SMS to patients

The SMS gateway of the portal, the patient's consent and number, what the message says, quiet hours and limits, the delivery log, legal notes.

The portal can send a patient the personal ePRO link and the reminders by SMS, from its own name, without the site’s phone. It does so only when two things are in place: the Portal Owner has set up the SMS gateway, and the site has recorded in the patient card that the patient agreed to SMS on a given number. The text names neither the study, nor the disease, nor the patient, and never carries the PIN.

How a message travels

An example from the demo data: the site of the registry REG-DIAB-01 sends a patient the link. The page does not wait for the provider: the message is queued, and a slow or unavailable provider never blocks the site’s work.

Setting up the gateway (for Portal Owners)

Open Administration › SMS. One gateway serves the whole portal:

• Provider: SMS.RU, or “Log only” for development and tests (nothing leaves the server; its log records the masked number and the length). “Off: no SMS” stops all messages at once.
• API key: for SMS.RU the api_id from your account. It is kept encrypted with the server key (PII_KEY) and never shown again: the page says only “set”. The audit trail records that the key changed, never the key itself.
• Sender name: 2 to 11 Latin letters or digits, exactly as registered with the provider. Choose a neutral one, such as the portal’s name: never the disease or the study.
• SMS per day: the limit for the whole portal (300 by default; 0 means no limit). When it is reached, new messages are refused until tomorrow and the page says so.
• Send from … until: the hours in the server’s time zone (TIME_ZONE of the installation). Outside them messages wait for the morning.

At the top: sent today against the limit, waiting, sent and not sent in 7 days. On the right, “Send a test SMS” and “Check the key”. Further down the page are the last messages with the number masked.

Send a test SMS sends a real message to your phone right away, without the queue, so you see the provider’s error at once. With Dry run ticked the provider checks the key, the sender and the number and sends nothing. Check the key asks the provider for the balance. Each check goes to the portal audit with the number masked.

Other providers (for example SMSC, SMS Aero or, outside Russia, Twilio) are connected by a small adapter in app/core/sms.py: sending one message and checking the key. The rest of the portal does not change.

The patient’s consent and number

In the patient card, in the Questionnaires for the patient section, the SMS to the patient block appears once the study has forms filled in by the patient and the function is on. The investigator or the study manager presses Record the consent to SMS, types the mobile number with the country code (in Russia also 8 900… or 900…), the day the patient agreed and the language of the messages (Russian or English), ticks that the patient agreed and saves.

The block in the patient card of the demo registry: the number is masked, below are the date of the consent, who recorded it and the delivery log.

The number is kept encrypted, like the patient’s e-mail, and only for the messages: the team, the log and the audit trail see it masked (+7 900 ***-**-12). A new number replaces the old consent; the old one stays in the history as “Replaced by a new number”. Other roles see the block but do not change it.

What the message says

Three kinds of message, each short enough for one or two SMS:

• Invitation with the link: “Questionnaires from your doctor: https://…/pt/… Enter your PIN to open them.” Before the first sign-in it says to open the link and choose a PIN; after a PIN reset, to enter the code the site gave.
• Reminder: a questionnaire is waiting, with the date until which it can be answered.
• Reminder: the last day.

The link is the patient’s own personal link: it still asks for the PIN, and the PIN is never sent in the same message or in any other SMS. The language is the one chosen with the consent. All texts are in the ePRO screen pack for the ethics committee.

Reminders by SMS come from the same hourly job as the e-mail reminders: when a questionnaire opens and on its last day, at most one SMS per patient per run and at most 3 SMS per patient in 24 hours.

Stopping SMS

Stop SMS in the patient card stops all messages and deletes the number. Choose the reason: the patient asked to stop (STOP), the number is wrong or no longer the patient’s, or other. Stopping works even in a locked study. The patient can also switch SMS off on the questionnaire page after entering the PIN. The delivery log and the audit trail keep the number masked.

Delivery log and audit trail

Under the block, the Delivery log lists each message: when, which, who sent it (or “reminder job”) and the state: queued (with the time it goes), sent, retrying, not sent (with the reason in plain words and the provider’s code), test mode. A temporary error of the provider (no connection, the provider unavailable) is tried again up to 5 times; a wrong number or no money on the account is not retried.

The audit trail of the study records the consent (number masked, date, language, who), each message (the kind, the masked number, who sent it or “ePRO reminders”) and its stop with the reason. The text of the message is never stored after sending: it holds the personal link.

Test, training and demo

In a QA or training environment and in demo studies the portal asks the provider to check every message in test mode and send nothing to the phone. The delivery log marks them “test mode”, so the whole path can be tried without real phones.

Legal notes

• The sender name is registered by the portal’s owner with the SMS provider (the aggregator), which agrees it with the mobile operators. Until it is approved the provider refuses the messages or replaces the name.
• The consent is recorded by the site in the patient card with the date and who recorded it, and the patient knows that SMS stop at any time. Keep the signed form as the study requires; the portal keeps the record and the audit trail.
• WhatsApp, Telegram, Viber and other messengers are deliberately not supported. The patient’s number and the very fact of taking part in a study are personal health data; through a foreign messenger they would leave the country (cross-border transfer under Federal Law 152-FZ). SMS go through a provider of the installation’s country.
• Other countries. Which provider, which number formats and which rules for consent and sender names apply is decided by the installation’s settings (REGION, TIME_ZONE and the provider chosen in Administration › SMS) and by the law of that country.