As WhatsApp's reach surges and its penetration deepens—even among hard-to-reach older and poorer populations—it is critical for healthcare organizations to gain insight into the pros and cons of its use, as well as its appropriate position within a larger social media strategy. The combining of WhatsApp and Facebook opens up new opportunities for strengthening and evaluating communications with key audiences—but also poses risks that are important to consider when defining WhatsApp's place in a social media program.

It's hard to overstate the popularity of WhatsApp, the Internet-based text and voice call mobile app acquired in 2014 by Facebook for $19 billion. Seven years after its founding, WhatsApp currently boasts 500 million monthly active users, roughly equivalent to a third of Facebook's 1.49 billion monthly active users. WhatsApp currently supports about 100 million voice calls daily. While this volume is only 3% of the roughly 3 billion or so calls made daily in the United States, the company didn't even offer voice services until February 2015.

The WhatsApp platform has many appealing advantages over other communications channels. WhatsApp eschews third-party banner ads, doesn't mine user-generated content, applies layers of security to keep communications within a person's social network private and provides end-to-end encryption to keep messages, voice calls and uploaded files private. Pairing this relatively noncommercial and private channel with Facebook's reach and social marketing analytics opens up new possibilities for the way healthcare organizations devise their social media and consumer engagement strategies.

WhatsApp does not yet support widespread consumer-to-business direct communications. However, recent changes to the WhatsApp Terms of Service and Privacy Policy suggest that it is moving in that direction. In the not too distant future, it may be possible for healthcare organizations to integrate Facebook social marketing with a private connection so consumers can privately schedule an appointment, submit biometric data, receive health coaching or participate in a private group.

Of concern to privacy watchdogs is that WhatsApp will begin integrating its service with Facebook to "improve its services" and unify efforts across all Facebook platforms to fight spam, make product suggestions and show relevant offers and ads on Facebook. None of the changes, which took effect on August 25, 2016 for new WhatsApp users, will result in data mining or sharing of user-generated content from WhatsApp messages, photos or account information. Even so, the Federal Trade Commission (FTC) has apparently signaled its intention to carefully review the revised Terms of Service and Privacy Policy, to determine whether any changes are deceptive or violate a 2011 settlement agreement that Facebook made with the FTC in connection with earlier misuses of personal data.

10 Key Considerations for Healthcare Organizations

While the FTC undertakes this review, healthcare organizations could benefit from developing a better understanding of how WhatsApp operates, and its anticipated role in Facebook's revenue growth.

To determine the role WhatsApp could play in their own social media strategies, here are the top 10 things that forward-thinking healthcare organizations should know about WhatsApp:

1. Scale and Code Stability. A service as big and complex as WhatsApp does not become successful without immense IT, talent and financial resources. Like Amazon, which built the profitable Amazon Web Services as a white-label version of its underlying service platform, Facebook is positioning WhatsApp as an infrastructure-as-a-service business solution for Internet-based direct-to-consumer communications.

2. Security. WhatsApp rankled government officials last spring when it introduced end-to-end encryption to its app, but even before that, the WhatsApp platform was built for privacy. Messages are stored on the device associated with an individual's cell phone number, not on multiple devices. WhatsApp servers delete messages after they are delivered, or if a message has not been delivered within 30 days. Undelivered messages are encrypted with an irreversible one-way hash that makes it nearly impossible to decrypt a message without the recipient's phone. On its face, WhatsApp's focus on privacy may seem counterintuitive to Facebook's core business, except that businesses want to keep their conversations with customers private and, at the same time, use Facebook to prompt consumers to initiate private conversations. For an infrastructure-as-a-service business solution to be successful, Facebook has to keep these communications secure from the prying eyes of its natural language processing algorithms.

3. Identity Authentication. Facebook's growth depends on its continuous vigilance to root out and proactively guard against identity theft. Healthcare organizations are subject to Meaningful Use and the Health Information Portability and Accountability Act (HIPAA) Security Rule to implement identity authentication controls on their patient- or member-facing portals. A disinterested observer might reasonably conclude that Facebook's systems for authenticating a user's identity are sufficiently strong for at least some types of personal health information.

4. Reach. Anyone with a smartphone, cell phone number and Internet connection can use WhatsApp. Some WhatsApp users might even forego cellular data service entirely if they can make phone calls wherever they have Wi-Fi-based access to broadband. Widely available, free broadband access and Wi-Fi may be expected over time. For example, New York City has awarded a 12-year contract for CityBridge to build a free, city-wide Wi-Fi network. For its part, Facebook intends to launch satellites to support free, next-generation (5G) broadband, worldwide. To the extent widespread free broadband becomes a reality, more consumers could switch to WhatsApp as their only voice call and data service carrier. Healthcare organizations should consider a scenario in their social media and digital outreach strategies that has WhatsApp becoming a major telecommunications platform in the future.

5. Insurgent Pricing. WhatsApp is free to end users, adding another significant inducement for consumers to use its platform. WhatsApp's insurgent pricing strategy is the cost of building a two-sided market, paid for by businesses seeking direct-to-consumer access.

6. Access to Traditionally Underserved Demographics. According to Pew Research Center, smartphone adoption by older adults and low-income people continues to rise. Indeed, Pew's surveys suggest that smartphones are often the only (or primary) means for them to gain access to the Internet. Since the cost of broadband and data plans are contributing factors to low adoption by these populations, WhatsApp's free-to-end-user model makes it more enticing for these harder-to-reach populations to adopt the mobile app. Facebook's social marketing tools may be off-limits inside the WhatsApp platform, but they can still be used by healthcare organizations to reach these underserved populations.

7. One Platform, Many Channels. Given its ability to secure text message, voice call, voicemail recordings and file uploads, WhatsApp may be able to offer businesses a single unifying platform for engaging consumers across modalities. This would allow healthcare organizations to streamline the number of digital health tools they need to engage consumers.

8. Banner and Spam-Free. While Facebook's revenue model depends on targeted placement of advertising content in its users' newsfeeds, WhatsApp has always been, and under its new Terms and Privacy Policy remains, free of third-party banners and spam. This policy, not shared by Facebook, may alleviate some concerns of healthcare organizations that they have limited control over the commercial content posted alongside their private digital interactions with consumers.

9. WhatsApp and Facebook Are Not HIPAA Business Associates, Yet. There are downside risks that healthcare organizations need to address with WhatsApp, as they do with evaluating all digital technologies. Facebook has not signaled whether it would sign business associate agreements in its new business venture. It would be difficult for Facebook to avoid becoming a business associate, because it would have to restrict and monitor information transmitted in WhatsApp between healthcare organizations and consumers. Since WhatsApp's central proposition is built on privacy and security, Facebook would have to seek other avenues for it not to be treated as a business associate.

10. Who Should Be in Charge? Another downside risk is that Facebook can change its Terms of Service or Privacy Policy at any time with few legal constraints (the terms of its 2011 settlement agreement being one such constraint). Healthcare organizations need to carefully consider whether they feel comfortable building a consumer engagement program on top of WhatsApp and other Facebook properties, with the possibility that Facebook could unilaterally change its Terms or Privacy Policy. As with the EU Safe Harbor Privacy Policy Framework (since replaced by Privacy Shield), there is precedent for Facebook to enter into agreements that bind it to specified standards and practices. Depending on the degree of support WhatsApp gains among healthcare organizations, developing such a global business associate agreement with healthcare organizations might not be such a bad idea.