Guide · HIPAA · Communications

Texting Patients Under HIPAA: Safeguards, Patient Choice, and Vendors

HIPAA does not prohibit texting. It requires deciding what is sent, through which system, and with what safeguards.

By Lincoln Square Law · 9-minute read

Patients expect to hear from their doctor’s office the same way they hear from everyone else, by text. Appointment reminders, refill notices, a quick answer about preparing for a procedure, a photo of a rash sent after hours. HIPAA does not prohibit any of this. It does require the practice to decide, deliberately, what it will send, through which system, to whom, and with what safeguards. Most texting problems come not from the rule itself but from habits that grew up without a decision: staff answering patients from personal phones, a reminder vendor with no business associate agreement, clinical details sent to a shared family number. This guide walks through the rules that apply and the choices a practice should make before it texts.

What the Privacy Rule allows

HHS has answered the basic question directly in its guidance on email, and the same reasoning applies to text messages. The Privacy Rule allows covered health care providers to communicate electronically with patients, provided they apply reasonable safeguards. HHS gives examples: confirming the number or address before sending, sending an alert that a message is coming, and limiting the amount of sensitive information in an unencrypted message. If a patient starts the electronic conversation, the provider may reasonably assume the patient is willing to communicate that way, unless the patient says otherwise.

Reasonable safeguards is a general standard (45 C.F.R. 164.530(c)), and it means that the answer depends on the message. A reminder that says “You have an appointment Tuesday at 10” carries little risk. A message that names a diagnosis, a test result, or a prescription for a sensitive condition carries a great deal more, especially if it lands on a phone that other people can see. The practice should decide in advance which categories of information may go by ordinary text and which must go through a secure channel.

The patient’s right to ask for another channel

A covered health care provider must permit patients to request, and must accommodate reasonable requests, to receive communications by alternative means or at alternative locations (45 C.F.R. 164.522(b)(1)(i)). The provider may require the request in writing and may ask for the alternative number or method, but it may not require the patient to explain why (45 C.F.R. 164.522(b)(2)). A patient who asks not to receive texts at a household number, or who asks for messages only through the portal, is exercising this right.

The practical point is that the preference has to follow the patient through every system that sends messages. A request noted in the chart does no good if the reminder platform still texts the old number. When a practice adds a texting tool, it should confirm that confidential-communication flags in the practice management system carry over to it.

When the Security Rule applies

Once a text message contains electronic PHI, the Security Rule applies to the systems that create, send, and store it. The practice must implement technical security measures to guard against unauthorized access to ePHI transmitted over a network (45 C.F.R. 164.312(e)(1)), and encryption of that transmission is an addressable implementation specification under the current rule (45 C.F.R. 164.312(e)(2)(ii)). Addressable does not mean optional. The practice must assess whether encryption is reasonable and appropriate and, if it chooses not to implement it, document why and what it does instead.

Ordinary SMS messages are not encrypted end to end, and they sit on the patient’s phone and the carrier’s systems. That is acceptable for low-risk content when the patient has chosen texting. It is not a sound channel for clinical detail unless the patient has asked for it after being told the risk. For anything more, a secure messaging platform that sends the patient a notice and a link to a protected message is the better design.

The texting decision belongs in the practice’s risk analysis (45 C.F.R. 164.308(a)(1)(ii)(A)). OCR’s recent enforcement has focused heavily on practices that never completed an accurate and thorough risk analysis, and a texting workflow that was never assessed is the kind of gap that appears in those cases. HHS proposed in January 2025 to make encryption of ePHI in transit a required specification with limited exceptions (90 Fed. Reg. 898). As of this writing that proposal has not been finalized, but a practice choosing a texting platform now should choose one that would satisfy it.

Texting vendors are usually business associates

A reminder service, a patient engagement platform, or a secure messaging app that stores message content on behalf of the practice is a business associate. HHS has explained that the so-called conduit exception is limited to transmission-only services with transient access, such as a telecommunications carrier, and that a vendor with more persistent access to PHI is a business associate even if it cannot read the data because it is encrypted (see 78 Fed. Reg. 5566, 5572 (Jan. 25, 2013), as discussed in HHS’s cloud computing guidance).

The practice must obtain satisfactory assurances, in a written business associate agreement, before the vendor receives PHI (45 C.F.R. 164.502(e), 164.504(e)). Many consumer messaging apps will not sign one, and that fact alone rules them out for patient communications that contain PHI. When reviewing a vendor, ask where messages are stored, for how long, who at the vendor can access them, whether the vendor uses subcontractors, and how quickly it will report a security incident.

Staff phones and internal texting

Texting between clinicians and staff about patients raises the same issues, often more acutely. A physician who texts a nurse about a patient from a personal phone has put PHI on a device the practice does not control. If that phone is lost, the practice may have a reportable breach.

For hospitals and critical access hospitals, CMS addressed this in its memorandum QSO-24-05 (Feb. 8, 2024), which superseded its 2018 guidance. CMS now permits texting patient information and orders among members of the care team if it is done through a HIPAA-compliant secure texting platform and consistent with the Conditions of Participation. CMS states that computerized provider order entry remains the preferred method of order entry, and it expects orders sent by text to be incorporated into the medical record with the date, time, and authentication. The memorandum applies directly to hospitals and critical access hospitals, but its expectations are a useful benchmark for any practice: a secure platform, identification of the author, integration with the record, and periodic review of the system’s security.

Practices that allow personal devices should have a written policy covering which apps may be used, device passcodes and encryption, remote wipe, and what happens when an employee leaves. Device and media controls are a required part of the Security Rule’s physical safeguards (45 C.F.R. 164.310(d)(1)).

Messages that belong in the record

A text exchange that includes clinical advice, a patient’s report of symptoms, or a decision about care is part of the patient’s care history. If it lives only on a phone or in a vendor’s system, the practice may be unable to produce it when the patient requests their records, when another provider needs it, or when the care is questioned later. The practice’s workflow should require clinically meaningful messages to be captured in the chart, whether by integration or by a staff member documenting the exchange.

Other rules that may apply

HIPAA is not the only law that governs patient texting. Automated text messages can fall under the Telephone Consumer Protection Act (47 U.S.C. 227), which has its own consent rules separate from HIPAA’s. A practice that uses an automated platform should confirm with counsel that its consent language and opt-out handling meet that statute as well. Mental health providers in Illinois should also account for the Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110), which is stricter than HIPAA in several respects and applies to the fact that a person is receiving services at all. A reminder that identifies a therapy practice by name can itself disclose protected information.

A texting policy that works

The decisions above fit on a page. A workable policy covers:

• Permitted content for ordinary text, such as appointment date and time, with no diagnosis, test result, or medication for a sensitive condition.
• Secure channel for anything clinical, through a platform covered by a business associate agreement.
• Patient choice, recorded at intake, with a clear way to opt out or choose another channel, and a process that pushes that choice to every messaging system.
• Verification of the number before the first message and when the patient reports a change.
• Approved apps for staff, with personal consumer messaging apps prohibited for PHI.
• Record capture for clinically meaningful exchanges.
• Annual review of the texting workflow as part of the risk analysis.

A practice that makes these choices once, and trains staff on them, can text patients with confidence. The risk lies in texting by default.