A dermatology practice moves two kinds of sensitive information all day: clinical photos and pathology results. Both are protected health information the moment they are tied to a patient. Staff chat can carry the handoffs around them, but only in a tool that signs a Business Associate Agreement, with a private channel for results and a firm rule that photos never pass through a personal phone's text app.
Start with the photos
Dermatology is the specialty where staff are most tempted to text a picture. A medical assistant (MA) photographs a lesion, the physician assistant (PA) wants the dermatologist's opinion before the patient leaves, and the quickest path is the camera app and iMessage. That path leaves a copy in the MA's camera roll, another in a cloud backup, and a third in a message thread the practice cannot see or delete.
A clinical photo tied to a patient's name or chart number is PHI, protected health information: anything that identifies a patient and relates to their care. A full-face photo is PHI even with no name attached, because the face identifies the person. The rule should be simple: the photo of record goes into the chart through the EHR, and a quick 'look at this' happens inside the BAA-covered chat, never in a personal text.
Two sides of one practice
Most small dermatology practices have a medical side and a cosmetic side under one roof. The medical side is the dermatologist, a PA or nurse practitioner, two or three MAs, a front desk, and someone who handles prior authorizations for biologics. The cosmetic side is an aesthetician or laser nurse and a cosmetic coordinator who quotes packages. The same people cross between them, and the front desk serves both. The cosmetic side feels less clinical, so staff treat its messages more casually. They should not: a before-and-after photo of a filler patient is as much PHI as a biopsy result.
Daily handoffs that run through chat
- Pathology arrives. Monday's biopsy reports come back, and the MA flags which ones the dermatologist must review today and which patients need a callback.
- Second opinion in the hallway. The PA wants the dermatologist to glance at a lesion before deciding on a biopsy, and the dermatologist is in a procedure room.
- Prior auth for a biologic. The authorization coordinator needs the diagnosis code and the list of failed treatments before the payer will approve.
- Cosmetic scheduling. The laser room is booked twice at 2, the numbing cream has to go on 30 minutes early, and the coordinator wants to confirm a package balance.
- A post-procedure call. A patient phones about swelling after a treatment, and the front desk needs the provider's guidance within minutes.
Where the HIPAA lines fall
Your practice is a covered entity: it bills insurance electronically, so the HIPAA Privacy and Security Rules apply to it directly. Any vendor that stores your messages or photos is a business associate and must sign a Business Associate Agreement (BAA), the contract that obliges it to protect PHI under HIPAA, before it touches a single message (45 CFR 164.502(e)). Consumer apps will not sign one. That is the whole reason WhatsApp, iMessage and Facebook Messenger are off the table, however convenient.
Inside the covered tool, share the minimum necessary. 'Path is back for three of Monday's patients, two need calls today' can sit in a channel the whole clinical team sees. The names and results belong in a smaller private channel, or in a thread with only the provider and the MA who will call.
A channel map for a 6 to 15 person practice
| Channel | Who is in it | What goes there |
|---|---|---|
| #medical-clinic | Dermatologist, PA, MAs, front desk | Room flow, supplies in rooms, patient-ready notices |
| #pathology (private) | Providers and the MAs who call patients | Results to review, callbacks owed, follow-up biopsies |
| #cosmetic | Aesthetician, laser nurse, coordinator, front desk | Laser room schedule, numbing times, product stock |
| #prior-auth (private) | Authorization coordinator, providers | Biologic approvals, denials, appeals |
| #front-desk | Front desk, office manager | Arrivals, cancellations, forms, payment questions |
| #inventory | Everyone | Cryo, sutures, cosmetic products, no patient details |
| #owners-private | Dermatologist, office manager | Hiring, vendors, payer contracts |
Mistakes dermatology teams make
- Lesion photos texted from an MA's personal phone to the dermatologist's personal phone. No BAA, copies everywhere, nothing the practice can audit or delete.
- A WhatsApp group for the cosmetic team where before-and-after photos get shared for 'training' and then stay on a departed employee's phone.
- A Facebook Messenger chat between front desk staff that drifts from lunch orders to 'the 3pm Mohs consult is here'.
- Pathology results read into a group text so the provider can respond from home.
Every one of these is a workflow shortcut. Replace the workflow, not the people. If a phone with any of these threads is ever lost, our guide on a lost staff phone covers the first hour.
Setting it up
- The office manager creates the workspace and invites each person by work email. It is invite-only, so nobody joins by forwarding a link.
- Create the channels above. #pathology, #prior-auth and #owners-private are private.
- Providers are managers of #pathology; the two MAs who make callbacks are members; nobody else is in it.
- Turn on passkeys, and remind everyone the app locks after 15 minutes idle, which covers a phone left in a procedure room.
- Post the photo rule in the topic of #medical-clinic and #cosmetic: photos go to the chart, quick looks go in a thread here, never a personal text.
- Pick a date, retire the WhatsApp and Messenger groups, and have the owner leave last.
With Yodl the practice pays $10 a month for the location, which includes five users, 20 GB of file storage (photos preview in the chat and in a files library) and a signed BAA. Each additional person is $2 a month, so a twelve-person practice pays $24. The audit viewer and retention settings sit in the admin panel, which is what you want the day a patient asks who viewed their result.
One honest note on encryption: Yodl, like Slack and Microsoft Teams, encrypts data in transit and at rest but is not end-to-end encrypted, on purpose, so that search, retention, legal hold and the audit log work. If you want to stop texting photos this month, Yodl is $10 a month for five people, with the signed BAA on every plan.
In dermatology the dangerous messages are the photos and the pathology results. Keep both out of personal text apps, give them private channels inside a BAA-covered tool, and put the rule in the channel topic so new MAs learn it on day one.
Frequently asked questions
Can an MA send a lesion photo to the dermatologist in team chat?
Yes, inside a tool that has signed a BAA, in a private channel or thread with only the people who need it, and only as a quick look. The photo of record still goes into the chart.
Is a photo PHI if it shows no face and no name?
If it is connected to a patient by a caption, a chart number or the thread it sits in, it is PHI. A face alone makes it PHI even with nothing else attached.
Does the cosmetic side have to follow the same rules?
Yes. The practice is one covered entity. Cosmetic photos, consult notes and package balances are PHI just like medical records.
Where should biopsy results be discussed?
In a private channel limited to providers and the staff who make callbacks, with the minimum detail needed. The result itself is documented and given to the patient through the practice's normal process.