HIPAA-Compliant Texting: What Clinics Need to Know

Patients want texts. They answer them faster than voicemail, they rarely log into portals for simple updates and many would rather reply “C” than call your front desk. Staff want texts too, because they are quick and familiar. The question every clinic manager eventually asks is the same: is this allowed under HIPAA?

The short answer is yes, with conditions. HIPAA does not name texting as forbidden, but it does require you to protect patient information and to use vendors that agree to protect it too. This guide explains business associate agreements (BAAs), patient consent and preferences, what can and cannot go in a text, and how to set up a texting policy your team will follow.

This is general information, not legal advice. Talk to your compliance officer or a health care attorney about your specific situation.

Does HIPAA allow texting patients?

HIPAA’s Privacy Rule lets health care providers communicate with patients electronically as long as they apply reasonable safeguards. HHS guidance on email, which is commonly applied to texting by analogy, says the Privacy Rule does not prohibit unencrypted messages for treatment-related communications, but providers should take precautions such as checking the recipient’s address or number and limiting the information sent.

The Security Rule adds technical requirements for electronic protected health information (ePHI): access controls, audit controls, integrity protections and transmission security. Under the current rule, encryption is an “addressable” specification, which means you must implement it when reasonable and appropriate, or document why an alternative is equivalent.

That may change. In January 2025, HHS proposed a major update to the Security Rule that would make encryption of ePHI at rest and in transit mandatory, with limited exceptions. As of October 2026 it has not been finalized, so the current rule still applies. Plan as if encryption will be expected, because it already is best practice.

Key takeaway: HIPAA does not ask “Did you text?” It asks “Did you protect the information, use a vendor bound by a BAA and send only what was necessary?” Build your texting program around those 3 questions.

Standard SMS vs. secure messaging

Not all “texting” is the same. Most clinics use some mix of these options.

The common pattern is a hybrid: SMS for simple reminders and confirmations, and a “you have a new secure message” text that sends patients to a portal for anything sensitive.

Business associate agreements: the vendor rule

Any vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate under HIPAA, and you need a signed BAA before using it with patient information. A texting platform that stores message history, contact lists or appointment details for you is in that group.

HHS describes a narrow “conduit” exception for services that only transmit information and store it temporarily as part of transmission, such as the postal service or a phone carrier with transient access. HHS has made clear that a vendor that stores ePHI is a business associate even if it never views the data. Most texting platforms keep message logs, so do not assume the conduit exception applies.

A solid BAA should:

• Limit how the vendor can use and disclose patient information
• Require the vendor to apply Security Rule safeguards
• Require the vendor to report breaches and security incidents to you
• Flow the same obligations down to the vendor’s subcontractors
• Explain how data is returned or destroyed when the contract ends

Consumer apps that will not sign a BAA, including many free messaging apps, should not be used for patient information, no matter how convenient. If you are building or buying software, our guide to HIPAA compliance for software covers vendor obligations in more detail.

Patient consent and preferences

HIPAA itself does not require written authorization to send treatment-related texts, and HHS treats appointment reminders as part of treatment. But 3 related rules shape how you text patients.

Patients can choose how they hear from you. Patients may request confidential communications, such as asking you to text a different number or not to text at all, and you must accommodate reasonable requests.

Patients can choose unencrypted delivery for their own records. Under the HIPAA right of access, HHS says a patient may ask to receive copies of their health information by an unsecure method such as unencrypted email. You must briefly warn them about the risk and confirm they still want it. If they do, you must comply, and you are generally not responsible for interception in transit. You cannot force patients to accept an unsecure method.

Other laws apply to automated texts. The Telephone Consumer Protection Act (TCPA) covers automated texts to cell phones. The FCC’s health care exemption allows certain treatment messages, such as appointment reminders and prescription notifications, under conditions including frequency limits and easy opt-out. Billing and marketing texts fall outside that exemption. Our guide on reducing patient no-shows with text reminders covers the TCPA rules for reminders.

Good practice: At intake, ask patients whether you may text them, which number to use and what kinds of messages they want. Record the answer in your EHR and honor changes quickly.

What can and cannot go in a text

Because standard SMS can appear on lock screens and is not encrypted end to end, use the minimum necessary information. When in doubt, send a link to the portal instead.

Some types of information carry extra protection. Substance use disorder treatment records covered by 42 CFR Part 2, for example, have stricter rules. Keep this kind of information out of texts entirely.

Texting between staff and clinicians

Internal texting has its own risks: staff use personal phones, messages linger on devices after people leave and texts about patients rarely make it into the medical record.

For hospitals and critical access hospitals, CMS issued updated guidance (QSO-24-05) on February 8, 2024. It allows texting patient information and patient orders among care team members when a HIPAA-compliant secure texting platform is used and Medicare Conditions of Participation are met, while computerized provider order entry remains the preferred way to enter orders. Smaller clinics are not bound by that memo, but its expectations are a useful benchmark: secure, encrypted systems that verify who sent each message and feed into the record.

Set clear internal rules:

• Use only the approved clinical messaging app for anything about a patient.
• Require device passcodes and multi-factor authentication.
• Turn off message previews on lock screens.
• Copy clinically relevant messages into the patient’s chart.
• Remove access immediately when someone leaves; see our employee offboarding IT security checklist.

Where to start: a 7-step texting setup

1. Inventory current texting. Find out who texts patients or colleagues today, from which phones and apps. You will likely find personal devices in use.
2. Pick a platform that signs a BAA. Many EHRs and patient engagement tools include texting. Confirm encryption, access controls, audit logs and data retention.
3. Write a texting policy. Define approved tools, allowed content, response times and who monitors replies.
4. Update intake forms to capture texting preferences and numbers, and record them in your EHR.
5. Create message templates for reminders, confirmations, closures and portal notifications that contain only the minimum information.
6. Train staff on the policy, with real examples of what not to text. Our guide to security awareness training has ideas for keeping it practical.
7. Audit quarterly. Spot-check messages, review access lists and confirm opt-outs are honored.

If a text goes to the wrong number or a phone with patient messages is lost, treat it as a potential breach and follow your incident response process. Our guide on what to do after a data breach outlines the first steps.

Conclusion

HIPAA-compliant texting is less about a specific app and more about a set of habits: use vendors that sign a BAA, encrypt and control access, respect patient preferences and keep sensitive details out of standard SMS. Get those right, and texting becomes one of the most efficient tools your clinic has. When you evaluate a new EHR, put secure texting on the list; our guide on how to choose an EHR for a small practice shows what else to check.

Sources

• HHS: Does HIPAA permit health care providers to use email to discuss health issues with patients? — reasonable safeguards for electronic patient communication
• HHS: Right to receive PHI by unsecure methods — warning requirement and patient choice of unencrypted delivery
• HHS: Guidance on HIPAA and cloud computing — conduit exception and vendors that store ePHI as business associates
• HHS: Business associates — when a BAA is required and what it must cover
• CMS: Texting of patient information and orders for hospitals and CAHs (QSO-24-05) — secure texting of orders among care teams