Gather records for a compliance review

When a reviewer or auditor asks who has access to patient messages and for copies of your records, you can gather most of it from BloomText in one sitting. This guide walks through each record and where to find it.

Before you start

• You need to be an organization admin.
• Decide where you'll keep the exports. They contain patient information, so save them only where your practice keeps protected records.

Check who has access

1. Click Settings, the gear at the bottom of the left bar.
2. Click Organizations, then your practice. Admins land on the Members tab, your current list of people with access.
3. Remove anyone who has left. See Change a member's role or title, or remove them.

Export the member list

1. On the Members tab, click the download icon at the right end of the toolbar.
2. Click Export. The CSV lists everyone who has ever been a member, and when they were invited, approved and removed.

Require SMS verification at login

1. Open the Details tab.
2. Turn on Require SMS verification at login. Every member then confirms a texted code when they log in on a new device.

See Turn on two-factor login.

Export SMS logs

1. In the left bar, click Directory.
2. Click the Teams tab.
3. Click the team that owns your business number.
4. Click Export SMS logs.
5. Pick the From and To dates. The From date can be up to 180 days back.
6. Click Export. The file of every message on that number downloads when it's ready.

Repeat for each team that has a number. To export one patient's chat as a PDF, see Export messages and records.

Review blocked numbers

1. On the same team page, open the Block List tab.
2. Check which numbers are blocked, and the Reason for each.

See Block a phone number.

Add your Business Associate Agreement

Keep a copy of your signed Business Associate Agreement with the exports. See Business Associate Agreement.

Audit checklist

Before a HIPAA audit or a payer audit, check you have:

• The exported member list.
• A note that Require SMS verification at login is on.
• An SMS log export for each team number.
• Your review of each team's block list.
• Your signed Business Associate Agreement.

Good to know

• BloomText keeps no in-app audit log or retention setting, so keep these exports together in one place.
• Export SMS logs on a regular schedule, so you have records older than 180 days when a review covers a longer period.
• For any record you can't find here, email support@bloomtext.com. Don't include patient details in the email.

Related

• Export messages and records
• Turn on two-factor login
• Block a phone number
• Business Associate Agreement
• Change a member's role or title, or remove them