HIPAA Compliant Texting: What Staff Can Send, and on Which Phone

Is texting HIPAA compliant?

Texting can be HIPAA compliant. Nothing in HIPAA names text messaging or bans it. The Security Rule asks what protects the PHI once it’s in a message: who can open it, whether there’s a log, whether it can be altered, and whether it’s protected in transit. Plain SMS from a personal phone usually fails most of that. A managed app can pass it.

The rules that matter are the technical safeguards at 45 CFR 164.312. Here’s what they mean for texting:

• Unique user identification. Each person signs in as themselves. A shared front-desk phone with one login doesn’t work.
• Automatic logoff. The app locks after a period of inactivity.
• Audit controls. Some record of activity on the systems that hold PHI.
• Integrity. Messages can’t be quietly altered or deleted.
• Transmission security. Encryption in transit. It’s “addressable,” which means you either do it or document why not and what you did instead. It doesn’t mean optional.

Plain SMS gives you none of that on your terms. Whoever holds either phone can read the message, and there’s no admin console or log you control.

If you want the full Security Rule picture beyond texting, start with our HIPAA compliance checklist.

Can you text patients?

Yes. Patients can ask you to reach them by text, and you should go along with it when it’s reasonable. Under 45 CFR 164.522(b), a provider “must accommodate reasonable requests” to communicate “by alternative means or at alternative locations.” You can’t make the patient explain why.

HHS’s FAQ on emailing patients is the closest official guidance, and the same rules apply to text. It says unencrypted messages to patients aren’t prohibited, but you should use reasonable safeguards, like confirming the address and “limiting the amount or type of information disclosed.” It also says that if a patient isn’t aware of the risk, you can warn them and let them choose. If a patient says no to unencrypted messages, offer something more secure, or the phone, or the mail.

Records requests are stricter. HHS says patients have a right to their records in the form they ask for, even an unsecure one, after a brief warning about the risk. Other unsecure modes depend on what you can produce and on your own risk analysis. And you can never require a patient to accept an unsecure method.

In practice, for the front desk:

• Reminders and logistics by text are fine. “Appointment Tuesday at 2. Reply C to confirm.” Leave out the diagnosis.
• Warn once, then document. If a patient wants results or details by text, read them a short script about the risk and note their answer in the chart.
• Verify the number. A typo sends PHI to a stranger. That’s on you, not the patient.

Email follows the same logic. Our HIPAA compliant email guide covers that side.

Can staff text PHI to other providers?

Yes, with the right setup. HIPAA lets you disclose PHI for treatment, and texting a referring doctor about a shared patient is treatment. The method still has to meet the Security Rule. That’s where personal SMS falls down, and where a secure messaging app earns its keep.

CMS has the official word for hospitals. Its memo QSO-24-05-Hospital/CAH, dated Feb 8, 2024, says texting patient information and orders “among members of the health care team is permissible, if accomplished through a HIPAA compliant secure texting platform.” It replaced 2018 guidance that said texting orders wasn’t compliant with the Conditions of Participation. Two caveats are in there too. Computerized provider order entry “continues to be the preferred method,” and the platform has to be secure, encrypted, and able to identify who wrote each message.

That memo is addressed to hospitals and critical access hospitals, not independent clinics. But its standard is a good one to borrow. If the app can’t tell you who sent an order and can’t get it into the record, don’t use it for orders.

Do you need a BAA with your messaging app?

Yes, if the service stores your messages. A vendor that creates, receives, maintains, or transmits PHI for you is a business associate, and 45 CFR 164.502(e) requires satisfactory assurances, in writing, before PHI goes to them. That’s the BAA.

Some vendors claim they’re just a “conduit,” like the post office. HHS’s cloud computing guidance limits that exception to “transmission-only services” with temporary storage. A messaging app that keeps your conversation history is storing PHI, so it’s a business associate. That holds even if the vendor says it can’t read the messages because they’re encrypted.

Check three things before staff use any messaging app for PHI:

1. A signed BAA that covers the messaging product you’re using, not just the vendor’s other products.
2. An admin console where you control accounts, so you can shut off someone who leaves the same day.
3. Logs and retention settings you can actually see.

If there’s no BAA, there’s no PHI in that app, whatever the marketing says about encryption.

Why are personal phones the real problem?

Personal phones are the problem because you don’t control them. The texts aren’t the weak point. When a staff member’s own phone holds patient texts, you can’t enforce a passcode, can’t wipe it when it’s lost, can’t pull the messages when they quit, and can’t show anyone who read what.

Walk through the lost-phone case. Under the breach notification rule, you have to notify patients after a breach of unsecured PHI. HHS’s breach guidance says PHI encrypted to its standard, with the key not compromised, doesn’t count as unsecured. So a lost phone that’s encrypted, locked, and wiped is a bad afternoon. A lost personal phone with years of patient texts and a four-digit passcode can mean letters to patients.

The Security Rule also has device and media controls for hardware that carries ePHI in and out of the building. A phone in a coat pocket is that hardware.

We’ve had to act fast on a stolen device before. In our stolen laptop remote wipe report, the device was online on someone else’s network within minutes, and we wiped it 16 minutes from the theft. That worked because the laptop was already managed. You can’t enroll a phone after it’s gone.

What does a sane texting setup look like?

A sane setup is boring. Practice-managed phones, or personal phones with a managed work profile. One approved messaging app with a BAA. Plain SMS only for reminders. A written rule for how long messages are kept and where clinical content ends up.

The pieces:

• Managed devices. Passcode, encryption, auto-lock, and remote wipe enforced by policy, not by asking nicely.
• One approved app. Covered by a BAA, with individual logins and an admin console. Everything else is off-limits for PHI, in writing.
• Offboarding that includes the phone. Account disabled and work data wiped on the last day.
• A retention rule. HIPAA itself doesn’t set how long medical records are kept. State law does. HIPAA does require safeguards for as long as you keep the data, including disposal. Decide whether clinical texts get copied into the chart, and how long the app keeps the rest.
• A patient script. One short warning, used every time, with the answer noted.
• Training. Staff need to know which app to use and what never goes in plain SMS.

Put all of it in your risk analysis.

Key takeaways

What this looks like when we do it

For a medical practice, texting is part of the device and Security Rule work, not a separate project. We start by finding out where texting already happens, because it’s almost always on personal phones. Then we put the phones that touch PHI under management with encryption, passcodes, and remote wipe. We check that the messaging app you pick has a BAA on file, tie its accounts to your user list so offboarding shuts them off, and write down the policy and retention rule so your risk analysis matches reality.

The clinical side stays yours: what goes in the chart and what your providers text each other about. Our job is making sure the phone in the parking lot isn’t a breach notice. More on how we support practices is on our medical practices page.

If your staff are texting patients from their own phones right now, book a call and we’ll map out the fix.