Epic Secure Chat: Compliance, Monitoring, and IT Guide

Posted in EPIC

Epic Secure Chat lets healthcare staff exchange messages within Epic and link conversations to a patient. It runs on the desktop client and on Epic’s mobile apps; supports one-to-one and group conversations, and a message can be attached to a patient so the recipient opens the chart from the conversation. Houston Methodist reported more than 135,000 messages exchanged within months of switching the tool on in May 2020, after nearly 12,000 in the first week alone. Staff starts using Epic Secure Chat before anyone has decided how long messages live, whether they count as part of the medical record, who can review them, and what the organization will tell a court if a conversation is subpoenaed. This guide covers those decisions using CMS guidance, the HIPAA Security and Privacy Rules, Epic’s own quick-start documentation, and the published Secure Chat policies of health systems that run it. It does not cover connecting Secure Chat to outside systems.

What Is Epic Secure Chat

Epic Secure Chat is a secure messaging tool for communication between authorized Epic users. It is meant for messages between healthcare staff, such as doctors and nurses. Patients usually contact their care team through a separate tool, such as MyChart. 

Staff can send individual or group messages, associate a conversation with a patient, and share images through supported features. Each organization decides which staff members can message one another. 

It is available through Epic’s desktop environment and supported mobile apps. A patient-linked conversation provides detailed context for the discussion, but that does not automatically turn the conversation into a clinical note or order. 

Epic Secure Chat: User Access

Your organization decides which staff groups receive Epic Secure Chat access. Clinical teams may need it for care discussions, while selected support teams may need it for tasks connected to patient care.

Before granting access, identify what each role needs to communicate and who should receive those messages. A broad rollout still needs clear boundaries around patient information.

Include access changes in your existing staff management process. Review permissions when employees change roles, leave the organization, or no longer need the tool. Give non-clinical users training that matches their responsibilities, rather than assuming clinical training covers everyone.

Epic Secure Chat: Desktop and Mobile Clients

Staff can access Secure Chat through Epic on a desktop or through supported mobile apps, including Haiku, Canto, and Rover where enabled. 

The available options depend on the user’s role and the organization’s setup. Before launch, test how messages and alerts behave in the situations staff will actually encounter:

• Messages sent while a recipient is logged out.
• Desktop sessions that lock or time out.
• Mobile devices with notifications disabled or connectivity interrupted.
• Staff who rely entirely on a workstation and do not use an approved mobile app.

A message arriving in the system does not prove that the recipient has seen it. Staff who spend much of their shift away from a workstation need a communication arrangement that suits their role.

Avoid copying another hospital’s timeout values into your own guidance. Check the settings in your installation and explain when staff can expect alerts. For more on Epic’s mobile tools, see our Epic Canto vs Haiku guide.

Epic Secure Chat: Notifications and Availability Settings

Availability settings let users indicate whether they can respond. Supported options include:

• Available
• Busy
• Unavailable – with an end time

Auto-forwarding can direct incoming messages to another user during an absence. These settings need clear instructions. 

Staff should know whether changing their status also changes notifications in your installation and what happens when a forwarding period ends. Do not assume that an availability label blocks incoming messages.

For coverage arrangements, confirm who will receive messages and whether that person is authorized to access the information involved. Ask staff to check forwarding details before leave and when returning to work. Treat notification preferences and message retention as separate issues.

Epic Secure Chat: Approved and Prohibited Uses

Routine care discussions

Use Secure Chat for approved updates and questions that can wait for the recipient to respond.

Emergencies

Use the established emergency response process for situations such as a suspected stroke, cardiac arrest, or rapidly worsening condition.

Time-sensitive information

Follow the approved process for critical results and urgent requests. Sending a chat alone should not replace a required call, acknowledgment, or escalation.

Clinical documentation

Record relevant assessments, decisions, and treatment details in the appropriate part of the medical record.

Recipient availability

Confirm that the intended colleague or coverage team uses the channel and is responsible for responding.

Unrelated messages

Keep personal and administrative discussions in the channels your organization assigns to them.

CMS Texting Rules of Epic Secure Chat

CMS permits hospitals and critical access hospitals to text patient information and orders between care team members through a HIPAA-compliant secure texting platform, provided they also meet the applicable Conditions of Participation. 

These are the requirements facilities must meet to participate in Medicare and Medicaid.

The February 8, 2024 CMS memo changed the earlier position on texting orders. Computerized provider order entry, or CPOE, remains the preferred method.

The guidance does not automatically approve every Secure Chat installation for orders. Organizations must meet requirements for security, encryption, author identification, and medical records. CMS also expects routine assessment of the texting system’s security and integrity.

Policies should state whether staff may send orders through Epic Secure Chat. If permitted, define how those orders will be properly recorded and authenticated. If not, state clearly; the staff should follow the organization’s approved process rather than interpret the CMS memo as permission to start texting orders themselves.

Message Retention and Deletion in Secure Chat

Not every Epic organization retains Secure Chat messages for the same period. 

• Houston Methodist: Its April 2020 policy described automatic message deletion after 30 days.
• User deletion: The same policy stated that users could not delete messages they had sent. Your team should verify the controls available in your current setup.

Ask your Epic team to document the difference between visible chat history, stored message content, and audit records. Confirm how each is retained and who can retrieve it.

Care information that needs to remain in the medical record should be documented through the approved process. A short chat retention period makes that responsibility especially important. Legal and records teams should approve retention decisions against applicable requirements and preservation needs.

Legal Record Status

Whether your organization includes Epic Secure Chat messages in its legal medical record is a records-management decision that must account for applicable law. It should be documented clearly and reviewed with the health information management and legal teams.

Messages outside the legal medical record may still be relevant evidence in a dispute. Staff should not treat a chat as private or assume that excluding it from the official record prevents its disclosure through legal proceedings.

Preservation also needs a defined process. Under Federal Rule of Civil Procedure 37(e), losing electronic information that should have been preserved for anticipated or ongoing litigation can have consequences. 

Epic Secure Chat: HIPAA Obligations for IT

Patient information in Epic Secure Chat needs attention to privacy and security just like all other electronic PHI. Relevant responsibilities include the following:

Audit controls:

45 CFR 164.312(b): It requires mechanisms to record and examine activity in systems containing or using electronic protected health information. Confirm which Secure Chat events your installation records, what reports are available, and who may review them. Do not assume that every message action or full conversation is available in an audit report. Our Epic EHR security features guide provides related background.

Workforce training:

45 CFR 164.530(b) requires covered entities to train staff on relevant privacy policies and procedures. Include practical guidance on recipients, patient details, documentation, and reporting mistakes. Explain your organization’s retention and authorized review practices.

Designated record set and patient access:

The HIPAA definition includes medical and billing records and other records used, in whole or in part, to make decisions about individuals. Patients generally have a right to access their information in that set, subject to specific exceptions. A policy excluding chat from the legal medical record does not, by itself, remove HIPAA access rights. Assess how the information is maintained and used.

Governance Decisions Before Rollout

• Scope of use: Explain which conversations belong in Secure Chat, with examples of situations that require another channel.
• Escalation path: Define what staff should do when a message is urgent, unanswered, or sent to someone who is unavailable.
• Retention period: Confirm how long message content and audit records remain available, and establish a process for required preservation.
• Legal record status: Document how messages are handled in the legal medical record and separately assess HIPAA designated record set obligations.
• Order policy: State whether orders are allowed and, if so, define the approved recording and authentication process.
• Recipient verification: Explain how staff should check the right person or team, coverage arrangements, and authorization to receive patient information.
• Audit and training: Identify the available monitoring tools, authorized reviewers, and training required for each staff group.
• Mobile coverage: Identify staff who rely on desktop access and test whether the communication arrangements meet their responsibilities.

Folio3 Digital Health for Epic 

Folio3 Digital Health provides Epic integration services for healthcare organizations and digital health companies. If your team needs to connect an application or exchange data with Epic, our Epic integration services team can help assess the available interfaces and project requirements. Secure Chat configuration, permitted use, and message handling should be coordinated with your organization’s Epic, compliance, and records teams.

Closing Note

Epic Secure Chat needs clear operating rules alongside technical setup. Staff should know when to use it, how to reach someone urgently, and which information must be recorded elsewhere in Epic. Before launch, test message delivery and coverage arrangements, document retention and review procedures, and resolve records-access responsibilities. Revisit those decisions when your Epic configuration or organizational policies change.

Frequently Asked Questions 

Are Epic Secure Chat messages part of the medical record?

No. Epic Secure Chat messages are usually not considered a part of a formal part of a patient’s legal medical record or chart. But they function as an internal communication tool between healthcare providers.

Can Epic Secure Chat messages be used in a lawsuit?

Yes. Relevant messages may be requested in litigation, even if they are outside the legal medical record. Whether they must be disclosed or can be admitted as evidence depends on the applicable rules and circumstances.

Can orders be sent through Epic Secure Chat?

No. It is not permissible to send order requests through epic secure chat. 

Do you need Haiku or Canto to use Secure Chat?

No. Authorized users can use Secure Chat through Epic on a desktop. Mobile access requires a supported, approved app and setup. Staff relying on desktop access should understand when they will receive alerts.

Can you send photos in Epic Secure Chat?

Yes, it is possible to send photos in Epic Secure Chat using Epic mobile applications like Haiku, Canto, or Rover.

About the Author