10 Best Practices for Using Slack in Healthcare

Slack is a popular tool used by many healthcare organizations to support workplace collaboration across a wide range of versatile applications. But is it a safe repository for protected health information (PHI)? This post reviews critical considerations and best practices for handling sensitive patient data while remaining HIPAA compliant.

How is Slack used in healthcare?

The use of workplace collaboration tools like Slack is on the rise in the healthcare industry.

• Claims management—streamlining communications to improve resolution times and patient satisfaction
• Patient care—bringing doctors and nurses into a unified workspace for faster treatment decisions
• Research team support—coordinating clinical trials and facilitating seamless communication for research teams

While these use cases can improve outcomes for patients and medical teams, it's crucial to exercise caution when handling sensitive healthcare data. At all times, adherence to HIPAA regulations is paramount to ensure the security and privacy of patient information.

Is Slack covered by HIPAA?

Healthcare providers and other covered entities are under the same obligation to protect PHI in Slack as in any other data set. The informal, conversational nature of Slack chats may lead employees to think they don’t have to take the same precautions to safeguard patient information as they might in other tools, such as email, and that makes it essential that healthcare organizations properly train employees on how to use Slack securely to remain compliant with the Health Insurance Portability and Accountability Act.

To support HIPAA, Slack offers a range of security and compliance features designed to protect patient information. However, simply configuring these settings is not enough to get complete HIPAA compliance in Slack. Instead, information security controls must be paired the appropriate training and compliance enforcement.

Are there challenges to using Slack in healthcare?

The fast, informal nature of Slack conversations can increase the likelihood of risky or restricted information being shared within its channels. Aware research shows that 1 in 17 Slack messages contain three or more pieces of sensitive data such as PII or PHI.

Additionally, workspace admins may find their visibility of Slack messages is restricted by Slack’s complex structure of public channels, private channels, and direct messages. Depending on the Slack plan in use, admins may have to petition Slack for copies of their own records. And even when administrators do have full visibility into Slack messages, users can still edit or delete what they originally wrote, making HIPAA compliance investigations harder to conduct.

Compliance concerns of using Slack for healthcare

Beyond the challenges of user behavior and limited visibility and control over sensitive data, there are more HIPAA compliance concerns that healthcare organizations and other covered entities must address in Slack.

Data loss prevention

Tools like Slack offer countless ways that data can be improperly accessed, exfiltrated, or lost. Many such cases are the result of accidents or negligence, such as uploading confidential documents to public Slack channels. These mistakes can be compounded if employees decide to erase the evidence that a breach occurred rather than report it. Malicious insiders can also use Slack for cover, syncing company files to personal devices and circumventing security firewalls in moments.

Hacks and breaches

External bad actors can also gain access to sensitive data through Slack. Even in workplaces that enforce two-factor authentication (2FA), Slack accounts can still be hacked through compromised credentials and MFA fatigue attacks, where they send repeated login requests until a user finally approves one. Once inside a Slack environment, these bad actors can exfiltrate anything from the channels available to them, including unrestricted patient information.

Third-party integrations

Even when Slack itself is properly configured and secured for HIPAA compliance, the third-party apps and integrations connected to it can still create back doors through while data may be compromised. To prevent this, workspace admins should thoroughly vet each new app and integrations before use, and routinely inspect them to ensure they still meet required compliance standards.

Device security

One of Slack’s most popular features is its wide range of apps that enable it to be used on multiple devices and device types. However, when employees use Slack on their personal devices, they may introduce risk by not keeping their Slack app up to date, or even mislaying the device completely.

10 best practices for healthcare teams using Slack

1. Leverage native data security features
 

Begin by understanding and using the controls Slack provides to protect health information. Slack offers a range of security and compliance options, including data encryption in transit and at rest, MFA and OAuth or SAML-based single sign-on (SSO).

2. Utilize admin roles in Enterprise Grid
 

Healthcare entities must use Slack Enterprise Grid to access all of Slack’s HIPAA compliance tools, and this also gives admins access to enterprise-grade security controls. Enterprise Grid roles allow workspace owners to take granular control of who has access to sensitive or restricted data in Slack.

3. Sign a Business Associate Agreement (BAA)
 

A BAA is a binding contract that outlines the responsibilities of covered entities and their partners in protecting PHI. Slack is classified as a vendor or service partner under HIPAA and has certain obligations to safeguard protected healthcare data within its software. Users must have an Enterprise Grid plan to sign a BAA with Slack.

4. Automate data retention and removal
 

By default, Slack retains data from paid workspaces indefinitely. Over time, this can create a massive library packed with data that carries more risk than value. However, free users may find that Slack's one-year retention limit results in the loss of critical company information. By implementing granular retention policies, evaluating the value of Slack data to the organization, and automatically purging old content when it is no longer needed, healthcare entities can protect themselves by reducing their liability in Slack.

5. Use a DLP tool designed to support HIPAA compliance in Slack
 

While Slack offers many features to help manage data within its app, workspace admins should consider implementing third-party data loss prevention integrations with the functionality to further support HIPAA compliance in Slack. The right tool should connect in real time to identify noncompliance, issue notifications when it detects risk, and coach employees on acceptable use polices as violations happen.

6. Implement 2-factor authentication
 

Slack can protect workspace instances by limiting logins to team members from a specified domain. However, usernames and passwords can be compromised, hacked, or stolen in phishing attacks. Implementing 2-factor authentication or single sign-on can reduce the likelihood of a hacker gaining access to a company Slack account.

7. Use role-based access control (RBAC)
 

Slack workspace admins can further limit which users can view sensitive and confidential information by implementing role-based access control at every stage. This can be used to limit visibility within Slack and restrict who can create channels, add users, or grant permissions. RBAC should also be a feature of any third-party tool connected to the workspace that can view or manage Slack data.

8. Implement compliant naming conventions
 

Real time compliance monitoring for Slack can prevent the proliferation of PHI and other sensitive data using keywords and regular expressions to detect unauthorized information sharing. However, users may take steps to circumvent these controls under the mistaken belief that this protects the data they are sharing. Enforcing predefined naming conventions can support HIPAA compliance by making PHI easily identifiable in Slack.

9. Routinely train and re-educate employees
 

Your employees are your greatest source of risk and your first line of defense when it comes to using Slack in healthcare. Training your employees on the importance of protecting PHI, regularly refreshing that training, and giving employees appropriate tools in which to share sensitive information in order to do their jobs.

10. Avoid patient communication via Slack
 

Slack prohibits the use of its app to share doctor-patient communications. Doing so will invalidate the BAA your organization signs with Slack, and leaves you exposed to HIPAA violations. Instead, patient communications should be limited to tools like MyChart that are specifically designed for that purpose.

By following these best practices, healthcare teams can harness the collaborative power of Slack while mitigating potential risks and ensuring HIPAA compliance.

How Aware supports compliance for healthcare teams

Aware empowers healthcare teams to unlock the potential of Slack while remaining HIPAA compliant using industry-leading AI and NLP technology to monitor for HIPAA compliance in real time. The Aware platform connects to Slack via native APIs for seamless integration, providing the security that covered entities need without impacting the end user experience. With Aware, healthcare providers can:

• Proactively identify unauthorized PHI sharing in real time
• Coach users on acceptable use in real time
• Tombstone restricted content to prevent ongoing visibility
• Automate HIPAA compliance monitoring 24/7
• Identify more instances of PHI with fewer false positives
• Connect Slack insights with legal, compliance, and HR workflows

Aware supports companies from healthcare organizations to international NGOs with data privacy, compliance, and cybersecurity in collaboration tools like Slack.