Does WhatsApp have a place in Irish hospitals?

An student issue analysis for MIS41240 at University College Dublin.

Written by Anthony Murphy, Summer 2019. Dublin.

From diagnosis queries to patient histories, the chat application, WhatsApp, has become the primary means by which doctors communicate and exchange information in Irish hospitals. According to a recent study based in University Hospital Limerick, 97% of physicians transfer and receive sensitive patient information regularly through WhatsApp, with claims that ‘every team…around the country has [a WhatsApp chat]’.

However, as use of WhatsApp has become commonplace in Irish clinical practice, concerns surrounding its appropriateness have been raised by the media, the public and HSE staff. For example, an article by the Medical Independent highlights the risks of sharing confidential and identifying patient information through WhatsApp, well-known to be used by the Neurosurgery Registrar. The journal suggests that an in-house instant messaging service would be more secure.

Accordingly, the Health Service Executive (HSE) has responded to the widespread adoption of WhatsApp for clinical practice, stating that its use by healthcare professionals is a breach of HSE security policy. On closer analysis of this policy, however, explicit instruction regarding WhatsApp, or other non-HSE-based instant messaging applications, is not apparent, as the guidelines largely focus on older communication modes such as pagers and fax machines.

In University Hospital Limerick, 97% of physicians transfer and receive sensitive patient information regularly through WhatsApp

Adherence to policy on use of instant messaging, as vague as it may be, is understandable, if not essential for health services. However, if the HSE’s stance on WhatsApp in clinical practice is rooted in concern for patient confidentiality, one wonders whether the alternative communication practices likely to be used in the absence of WhatsApp have been fully considered? For example, use of a fax machine to transfer patient information poses significant security challenges of its own, where a password is not required to print a fax, and it will be received by whomever happens to be closest to the machine at the time of delivery. Most faxes do not use encryption, either. Further, given that an alternative HSE-developed instant messaging application does not exist, doctors would likely rely on paper-based documentation to communicate. However, a Swedish study suggests that paper-based hospital communication also comes with confidentiality risks, finding that doctors leave confidential patient information unattended in busy hospital areas for long periods, as opposed to in a locked cabinet, or indeed, in an encrypted chat session.

Although there is some ‘talk’ of a purpose-built HSE instant messaging service, which would allow doctors to communicate easily while adhering to data protection and confidentiality obligations, this has scarcely been cited by HSE officials and thus does not appear to be a priority. Moreover, an in-house HSE messaging application may, in fact, have weaker security measures than those offered by WhatsApp. WhatsApp’s encryption is end-to-end, where messages are encrypted for the complete duration of their transit from sender to receiver. The encryption is also based on a combination of Double Rachet encryption, 3-DH Handshake and prekeys, widely considered industry-leading security. This means that while the content is concealed from all third parties (including WhatsApp and its owner, Facebook), it is also authenticated, confirming that it came directly from the listed sender, with an additional assurance that the content is unaltered. The sender can also verify the key of their intended recipient at any time, in addition to ensuring that the relevant keys remain only on the user devices and not on third-party cloud servers, such as those of WhatsApp, Apple, or otherwise.

Granted, it may be argued that the HSE could develop a system with similar security capabilities. However, the HSE’s capacity to build a system with security paralleling that of WhatsApp must be judged in the context of the current government funding and resource allocation management issues in Ireland. Furthermore, as WhatsApp’s library of security protocols is open-source and published, their robustness is continuously in the public eye, unconcealed and thus, open for judgement and improvement by industry experts (long considered best practice, see Baran, 1964). In the case of a HSE purpose-built messenger, it seems unlikely that and HSE-developed app would receive a similar level of attention to that of WhatsApp.

Finally, if ethical practice is the premise for blanket disapproval of WhatsApp in clinical practice, the test ought to be patient safety in equal measure to patient confidentiality. Even if WhatsApp does not facilitate the latter, there is no question that it benefits the former. For example, fast and secure communication with WhatsApp enables doctors to seek crucial support from more senior team members, contributing to more accurate and timely diagnosis. Furthermore, Elanti et al. (2017) analysed the efficiency of using WhatsApp, as against telephone- or pager-based communication methods within an Irish orthopaedic team over 6 months, and estimated total time-savings in this period of 7664 minutes among team members afforded by WhatsApp. Rather than holding the line for minutes and waiting for the appropriate team member to come to the phone (who is then distracted from their caseload), doctors can instead send a swift WhatsApp message, to which a swift reply is likely, and direct their attention more wholly towards the patient.

In conclusion, it is clear that WhatsApp is immensely beneficial to hospital-based doctors in practice, offering greater convenience, efficiency and clinical accuracy. While the HSE’s position that this communication mode is inappropriate for clinical practice may be warranted in the context of current legislation and policy, without offering an alternative the service may inadvertently sacrifice patient safety in favour of dogmatically adhering to a (seemingly outdated) confidentiality protocol. Furthermore, given its robust security offering, which may be difficult to simulate in a messenger built by a poorly funded, government-based institution (the HSE), WhatsApp may stand as the most appropriate communication mode for the Irish health service on all fronts—from patient safety to confidentiality. Finally, instead of denying the already widespread practice of using WhatsApp for clinical purposes and attempting to ‘re-invent the wheel’, perhaps HSE’s focus should be directed to revision of policy and legislation, acknowledging and guiding the use of WhatsApp among healthcare professionals, towards enhancing the health service in a realistic manner, for physicians and patients alike.