An optometry practice has three teams that need each other all day: pretest, the exam lane and optical. Most of what they say to each other is about a specific patient's eyes, prescription or order, which makes it protected health information. A tool that signs a Business Associate Agreement, with a channel for each team and one for lab orders, replaces the texts that carry that information today.
Three rooms, one patient
A patient in an optometry practice passes through three sets of hands in an hour. A pretest technician runs the autorefractor, checks eye pressure and takes retinal images. The optometrist (OD) does the exam and writes the prescription. An optician helps pick frames, takes measurements, places the lab order and later dispenses the glasses. Around them: a front desk that schedules and checks vision plan eligibility, a billing coordinator, sometimes an in-house lab tech who edges lenses, and an office manager. Seven to twelve people, and the handoffs between them never stop.
Messages that move between the rooms
- Pretest to doctor. 'Pressure is 26 in the right eye on the 10:30, want a repeat before you go in?' A reading like that needs the doctor's answer before the patient moves to the lane.
- Doctor to optical. 'The 11:15 needs progressives with prism, make sure the lab gets the full Rx and the fitting height.'
- Lab to optician. 'Job came back with the axis wrong on the left lens, we have to remake, patient was promised Friday.'
- Front desk to everyone. 'Contact lens trial arrived for the Tuesday patient, who calls her?'
- Recalls. The office manager wants the annual exam recall list worked this week, split between two front desk staff.
What is PHI in an optometry message
Protected health information (PHI) is any detail that identifies a patient and relates to their health, care or payment. A name with an eye pressure reading is PHI. A name with a prescription is PHI. An order number is PHI too, because it links to one patient's record. 'The lab is running three days behind' is not PHI, and neither is 'the autorefractor needs calibration'. A time slot with a finding, like 'the 10:30 has a pressure of 26', is on the line and should be treated as PHI.
Your practice is a covered entity under HIPAA if it bills vision or medical plans electronically, so the Privacy and Security Rules apply to the practice itself. Any vendor that stores your staff messages is a business associate and must sign a Business Associate Agreement (BAA), the contract in which it agrees to protect PHI under HIPAA, before it handles a message (45 CFR 164.502(e)). WhatsApp, iMessage, carrier SMS and Facebook Messenger do not sign one.
A channel map for a 7 to 12 person practice
| Channel | Who is in it | What goes there |
|---|---|---|
| #pretest-and-lane | Technicians, doctor | Readings that need a decision, repeat tests, images ready, room status |
| #optical | Opticians, doctor, front desk | Rx questions, fitting measurements, frame holds, adjustments |
| #lab-orders (private) | Opticians, lab tech, office manager | Orders placed, remakes, promised dates, vendor delays |
| #recalls (private) | Front desk, office manager | Recall lists, callbacks done, no-shows to rebook |
| #front-desk | Front desk, office manager | Arrivals, plan eligibility, forms, payments |
| #equipment-and-supplies | Everyone | Calibration, contact lens stock, cleaning supplies, no patient details |
| #owners-private | Doctor, office manager | Hiring, vendor contracts, marketing |
Mistakes optometry practices make
- 'Your glasses are ready' texts to patients from a staff member's personal phone, and the same phone used to tell the optician 'Mrs. L is coming at 4'. Patient texting belongs in a patient-facing tool; staff coordination belongs in a BAA-covered chat; a personal phone is neither.
- A WhatsApp group for the optical team with photos of lab invoices and order slips, which carry names and prescriptions. WhatsApp signs no BAA, and an optician who leaves keeps everything.
- Facebook Messenger between front desk staff for lunch and schedules, which absorbs the recall list.
- Retinal images or pressure readings photographed off the screen and texted to the doctor on her day off.
Each of these replaces a two-minute walk with a ten-second text. The right tool keeps the ten seconds and removes the risk.
Setting it up in an afternoon
- The office manager creates the workspace and invites each person by work email. Invite-only means a departed optician cannot linger.
- Create the channels above. #lab-orders, #recalls and #owners-private are private; the rest are open to the team.
- Opticians are managers of #optical and #lab-orders; technicians are members of #pretest-and-lane; the doctor is a member everywhere and the manager of #pretest-and-lane.
- Turn on passkeys so the pretest room computer and the front desk tablet sign in with Face ID or Touch ID, and remind everyone of the 15-minute lock.
- Post the order rule in the #lab-orders topic: order numbers and names stay here, patient calls happen from the practice phone, never from a personal cell.
- Set the date the WhatsApp group ends and delete it that day.
Yodl's Team plan is $10 a month per location, with five users, 20 GB of file storage and a signed BAA, and each extra person is $2 a month, so a nine-person practice pays $18. Lab order slips and invoice photos can be shared in a channel with preview and download, and the files library keeps them findable. A second location is another $10 with five more users.
What the tool should give the owner
Beyond the BAA, the owner wants an audit viewer with export, retention settings and a legal hold for the day a patient dispute or a vision plan audit asks who handled an order, plus push notifications that never show a name on a lock screen. Yodl provides those. Like Slack and Microsoft Teams it encrypts data in transit and at rest rather than end-to-end, which is what lets search, retention and the audit log work.
To get order status off personal phones, Yodl is $10 a month for five people, with the signed BAA on every plan.
In optometry the risky messages are the ordinary ones: a name and an order, a time slot and a pressure reading. Put each team's channel inside a BAA-covered tool and keep patient calls on the practice phone.
Frequently asked questions
Is an optometry practice a covered entity?
If it bills vision or medical insurance electronically, yes. The HIPAA Privacy and Security Rules apply to the practice directly, and every vendor that handles PHI must sign a BAA.
Is a lab order number PHI?
Treat it as PHI. It links to one patient's prescription and record, so keep it inside the covered tool like a name.
Can we text patients that their glasses are ready?
Not from a staff member's personal phone. Use a patient-facing tool that signs a BAA and gets the patient's consent for texting. Staff chat is for staff only.
Does an in-house lab tech need to be in the chat?
Yes, as a member of #lab-orders and #equipment-and-supplies. That is where remakes and promised dates get resolved without a walk to the lab.