Text messaging is one of the most common ways people communicate, so it should come as no surprise that research shows it’s a valuable way for medical care providers to connect with patients.
HIPAA-compliant texting is the use of text messages to communicate with patients while following the HIPAA Privacy and Security Rules, typically through secure, encrypted messaging tools that protect protected health information (PHI). For healthcare providers, medical practices, and staff who text patients, that matters because standard texting is convenient but not built to safeguard patient data or reduce compliance risk.
HIPAA offers patients important privacy protections, but it can also create legal exposure for providers who use one of their patients’ most preferred communication channels without the right safeguards. What providers must remember is that compliant patient texting is possible. It’s simply a matter of understanding the rules for the types of messages they can send, the technology and workflows they need to use, how patient replies should be handled, and how to avoid the penalties and coverage gaps that can follow a violation.
Benefits & Risks of Texting Patients
Research has demonstrated significant benefits of texting patients. Some of the benefits of healthcare texting include:
- Building patient trust through using one of their preferred communication methods
- Developing a simple channel to solicit information about patients’ perspectives and concerns
- Encouraging adherence to patient treatment plans
- Improving patient satisfaction
- Reducing disparities in access to care
- Facilitating fast and efficient communication and collaboration
- Increasing the proportion of adults who use IT to communicate with providers
However, these benefits must be balanced against the risks of compromising healthcare privacy by using an inherently insecure communication channel. Texting, by nature, is not a secure method of communication because:
- Standard text messages are not encrypted in transit or at rest. They can be intercepted when being transmitted and can be easily accessed if a phone is stolen, lost, or unlocked.
- No audit controls are in place. With standard text messages, there is no tracking regarding who read or opened the message or who stored the message data.
- The risk of misdirected transmissions is high. Human error could result in a text being sent to the wrong person, either because the wrong number was provided or because the wrong digit was entered when sending a message.
These risks may make texting feel like an unacceptable communication method for providers who face severe penalties for violating HIPAA data privacy rules.
Is Texting in Healthcare Allowed?
Texting is allowed in healthcare, but significant restrictions apply if the text message contains protected health information (PHI). PHI can include, but is not limited to:
- The patient’s name along with any condition or diagnosis. Examples include “Sam’s heart attack” or “Carol’s diabetes”
- The patient’s identifying information combined with any details about an appointment. Examples include “Lucia’s fertility appointment is at 3 PM” or “Fred’s vasectomy is at 9”
- Photos containing information that can identify a patient. Examples include a unique tattoo, a patient’s face, or even a unique birthmark or wound
- Lab results that can be connected to a patient or a particular time and place
- Patient account numbers
- Patient medical records
- Insurance information
- Any combination of details that could allow a reader of the text to reasonably identify a patient
Texts with PHI can be HIPAA-compliant, provided the communications follow all applicable HIPAA privacy and security requirements under the security and privacy rules outlined in the HIPAA Security Rule and the HIPAA Privacy Rule.
Under these rules:
- Standard SMS and iMessages are not typically considered HIPAA-compliant. When sending PHI, providers should use HIPAA-compliant texting software that encrypts protected health information.
- If a patient texts a provider, the provider may respond but should confirm the patient’s communication preferences or suggest switching to a HIPAA-compliant texting platform.
- The provider should limit the amount of protected health information that is shared.
It is also important to note that HIPAA text messaging rules don’t apply only to messages that providers send to patients. These rules also apply to messages sent between staff members who use text messages to communicate about a patient’s care.
What Are the HIPAA Text Messaging Rules?
HIPAA guidelines for patient messaging can largely be divided into three different categories. HIPAA establishes best practices for putting in place technology, operational, and communication requirements.
Technology Requirements
Under the HIPAA rules, if a text message contains PHI, the following technology requirements are typically recommended or, in some cases, required to help ensure compliance and support maintaining compliance:
- Providers must determine if encryption is reasonable and appropriate after a risk assessment. If a provider chooses not to use encryption, that decision must be documented, and an alternative measure must be used when possible. OCR guidelines almost always conclude encryption is reasonable in these situations, especially when protecting electronic protected health information.
- Users who send or receive text messages must authenticate their identity before being able to send or view messages. This can be done using login credentials, multi-factor authentication tools, or entering a PIN for access.
- Audit trails must be in place to determine who sent a message, when it was sent, and who could read it.
- Devices used to send text messages must be secured. This typically means they must be configured to automatically log off the user after a period of inactivity. Lock screen previews should also be disabled so sensitive information is not exposed in notifications. A mechanism must also be in place to remotely erase sensitive data if the device is lost or stolen.
- When using a HIPAA-compliant communication platform, the covered entity and business associate may need to enter into a legally binding Business Associate Agreement (BAA), which establishes permitted uses and disclosures, defines the vendor’s role in protecting PHI, and requires appropriate security measures from business associates.
Operational Requirements
Healthcare organizations, healthcare systems, providers, and medical practices that use texting as a communication method should also implement administrative safeguards recommended under HIPAA.
- Staff members who text with or about patients must receive formal training on what they can include in text messages, which messaging apps are approved for staff use, and the process for verifying the recipient's phone number before sending a text.
- Periodic risk assessments are required to identify any threats that could compromise the integrity and security of patient data so those threats can be mitigated, helping protect patient information and support ongoing HIPAA-compliant texting capabilities.
- Any providers or staff members who use their personal mobile devices to send or receive patient text messages must confirm that they have put appropriate encryption tools and data safeguards in place.
- Employees must be prohibited from saving or storing PHI on their personal devices.
- If a device used to text patients is stolen or lost, the PHI may need to be deleted remotely after a risk analysis shows the appropriate course of action, helping maintain operational efficiency while protecting patient data.
Communication Requirements
Specific rules and procedures are also recommended for communicating directly with patients digitally, just as there must be rules and procedures for telemedicine. In the broader context of healthcare communication, these safeguards also shape secure text messaging between clinicians, staff, and patients.
Rules for texting may include the following:
- Providers and staff may want to limit the amount of PHI included in text messages when communicating with other providers about a patient. The minimum necessary standard applies for provider-to-provider communications, so when providers or staff members text, they must keep the health information they provide to the absolute minimum necessary for the specific communication to support secure communication and care coordination.
- Providers should accommodate reasonable requests when a patient asks for communications by alternative means, including unencrypted text, but should ideally warn of the risks of complying with the request, and patient consent should be documented before using less secure channels or ongoing patient-facing texting workflows.
- Patients should be provided with an explicit written warning that text messages are not secure. They must be informed of the risks that their data could be exposed, and they must be provided with a way to opt out of receiving provider text messages at any time. Communications about treatment, payment, or healthcare operations differ from marketing messages, which may require separate consent or authorization.
- Under FCC rules, the medical practice must be listed as the sender and clearly identified in every message, except in follow-up messages of an ongoing conversation.
- Those sending texts should not include identifying information as the first sentence of the message. Ensuring that the patient must open the text before identifying information is displayed can help prevent unauthorized individuals from viewing PHI in notifications.
There are also rules in place set forth by other government agencies, including the Telephone Consumer Protection Act, which imposes a requirement that patients receive the option to opt out of text communications in any initial message. If the patient opts out, providers can provide only one follow-up confirming that the opt-out has been processed. These requirements are especially relevant for staff-to-patient communication.
Automated Patient Messaging & HIPAA
Automated reminders can help streamline practice operations as part of broader healthcare messaging. Examples include:
- Appointment reminders
- Medication reminders to encourage adherence
- Post-discharge check-in sequences in the days after a procedure to provide patients opportunities to speak about their care or offer important reminders
- Intake forms
- Billing information
HIPAA-compliant automated texting can reduce no-show rates by 39%. Automated reminders can achieve response rates of 70% to 80%.
Automated messages are still subject to HIPAA requirements, even if they are pre-scheduled and designed to manage administrative tasks.
If a patient’s identity can be matched with their medical care, then this information is considered protected health information, and providers must follow HIPAA security rules and may be required to obtain patient consent in writing.
What should you look for in HIPAA-compliant messaging software?
Providers who plan to send electronic communications like text messages or other direct messages regularly will likely need a HIPAA-compliant texting app or chat program. This secure messaging platform can be used for all patient messaging that contains PHI and is built for healthcare providers.
There are a lot of different apps that promise secure messaging for healthcare professionals, so providers should look for one that offers certain key features, including:
- Vendor willingness to sign a Business Associate Agreement
- Data encryption
- Access controls, including requiring logins, offering role-based access control based on staff duties, and providing multi-factor authentication options
- Automatic audit logs that allow auditing of who is sending, receiving, and reviewing communications. Logs must be able to be exported in the case of a regulatory investigation
- Remote device management, so sensitive patient information can be deleted if a device with the software is improperly accessed
In addition to these features, it’s important to look for software that fits workflows and is user-friendly so providers and staff can quickly and easily communicate with patients and other healthcare professionals. The best communication tools should also fit clinical workflows and support secure communication across healthcare teams.
About 75% of medical providers are expected to use HIPAA-compliant texting by 2026.
- TigerConnect is recognized as a leading HIPAA-compliant messaging platform.
- OnPage combines HIPAA-compliant messaging with critical alerting features.
- SlickText is used by over 800 healthcare companies for secure messaging.
Examples of HIPAA-compliant Texts vs. Non-compliant Texts
It can be helpful to look at some examples of HIPAA-compliant texts vs. texts that are not compliant.
| Type of Communication |
Non-Compliant Messages (When Using Regular SMS) |
Compliant Message |
| Appointment reminders |
Hi Jessie. This is a reminder about your pregnancy test tomorrow at 2:00
Problem: It links a patient to a specific identifying condition
|
Hi Jessie. This is a reminder about your appointment at 2:00 tomorrow.
This is compliant unless the practice name reveals Jessie's condition.
|
| Medication updates |
Hi Jessie. Your prescription for antiemetic medicine is ready.
Problem: It provides details about a specific medication linked to a patient.
|
Hi Jessie. Your prescription is ready at Pharmacy Name
This is compliant because it omits the name of the medication.
|
| Test results |
Hi Jessie. This is the lab. Your test results show you are pregnant. Please call.
Problem: It transmits PHI over an unsecured message.
|
Hi Jessie. Your lab results are ready. Please log into our secure portal or call us.
This is compliant because it does not reveal private health information until Jessie logs in or otherwise confirms her identity.
|
How to Handle Patient Replies
If a patient replies to a text, providers still must follow HIPAA requirements, especially if the patient discloses private and protected health information in the chat; handling replies well also supports patient engagement and compliance management. Some of the best ways to ensure HIPAA compliance while replying to a patient who has sent a text include:
- Verifying the identity of the patient who contacts you
- Shifting the conversation to a secure channel so staff can communicate securely through a HIPAA-compliant messaging app or patient portal that requires a login
- Sending a HIPAA-compliant automated reply that provides instructions for reaching staff members securely, explains the privacy risks of using text as a method of communication, and uses clear reply workflows that can improve patient engagement while limiting administrative back-and-forth
- Adhering to the Minimum Necessary Standard and providing as little information as possible about the patient’s condition
- Maintaining audit trails detailing when the messages were exchanged
Penalties for HIPAA Text Messaging Violations
Standard penalties for HIPAA violations apply when you fail to follow security or privacy rules. The Department of Health and Human Services uses a tiered system based on the violation’s severity. These are the penalties in effect as of January 28, 2026:
- Tier 1 (Did Not Know): $145 to $73,011 per violation, with an annual cap of $2,190,294.
- Tier 2 (Reasonable Cause): $1,461 to $73,011 per violation, with an annual cap of $2,190,294.
- Tier 3 (Willful Neglect - Corrected within 30 Days): $14,602 to $73,011 per violation, with an annual cap of $2,190,294.
- Tier 4 (Willful Neglect - Not Corrected): Minimum of $73,011 per violation, with an annual cap of $2,190,294.
Each individual instance of a text that violates the rules could result in separate penalties being imposed.
Does Medical Malpractice Insurance Cover Text Messaging in Healthcare?
Medical malpractice policies typically cover clinical negligence, including claims of negligence based on text messages. If a provider offers medical advice in a text or makes clinical decisions based on a text that results in a malpractice claim, malpractice policies typically cover the defense and resulting damages.
However, standard medical malpractice insurance policies generally do not cover regulatory fines or penalties resulting from a HIPAA privacy breach.
FAQs
Is texting HIPAA-compliant?
Texting can be HIPAA-compliant if done properly. It can meet the rules when healthcare providers use secure communication tools and follow consent and privacy safeguards, including limiting messages to the minimum necessary protected health information, ensuring patients affirmatively opt in after being warned of privacy risks, and having protocols in place to keep the texted information safe.
What is HIPAA-compliant text messaging?
HIPAA-compliant text messaging is secure text messaging that follows the HIPAA Security Rule and HIPAA Privacy Rule. Generally, it involves sending encrypted text messages, limiting who can send texts, restricting patient information you include, and establishing texting protocols to keep confidential information private and protect electronic protected health information while communicating via text.
What makes a HIPAA-compliant texting app?
A HIPAA-compliant texting app, or secure messaging platform, generally includes certain key features, including:
- Access controls
- Encryption
- A Business Associate Agreement
- Audit logs for message activity
The software must effectively limit who has access to patient information, helping medical providers with maintaining compliance.
What is the difference between HIPAA text messaging and standard SMS?
Standard SMS text messages, or short message service, and iMessages that contain protected health information are generally not HIPAA-compliant because they are insecure messages that are not encrypted in transit or at rest.
HIPAA-compliant text messages are often encrypted, contain the minimum amount of private patient information, and follow other requirements such as being sent from a program with controlled access. Unlike healthcare messaging platforms, standard SMS can expose sensitive information because it lacks these safeguards.
What are the biggest risks of texting in healthcare?
Text messages regarding patient care are part of a medical record and can be used as evidence in malpractice cases, and delays or mishandling can also affect patient safety when urgent information is involved. Medical advice given over text messages that falls below the standard of care could give rise to medical malpractice liability, especially when care teams rely on ordinary texting instead of secure communication.
Texts can also violate HIPAA if they contain protected patient information, which could lead to regulatory fines.
How long should HIPAA text messages be retained?
HIPAA does not specify a required retention period, but text messages with protected health information can become part of a patient’s medical record, and retention is largely governed by state medical record laws.
While medical records laws vary by location, adult medical records often must be kept for five to ten years from the date of service, while children’s medical records may need to be kept until the age of majority plus several years.
Be Sure You Understand Texting & HIPAA Rules
HIPAA-compliant texting is possible, and while there are risks, there are also significant advantages. It's a valuable tool for healthcare practices and healthcare providers.
If you are considering texting as a communication method with patients, make sure you and your healthcare teams understand HIPAA regulations for this form of electronic communication and have the right protocols and procedures in place. Across the healthcare sector, compliant texting also supports clinical communication for medical teams.
While many malpractice policies do not cover HIPAA violations, they may cover negligence claims arising from text communications.
If you find your policy lacks any essential coverage, Indigo can help you explore your options for getting the right protections in place.
Contact us today to find out how we can help.
Image by Tippapatt from iStock.
