WhatsApp is an instant messaging application created in 2009 and acquired by the Facebook family of companies in 2014. Mainly used with mobile devices, it also runs on desktop computers. Although asynchronous as e-mail, most users perceive WhatsApp as a synchronous communication tool.
The WhatsApp installation involves the transmission of the contacts list on Facebook Servers and it is possible to select manually the storage of messages. Communication through end-to-end encryption allows the maintainance of data confidentiality because only the sender and the receiver can decipher the message.
Physicians frequently use WhatsApp to communicate with peers. The clinical utility of this communication tool is now emerging, especially in acute settings [1, 2]. Other more general benefits are reported: communication improvement and streamline workflows, reduction of phone tags, decreased consultation time, promotion of a collaborative environment to improve the level of healthcare provided to patients [3].
As far as the European Community is concerned, the use of WhatsApp must comply with the General Data Protection Regulation (GDPR), which came into force in May 2018, a complex set of rules that allows EU citizens greater control over personal data.
The GDPR does not allow the storage of sensitive data of EU citizens on servers located outside the geographic area of the European Community. Furthermore, faced with a request for access to personal data (Subject Access Request—SAR), organizations are obliged to provide information and to correct or delete it. It is therefore mandatory that hospitals and healthcare centers know where and how the data are stored [4].
The GDPR rules apply to all EU countries without the intervention of national parliaments and they are mainly directed at organizations, which can suffer fines of up to €20 million or 4% of annual turnover. This will encourage hospitals and health organizations to closely monitor their employees so that GDPR rules are respected.
Since the installation of WhatsApp uploads contacts list and storages messages on servers outside the EU area, Facebook is not able to meet the rules of the GDPR and it is therefore inappropriate to share clinical information via WhatsApp [5].
The same considerations also apply to other apps, such as online calendars, Dropbox and Google Drive, which store data in servers worldwide, making it extremely difficult to comply with the GDPR rules and to respond to SARs.
Obviously, these issues are known by the massive organizations that manage Internet services. WhatsApp has recently tried to tackle the problem by interrupting data sharing for EU users, but has failed to find a longer term solution that allows data sharing in line with the GDPR rules [4].
With regard to the United States, patients' right to data confidentiality is governed by the Health Insurance Portability and Accoutability Act (HIPAA). According to this law, no communication platform completely complies with its rules as this does not depend on how the software is made, but rather on how it is managed by users [6].
The lack of access control with an account, other than the one on the device, is the first obstacle to the use of WhatsApp for keeping patient data confidential. Any person who uses a smartphone can read WhatsApp messages and, if the screen is not locked, can see notifications to messages.
The possibility of deleting messages received and the inability of WhatsApp to keep a record of those sent is contrary to the HIPAA rules as it prevents the possibility of any audit. Furthermore, the replacement of the smartphone determines the impossibility to recover the messages, unless they have been backed up. Finally, if the employee leaves the organization, complete deletion of sensitive data is required. This can be complex and it cannot be performed remotely. The best solution would be to delete the account, an action that the user would probably reject [6].
Given the non compliance of WhatsApp with GDPR and HIPAA, its use puts the physician at risk to make errors in the management of patient data. Some suggestions that can be useful to use WhatsApp in an appropriate way to avoid regulatory investigation for not having taken the necessary steps to keep patient confidentiality are discussed below [7].
Firstly, when sending a message one of the most important precautions is always to make sure that the recipient is the right person. This is particularly true when there is a long list of contacts and there is no different group between contacts linked to the exercise of the profession and the ones that belongs to family and friends.
Secondly, when communicating it is good practice to avoid entering information that could lead to the recognition of the patient such as his name and surname, an identifier, the date of birth or home location. Sometimes a vague phrase like "the patient with autoimmune disease we saw yesterday morning" may suffice to break this rule. To this it should be added that the attempt to anonymize clinical images acquired via smartphone through editing and clipping, it may not be sufficient for the presence of accompanying metadata such as date, time, geographical coordinates together with the model of the mobile device [8].
The limitations of WhatsApp force us to explore alternative software that can be used in the healthcare environment.