Actively seeking patient feedback allows healthcare organizations to gain invaluable insights into the patient experience, identifying areas of strength and areas that require enhancement. Survey data is a powerful decision-making tool, supporting strategic planning and resource allocation.
HIPAA and patient surveys
When conducting HIPAA compliant patient surveys, healthcare organizations must ensure that no individually identifiable information is collected, and survey responses are kept anonymous and confidential. The Minimum Necessary Rule further mandates that only the minimum amount of PHI necessary for a specific purpose should be used or disclosed. When creating patient surveys, healthcare organizations should limit the collection of patient information to only what is required for the survey's objectives.
This ensures that while the organization benefits from the patient's perspective on their performance, all patient data is adequately protected.
Related: Text messaging for patient surveys
Steps to take when creating an effective patient survey
Select the Survey Method
Choose the most appropriate survey method based on the target audience. Options include online surveys, mailed surveys, phone surveys, or in-person surveys. Online surveys are often more convenient and cost-effective. If using a third-party survey platform or hosting service, ensure they are willing to sign a Business Associate Agreement (BAA). This agreement establishes a legal obligation for the third party to comply with HIPAA regulations and protect patient data.
Develop Survey Questions
Draft clear, relevant, and actionable questions that align with the survey's objectives. Mix different question types, including closed-ended (multiple-choice, rating scales) and open-ended questions.
Avoid PHI in Questions
Avoid asking questions that directly solicit PHI from patients as far as possible. Keep questions focused on patient experiences, satisfaction, and feedback related to care and services.
Obtain patient consent
Before sending the survey, obtain written consent from each patient, explicitly stating that they agree to participate in the survey and understand that their responses may include PHI. Make sure the consent form includes details about how their information will be used, stored, and protected.
Anonymize and de-identify data
Remove any identifiable information from the survey responses if possible. If the survey does contain questions that could lead to the identification of individuals (e.g., specific medical details), ensure that the data is appropriately de-identified or anonymized before storage or analysis.
Use secure transmission methods
When sending patients the survey link or email, use secure and encrypted methods. Avoid sending PHI through standard email, as it may not be adequately protected. Instead, opt for secure methods like HIPAA compliant email software or a HIPAA compliant marketing platform.
Set expiration or access limits
Limit the timeframe during which patients can complete the survey or set access limits for the survey link. This helps prevent unauthorized access to the survey after the data collection period is over.
Creating engaging questions
- Use simple language
- Start with general questions before getting specific
- Use positive language
- Avoid leading or biased questions
- Ask about intentions, such as whether the patient would recommend your practice or if they would return.
Challenges associated with receiving feedback for patient surveys
If patient surveys are not appropriately designed and managed, there is a risk of inadvertently collecting or sharing individually identifiable information, which could lead to the breach of patient privacy and potential legal and financial consequences for healthcare organizations.
If the survey platform or hosting environment is not adequately secured, it may be vulnerable to data breaches, hacking, or unauthorized access, resulting in the exposure of sensitive patient data.
Moreover, patients may receive multiple surveys from various sources, including healthcare providers, leading to survey fatigue. This can reduce motivation to participate and contribute to lower response rates.
Related: Guidelines for HIPAA compliant documentation and record retention
Kirsten Peremore
