Introduction: Can Medical Practices Text Patients Without Violating HIPAA?

A patient calls your medical office to confirm an appointment. Another asks whether the practice has received their test results. A third wants to know when they should arrive for a scheduled visit.

Text messaging can make these interactions easier. Patients can receive timely updates, and administrative teams can manage routine communication without relying entirely on phone calls.

But healthcare communication involves sensitive information.

A message that includes a patient's name, appointment details, treatment information, or other identifiable health-related information may involve protected health information (PHI). The way that information is sent, stored, accessed, and managed matters.

This raises an important question for medical practices:

Can healthcare providers send text messages to patients while complying with HIPAA?

In many circumstances, yes. HIPAA does not categorically prohibit electronic communication with patients. However, providers must apply appropriate safeguards, follow applicable Privacy and Security Rule requirements, and evaluate the communication method based on the information involved and the circumstances.

Choosing a messaging platform is therefore more than a convenience decision. It is part of a broader privacy, security, and vendor-management process.

This guide explains how HIPAA applies to healthcare text messaging, the role of Business Associate Agreements (BAAs), important security safeguards, patient communication considerations, and how medical practices can evaluate a messaging solution.

***Important: ***This article provides general educational information about US healthcare privacy and communications requirements. It is not legal advice or a certification of any software product. Practices should consult qualified privacy, security, and legal professionals about their specific circumstances.

What Is HIPAA-Compliant Text Messaging?

HIPAA-compliant text messaging refers to the use of messaging systems and communication practices that appropriately protect protected health information when healthcare organizations communicate electronically.

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. Its regulations establish requirements concerning the privacy and security of protected health information handled by covered entities and business associates.

In a messaging context, the relevant considerations include:

What patient information is included in a message?
Who can access the message?
How is the information transmitted?
Where is the conversation stored?
Does the messaging vendor handle PHI on behalf of the practice?
Is a Business Associate Agreement required?
What administrative, physical, and technical safeguards are in place?
How are access, retention, and security incidents managed?

A messaging application is not automatically HIPAA-compliant simply because it uses encryption, offers password protection, or is marketed to healthcare providers.

Compliance depends on the full arrangement between the practice, the vendor, the technology, and the people using it.

Does HIPAA Allow Doctors to Text Patients?

Yes. HIPAA does not impose a blanket prohibition on healthcare providers communicating electronically with patients.

HHS explains that the HIPAA Privacy Rule permits healthcare providers to communicate electronically with patients, including through email, when reasonable safeguards are applied.

The provider should take appropriate precautions to protect patient information and consider the nature of the communication.

For example, a practice may need to:

Verify the patient's contact information.
Consider whether the communication method is appropriate.
Limit unnecessary sensitive information in the message.
Respect reasonable requests for alternative communication methods.
Apply relevant Security Rule safeguards when electronic PHI is transmitted.
Follow the practice's documented privacy and security procedures.

HHS also recognizes that patients may request confidential communications through alternative means or at alternative locations when the request is reasonable.

This means that healthcare providers should not treat every patient as having the same communication preferences.

A patient may prefer a phone call rather than a text message, while another may request appointment reminders through a specific communication channel.

The key principle: Electronic communication is not automatically prohibited, but it must be handled responsibly under the applicable HIPAA requirements.

Official guidance: HHS — Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?.

Is Regular SMS Text Messaging HIPAA-Compliant?

This is one of the most important questions medical practices should ask before adopting a patient messaging platform.

The answer is not a simple yes or no.

Traditional SMS is not inherently a secure healthcare messaging environment. Standard SMS may not provide the safeguards, access controls, storage protections, and administrative capabilities a practice needs when handling electronic protected health information (ePHI).

However, the technology label alone does not determine HIPAA compliance.

A healthcare provider must evaluate the actual communication method, information being transmitted, vendor involvement, and applicable safeguards.

For example, consider two different messages.

Example 1: Routine administrative reminder

"Hello, this is a reminder of your upcoming appointment with our office tomorrow. Please contact us if you need assistance."

This message contains limited information and may be appropriate depending on the practice's communication policies, patient preferences, and applicable requirements.

Example 2: Detailed medical information

"Your test results indicate [specific medical finding]. Please follow the treatment instructions discussed with your physician."

This message contains sensitive medical information and requires a more careful assessment of the communication channel and safeguards.

The distinction matters because a message's content can change the privacy and security considerations.

A practice should not assume that every SMS message is appropriate for transmitting PHI simply because the patient has provided a mobile number.

SMS vs. Secure Patient Messaging

Area

Standard SMS

Secure patient messaging

Message delivery

Through mobile carrier messaging infrastructure

Through a platform designed for protected communication

Access controls

Often limited and device-dependent

May support user authentication and role-based access

Message storage

May remain on personal devices and carrier systems

May offer controlled storage and retention

Audit visibility

Often limited

May provide access and activity logs

Sensitive information

Requires careful evaluation

May support safeguards designed for sensitive information

Vendor agreements

Depends on the vendor's role and services

BAA may be required when the vendor handles PHI as a business associate

This is a general comparison, not a guarantee that every product in either category has the same capabilities.

A secure messaging product still needs to be evaluated. Its name or marketing description does not establish compliance.

Understanding PHI and ePHI in Patient Text Messages

Before selecting messaging software, medical practices should understand what information** HIPAA protects.**

Protected health information (PHI) generally refers to individually identifiable health information held or transmitted by a covered entity or business associate, subject to HIPAA's definitions and exclusions.

Examples may include:

Patient names associated with healthcare information
Medical record numbers
Diagnoses and treatment information
Prescription details
Test results
Appointment information connected to identifiable healthcare services
Contact information associated with identifiable health information

When PHI is created, received, maintained, or transmitted electronically, it may constitute electronic protected health information (ePHI).

A patient message does not need to contain a detailed diagnosis to raise privacy concerns. Even a relatively short message can reveal information about an individual's relationship with a healthcare provider.

For example, a message that identifies a patient and a highly sensitive specialty or service could disclose information the patient did not expect others to see.

This is why message content, recipient verification, and communication preferences matter.

What Is a Business Associate Agreement (BAA)?

A Business Associate Agreement is a written agreement between a HIPAA-covered entity and a business associate that establishes permitted and required uses and disclosures of PHI and requires appropriate safeguards.

A business associate may be an organization or individual performing services on behalf of a covered entity that involve creating, receiving, maintaining, or transmitting PHI.

For example, a third-party technology vendor may qualify as a business associate if it handles PHI on behalf of a medical practice through its messaging service.

The precise role depends on the services and relationship—not simply the vendor's industry or product category.

When Is a BAA Required?

A BAA is generally required when a vendor qualifies as a business associate and handles PHI on behalf of a covered entity.

HHS specifically explains that a cloud service provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity may be a business associate.

Importantly, this can apply even when the vendor stores only encrypted ePHI and does not possess the decryption key.

The practice and vendor must assess the relationship and applicable HIPAA obligations.

What Should a BAA Cover?

A BAA should address relevant responsibilities, including:

Permitted uses and disclosures of PHI
Safeguarding PHI
Security Rule obligations
Reporting of applicable security incidents and breaches
Restrictions on unauthorized disclosures
Subcontractor responsibilities
Access to information where required
Return or destruction of PHI when the relationship ends, where feasible

A BAA is not simply a formality to collect from a vendor.

It establishes important responsibilities between the parties and should be consistent with the actual services being provided.

Does a BAA Guarantee HIPAA Compliance?

No.

A signed BAA does not automatically make a technology product compliant.

The covered entity remains responsible for its own HIPAA obligations, including conducting an appropriate risk analysis, establishing policies, managing access, and using the service appropriately.

The vendor also has responsibilities under the applicable HIPAA Rules when it qualifies as a business associate.

Both parties need to understand their responsibilities.

Official reference: HHS — Guidance on HIPAA and Cloud Computing.

Key HIPAA Security Safeguards for Healthcare Messaging

The HIPAA Security Rule establishes administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI.

A medical practice should evaluate its messaging environment across all three areas.

1. Administrative Safeguards

Administrative safeguards focus on the policies, procedures, responsibilities, and workforce practices used to protect ePHI.

For patient messaging, these may include:

Documented communication policies
Workforce privacy and security training
Defined responsibilities for system administration
Risk analysis and risk management
Procedures for managing security incidents
Employee access approval and termination processes
Vendor and business associate management

For example, a practice should establish which employees are permitted to handle patient messages and what types of information they may access.

2. Physical Safeguards

Physical safeguards help protect the systems, devices, and facilities used to access ePHI.

Relevant considerations may include:

Device security
Workstation access
Physical access restrictions
Secure handling of mobile devices
Procedures for lost or stolen devices
Protection of equipment used to access patient information

A messaging platform may be technically secure, but patient information can still be exposed if employees use unsecured devices or leave workstations accessible to unauthorized individuals.

3. Technical Safeguards

Technical safeguards protect ePHI through technology and system-level controls.

Medical practices should evaluate whether their messaging solution supports appropriate capabilities such as:

Access control: Restrict access to authorized users.

Unique user identification: Identify individual users accessing the system.

Authentication: Verify the identity of users attempting to access ePHI.

Audit controls: Record and examine relevant system activity.

Integrity protections: Protect ePHI from improper alteration or destruction.

Transmission security: Protect ePHI while it is transmitted over electronic networks.

Not every feature is implemented in exactly the same way across products. The practice should evaluate the actual controls, contractual responsibilities, and configuration of the service.

Official reference: HHS — Summary of the HIPAA Security Rule.

Essential Features to Evaluate in HIPAA-Compliant Messaging Software

When evaluating healthcare messaging software, medical practices should look beyond basic SMS functionality.

The following capabilities can help support a more controlled communication environment.

1. Appropriate Encryption and Transmission Security

Ask how the platform protects information while it is transmitted and stored.

Questions include:

Is data encrypted in transit?
Is stored information encrypted?
Which encryption controls are used?
Who manages encryption keys?
What happens to stored data when an account is terminated?
How are backups protected?

Encryption is an important safeguard, but it is not a complete HIPAA compliance program.

2. User Authentication and Access Controls

A healthcare messaging platform should be evaluated for its ability to restrict access to authorized individuals.

Consider:

Individual user accounts
Strong authentication
Multi-factor authentication, where available
Role-based permissions
User access reviews
Account deactivation when employees leave
Restrictions on administrative access

Avoid shared employee credentials. Individual user accounts help practices establish accountability and review activity.

3. Audit Logs and Activity Monitoring

A platform may handle sensitive information, so administrators should understand who accessed it and what activity can be reviewed.

Ask whether the system records:

Login activity
User access
Message activity
Administrative changes
Permission changes
Relevant security events

Also confirm how long these records are retained and whether the practice can access them when needed.

4. Secure Message Storage and Retention

A messaging platform should have clear policies for storing, retaining, exporting, and deleting information.

Ask:

Where is information stored?
What retention options are available?
Can access be restricted?
How are backups handled?
What happens when a user account is deleted?
Can information be securely returned or destroyed at contract termination, where feasible?

The practice should also consider whether its communication records need to be incorporated into its official patient record system.

5. Role-Based Team Access

Medical practices often have multiple employees involved in administrative communication.

Not every employee needs access to every patient interaction.

A platform that supports appropriate user permissions can help practices align access with job responsibilities.

For example:

Front-desk employees may manage routine appointment communication.
Practice administrators may oversee communication operations.
Other authorized staff may handle specific administrative workflows.

Access decisions should follow the practice's documented policies and applicable HIPAA requirements.

6. Business Associate Agreement Availability

If the vendor qualifies as a business associate, the practice needs an appropriate BAA before using the service to handle PHI.

Ask the vendor:

Will you sign a BAA?
Which services are covered by the agreement?
Are subcontractors involved?
How are subcontractor responsibilities handled?
What happens if the service relationship ends?
How are security incidents reported?

A vendor should be able to explain its contractual and operational responsibilities clearly.

7. Security Incident and Breach Response

Medical practices should understand how vendors identify, manage, and report security incidents.

Questions include:

How can the practice report a suspected incident?
Who investigates the incident?
How quickly will the vendor notify the practice?
What information is included in an incident report?
How are affected systems and data protected?
What contractual notification timelines apply?

A vendor's incident response process should align with the BAA and applicable legal requirements.

How Medical Practices Can Send Patient Text Messages More Responsibly

Selecting a suitable platform is only one part of the process.

The practice also needs clear communication policies.

Here are practical steps to consider.

Step 1: Identify the Purpose of Each Message

Before sending a message, determine why the practice is contacting the patient.

Common examples include:

Appointment confirmations
Appointment reminders
Administrative updates
General office information
Follow-up instructions
Patient requests for information

The message's purpose affects how it should be handled.

Step 2: Verify Patient Contact Information

An incorrectly entered phone number can result in information being sent to the wrong person.

Establish procedures to verify and update contact details.

Consider confirming patient preferences during registration or when contact information changes.

Step 3: Keep Routine Messages Discreet

Where appropriate, avoid including unnecessary medical details in ordinary notifications.

For example, a general appointment reminder may be more appropriate than a message that reveals a sensitive diagnosis or treatment.

The Privacy Rule's minimum necessary standard generally requires reasonable efforts to limit certain uses and disclosures of PHI to what is needed for the intended purpose, although specific exceptions apply.

Do not confuse this standard with a requirement to remove information necessary for legitimate treatment communications.

Step 4: Respect Patient Communication Preferences

Patients may request reasonable alternative means or locations for confidential communication.

A practice should have a process to document and respect applicable communication preferences.

For example, if a patient requests that appointment reminders be sent through a different channel, staff should know how to update the preference.

Step 5: Use Approved Communication Channels

Create clear policies that identify which systems employees may use for patient communication.

Avoid relying on personal messaging accounts or unapproved applications to handle PHI.

Employees should understand which information can be communicated through each channel and when a more secure method is necessary.

Step 6: Train Employees

Technology cannot replace staff awareness.

Train employees on:

Patient privacy
Secure communication procedures
Recipient verification
Appropriate message content
Access restrictions
Handling patient responses
Reporting suspicious activity
Managing lost or stolen devices

Step 7: Review and Update Communication Policies

Healthcare practices should periodically review their messaging processes.

Changes in technology, vendors, workflows, staffing, and regulatory requirements can introduce new risks.

Document relevant reviews and update policies when necessary.

HIPAA-Compliant Appointment Reminder Text Messages

Appointment reminders are a common reason medical practices adopt patient messaging solutions.

HHS permits healthcare providers to communicate with patients about their healthcare, including appointment reminders, while applying reasonable safeguards to protect privacy.

However, practices should distinguish HIPAA requirements from other communications rules.

Example 1: General Appointment Reminder

"Hello, this is a reminder of your upcoming appointment with [Practice Name]. Please contact our office if you need assistance."

This message keeps the content relatively general.

Example 2: Appointment Confirmation

"Hello, [First Name]. Your appointment with [Practice Name] is scheduled for [Date] at [Time]. Please contact our office if you need to make changes."

The practice should assess the information included, the patient's preferences, and the communication method.

Example 3: Administrative Follow-Up

"Thank you for contacting [Practice Name]. Our office will follow up with you during business hours. If you need immediate medical assistance, please use the appropriate urgent or emergency care service."

This can help set expectations without attempting to provide clinical advice.

These are illustrative templates, not universal legal safe harbors. Practices should review message content and workflows against their own policies and applicable requirements.

HIPAA and TCPA: Why Medical Practices Must Consider Both

HIPAA and the Telephone Consumer Protection Act (TCPA) address different legal issues.

HIPAA concerns the privacy and security of protected health information.

The TCPA and related FCC rules regulate certain calls and text messages, including consent and restrictions on automated communications.

Some healthcare-related messages may qualify for specific FCC exemptions, but those exemptions are limited and subject to conditions.

For example, the healthcare exemption under 47 CFR § 64.1200 includes specified types of messages such as appointment and exam confirmations and reminders, wellness checkups, and certain care-related notifications. It also imposes restrictions on content, frequency, length, and other conditions.

It does not provide blanket permission for marketing messages or all automated healthcare texts.

Practices should review the applicable FCC rules and obtain legal guidance before relying on an exemption.

Reference: 47 CFR § 64.1200 — Delivery Restrictions.

Common HIPAA Text Messaging Mistakes Medical Practices Should Avoid

Even when a practice uses a well-designed communication platform, poor processes can create privacy and security risks.

1. Assuming Encryption Alone Is Enough

Encryption is important, but HIPAA requires a broader set of safeguards.

Risk analysis, access controls, authentication, audit controls, policies, and incident response also matter.

2. Using Consumer Messaging Apps Without Proper Evaluation

A familiar messaging application is not automatically appropriate for handling PHI.

Evaluate the vendor's role, contractual arrangements, safeguards, and intended use before allowing employees to use it for patient information.

Shared accounts make it harder to identify individual user activity and manage access appropriately.

Use individual accounts and establish clear access procedures.

4. Sending Sensitive Details Without Considering the Channel

A message may reveal more information than necessary.

Review message content and use an appropriate communication method for the information being shared.

5. Ignoring Patient Preferences

Patients may request alternative communication methods.

A practice should maintain a process for recording and honoring reasonable confidential communication requests.

6. Failing to Review Third-Party Vendors

A vendor's marketing language should not replace due diligence.

Review BAAs, security documentation, subcontractors, incident response, data retention, and access controls.

7. Treating the Messaging Platform as the Official Medical Record

A messaging platform may retain conversation history, but this does not automatically make it the practice's EHR or official clinical documentation system.

Define which communications must be documented in the patient record and how that documentation is completed.

HIPAA-Compliant Text Messaging Software: Questions to Ask Vendors

Before purchasing a messaging platform, use the following checklist.

Evaluation area

Questions to ask

BAA

Will the vendor sign a BAA when required?

PHI handling

What information does the platform create, receive, maintain, or transmit?

Encryption

How is information protected in transit and at rest?

Access control

Can access be restricted by individual user and role?

Authentication

Does the platform support individual accounts and appropriate authentication?

Audit logs

Can administrators review relevant user and system activity?

Data retention

How is information stored, retained, exported, and deleted?

Incident response

How are security incidents identified and reported?

Subcontractors

Which third parties may handle or access PHI?

Integrations

Does the platform connect to the practice's existing systems?

Patient preferences

Can communication preferences and restrictions be managed?

Support

What support is available for security and operational issues?

Contract termination

What happens to PHI when the service ends?

Do not accept vague answers such as "we are fully secure" or "we are HIPAA-ready."

Ask for relevant documentation and have the practice's privacy or security representative review it.

How Textology Fits Into Healthcare Communication

Textology is a business communication platform designed to help teams manage customer conversations through supported messaging, business calling, and centralized communication workflows.

For medical practices exploring communication solutions, areas worth evaluating include:

Business messaging and two-way conversations
Business calling and call management
Missed-call visibility and follow-up workflows
Shared communication visibility for teams
Available communication automation
Communication activity and reporting

These capabilities may be relevant to administrative communication workflows in a medical practice.

However, Textology should not be represented as a HIPAA-compliant messaging solution unless its current product configuration, contractual arrangements, BAA availability, security safeguards, and intended healthcare use have been formally verified.

Medical practices should not transmit or store PHI through Textology unless the product and contractual arrangements have been reviewed and approved for that purpose.

Before considering any healthcare deployment, confirm:

Whether Textology will enter into an appropriate BAA when required.
Which specific products and services are covered by that agreement.
How PHI is transmitted, stored, accessed, and retained.
Which security and administrative controls are available.
How access permissions and audit activity are managed.
Which sub processors or third-party services may handle the information.
How security incidents and termination of service are handled.

A product demonstration can help evaluate communication workflows, but it should not be treated as a substitute for privacy, security, and legal due diligence.

The objective is to select a communication solution that fits the practice's operational needs without compromising its responsibilities to protect patient information.

Frequently Asked Questions

1. Is text messaging allowed under HIPAA?

HIPAA does not categorically prohibit healthcare providers from communicating electronically with patients. Providers must apply appropriate safeguards, follow applicable Privacy and Security Rule requirements, and consider the information being shared and the communication method.

2. Is regular SMS HIPAA-compliant?

Standard SMS should not automatically be considered suitable for transmitting PHI. Practices should evaluate the actual messaging service, transmission and storage safeguards, vendor role, and intended use before sending sensitive patient information.

3. Can doctors text patients about appointments?

Healthcare providers may communicate with patients about appointments. HHS permits healthcare-related communication when reasonable privacy safeguards are applied. Practices should consider patient preferences, message content, and any applicable TCPA or FCC requirements.

4. Does a healthcare messaging provider need a BAA?

A BAA is generally required when a vendor qualifies as a business associate and creates, receives, maintains, or transmits PHI on behalf of a covered entity. The exact requirement depends on the services and relationship.

5. Does a signed BAA make a messaging platform HIPAA-compliant?

No. A BAA establishes contractual responsibilities, but it does not independently establish that every product, configuration, or practice workflow meets HIPAA requirements. Both the provider and vendor have applicable responsibilities.

6. Is encryption enough for HIPAA compliance?

No. Encryption is an important safeguard, but the HIPAA Security Rule also addresses risk analysis, access control, authentication, audit controls, integrity, transmission security, and other administrative, physical, and technical safeguards.

7. Can a medical office send appointment reminders through SMS?

Healthcare providers can send appropriate appointment reminders, but they should use reasonable safeguards, respect patient communication preferences, and assess the applicable communications rules. Some FCC healthcare exemptions have specific conditions and limitations.

8. Can patients text their doctors first?

Patients may initiate electronic communication with healthcare providers. HHS guidance on electronic communication recognizes that providers may generally assume patient-initiated email communication is acceptable unless the patient states otherwise. Practices should still apply appropriate safeguards and follow their communication policies.

9. What information should medical practices avoid including in ordinary text messages?

Practices should avoid disclosing unnecessary sensitive details, especially when the recipient or communication channel has not been adequately verified. Consider whether a general administrative message or a more secure communication method is appropriate.

10. How do medical practices choose secure patient messaging software?

Evaluate the vendor's BAA arrangements, data handling, encryption, access controls, authentication, audit logs, retention policies, incident response, integrations, and support. Have the practice's privacy and security representatives review the solution before it is used to handle PHI.

Final Thoughts: Secure Patient Communication Starts With the Right Decisions

Text messaging can make communication more convenient for patients and administrative teams. But healthcare organizations must consider more than delivery speed and ease of use.

They need to understand what information is being shared, which vendors handle it, how it is protected, and what responsibilities apply to each party.

A well-designed patient communication process combines appropriate technology with clear policies, employee training, patient preferences, and ongoing security oversight.

For medical practices, the right messaging solution should support communication without creating unnecessary privacy or compliance risks.

Better patient communication starts with responsible technology choices.

Explore Textology's Business Communication Capabilities

Discover how Textology supports business messaging, calling, and centralized communication workflows.

Schedule a Demo | Start Your Free Trial

Healthcare organizations must independently verify product suitability, contractual arrangements, and applicable compliance requirements before transmitting or storing PHI through any platform.

HIPAA-Compliant Text Messaging for Healthcare: What Medical Practices Need to Know