > On Behalf Of Kelly, Daniel Sent: Wednesday, April 22, 2020 9:33 AM To: Child Maltreatment Researcher List (CMRL) > Subject: [EXTERNAL] Re: secure texting with participants First, who is telling you this isn’t secure enough and why? Second, who are you trying to secure the information from? If it is traffic over the net, is the texting application secure/encrypted? Happy to help, just need more information. Feel free to reach out privately, -Daniel --------------------------------------------------- Dr. Daniel P. Kelly Pronouns: he, him, his Assistant Professor of Instructional Technology Department of Educational Psychology and Leadership Texas Tech University - College of Education EDIT Master’s Degree Program Coordinator Affiliate Faculty - Human Development & Family Studies Editor-in-Chief – Journal of Foster Care Associate Editor – Engineering Design Graphics Journal Phone: 806.834.5391 daniel.kelly@ttu.edu http://drdanielkelly.com Attention: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom addressed. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please contact the sender by reply e-mail and destroy all copies of the original message. From: > on behalf of "Silovsky, Jane F. (HSC)" > Reply-To: "Child Maltreatment Researcher List (CMRL)" > Date: Wednesday, April 22, 2020 at 8:49 AM To: "Child Maltreatment Researcher List (CMRL)" > Subject: secure texting with participants What strategies and policies do research teams have in place to allow texting of research participants and keep this process secure? We previously have used encrypted cell phones for texting, but now have been told this isn’t secure enough because the cell phones of the participant isn’t encrypted. Participants do not want to be managing multiple devices. Any recommendations? Jane Silovsky -- "The resemblance between the process of therapy and the phenomenon of play is, in fact, profound." - Gregory Bateson Andrew S. Benesh, PhD LMFT Assistant Professor & Clinic Coordinator Mercer University School of Medicine (w) 478-301-4078

I think Steven's got the right idea. I'd suggest looking at Signal ( https://signal.org/) or pMD ( https://www.pmd.com/). Signal offers end-to-end encryption with password protected access and on-device encryption, and functions exactly like a regular SMS app from the user side; it can even be used to send both encrypted and unencrypted messages so your participants won't have to switch between apps for those functions. It's considered some of the highest quality security you can get; it's commonly used by journalists handling sensitive stories and people communicating in oppressive regimes. The way the messaging is setup it qualifies under the HIPAA Conduit exception, which may be part of your concern. pMD is part of a larger ecosystem of apps that also offers end-to-end encryption with on device encryption and password protected access. They do store data on a server separate from the user devices as part of their larger service, and to address that from a HIPAA standpoint they do offer a free BAA for individual users. This can be useful in that it clearly separates out your research / clinical messages from your normal texts; however it does require participants to use a different app than they normally do which might be an issue for some. Both of these also offer secure options for video and voice calls as well. Hope that helps, On Wed, Apr 22, 2020 at 11:54 AM Silovsky, Jane F. (HSC) > wrote: Thanks Daniel for reaching out – this is part of longitudinal research and we have found the best means to maintain contact with participants is through texting. We use texts to check in on a monthly basis and to schedule meetings with them. We are not sharing any PHI or sensitive information and we are not collecting data through the texts. Jane From: bounce-124574449-6832844list.cornell.edu > On Behalf Of Kelly, Daniel Sent: Wednesday, April 22, 2020 9:33 AM To: Child Maltreatment Researcher List (CMRL) > Subject: [EXTERNAL] Re: secure texting with participants First, who is telling you this isn’t secure enough and why? Second, who are you trying to secure the information from? If it is traffic over the net, is the texting application secure/encrypted? Happy to help, just need more information. Feel free to reach out privately, -Daniel --------------------------------------------------- Dr. Daniel P. Kelly Pronouns: he, him, his Assistant Professor of Instructional Technology Department of Educational Psychology and Leadership Texas Tech University - College of Education EDIT Master’s Degree Program Coordinator Affiliate Faculty - Human Development & Family Studies Editor-in-Chief – Journal of Foster Care Associate Editor – Engineering Design Graphics Journal Phone: 806.834.5391 daniel.kellyttu.edu http://drdanielkelly.com Attention: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom addressed. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please contact the sender by reply e-mail and destroy all copies of the original message. From: > on behalf of "Silovsky, Jane F. (HSC)" > Reply-To: "Child Maltreatment Researcher List (CMRL)" > Date: Wednesday, April 22, 2020 at 8:49 AM To: "Child Maltreatment Researcher List (CMRL)" > Subject: secure texting with participants What strategies and policies do research teams have in place to allow texting of research participants and keep this process secure? We previously have used encrypted cell phones for texting, but now have been told this isn’t secure enough because the cell phones of the participant isn’t encrypted. Participants do not want to be managing multiple devices. Any recommendations? Jane Silovsky -- "The resemblance between the process of therapy and the phenomenon of play is, in fact, profound." - Gregory Bateson Andrew S. Benesh, PhD LMFT Assistant Professor & Clinic Coordinator Mercer University School of Medicine (w) 478-301-4078