General information, not legal advice — confirm with your compliance officer or attorney.
HIPAA compliant texting depends less on the app than on what you send, to whom, and through which vendor. HIPAA doesn't ban texting patients. It expects reasonable safeguards, respect for how each patient wants to be contacted, and a business associate agreement (BAA) with any vendor that handles the messages. Marketing texts bring in a second law, the Telephone Consumer Protection Act (TCPA), with its own consent rules.
In short: Texting patients is allowed under HIPAA when you apply reasonable safeguards and the patient accepts the channel. Keep standard SMS to logistics such as appointment times, and send results or diagnoses through a portal or a messaging tool whose vendor signs a BAA. Marketing texts also need prior express written consent under the TCPA.
Is text messaging HIPAA compliant? The short answer
Yes, with conditions. HHS's FAQ on emailing patients (opens in a new tab) says providers may communicate electronically with patients if they "apply reasonable safeguards when doing so," such as checking the destination and limiting what's sent. We found no HHS FAQ that names texting, so this is the closest official guidance.
The Security Rule's transmission security standard (opens in a new tab), 45 CFR 164.312(e), asks for measures "to guard against unauthorized access" to electronic PHI sent over a network. Encryption is "addressable": you must assess it and implement it "whenever deemed appropriate." HHS's Security Rule FAQ (opens in a new tab) says you must assess your use of open networks, pick a protection and document the decision. Addressable doesn't mean optional.
Standard SMS vs secure messaging apps
| Item | Standard SMS from a staff phone | Business texting platform | Secure messaging app or patient portal |
|---|---|---|---|
| Vendor BAA | None | Depends on the vendor and plan | Check before buying |
| End-to-end encryption | No | Not on the SMS leg to the patient | Usually, inside the app |
| Who controls the record | The employee | The practice | The practice |
| Lock-screen exposure | Full message | Full message | Usually a notice only |
| Removing access when staff leave | Not possible | Admin can remove | Admin can remove |
The middle column surprises people. A business texting platform can sign a BAA and log every message, but the text still reaches the patient as ordinary SMS. The BAA covers the vendor, not what a family member reads on the patient's lock screen. That's why content rules matter even with a good vendor.
What's reasonable to text, and what isn't
A practical test: if someone else picked up the patient's phone, would the message reveal anything beyond "has an appointment"?
Illustrative examples (fictional practices), fine over standard SMS with the patient's agreement:
- "Maple Street Dental: your appointment is Thursday at 9:30 a.m. Reply C to confirm or call us to reschedule."
- "Your new-patient forms are ready in the patient portal. Please complete them before your visit."
- "We're running about 20 minutes behind today. Sorry for the wait."
Not fine over standard SMS:
- Test or lab results, even "normal."
- Diagnoses, or the reason for the visit ("your colonoscopy prep starts tonight").
- Insurance member IDs, dates of birth or Social Security numbers.
- Medication names tied to a condition.
The sender's name can say more than the message. A reminder from a family practice reveals little; the same reminder from an addiction treatment program, a fertility clinic or a psychiatry practice reveals a lot. Those practices should keep texts especially plain, or use a portal notification instead.
Patient preferences and documented consent
HIPAA gives patients a say in how you contact them. Under 45 CFR 164.522(b) (opens in a new tab), a provider "must permit individuals to request and must accommodate reasonable requests" to receive communications "by alternative means or at alternative locations." You may ask for the request in writing, but you "may not require an explanation."
Two more points from HHS:
- If a patient contacts you electronically first, HHS's email FAQ says you may assume the channel is acceptable unless they say otherwise. If you doubt they understand the risk, explain it and let them decide.
- A patient may ask for copies of their records by an unsecure method. HHS's right of access FAQs (opens in a new tab) say you aren't responsible for a disclosure in transit once the patient was warned and still chose it.
Put the question on your intake form and record the answer in the chart.
Illustrative example (consent wording for a fictional clinic): "May Cedar Family Medicine text appointment reminders and scheduling updates to the mobile number above? Standard text messages aren't encrypted and may be seen by others with access to your phone. ☐ Yes ☐ No. You can reply STOP at any time."
Update the answer when a number changes, and treat a shared family phone as a reason to keep texts even plainer.
Marketing texts: TCPA consent rules
The TCPA is enforced by the Federal Communications Commission (FCC), separately from HIPAA. The FCC's consumer guide (opens in a new tab) says its rules ban autodialed texts to a mobile phone "unless the phone owner previously gave consent," that "Commercial texts require written consent," and that people "may opt out of any robocall or robotext at any time and in any reasonable manner."
The rule itself, 47 CFR 64.1200 (opens in a new tab):
- Marketing. Autodialed advertising or telemarketing to wireless numbers needs "prior express written consent": a written agreement "bearing the signature of the person called" that clearly authorizes the messages and lists the number. The same paragraph exempts a "health care" message from a HIPAA covered entity or its business associate from that written-consent requirement.
- A narrow healthcare exemption. Paragraph (a)(9)(iv) allows certain provider texts with strict limits: only to the number the patient gave; the provider's name and contact details; limited purposes such as appointment reminders, pre-operative instructions, lab results and prescription notifications; no marketing or billing content; 160 characters or less; at most one a day and three a week; and a "STOP" opt-out honored immediately.
That exemption is a TCPA rule only. It doesn't make a lab result safe to send over SMS under HIPAA.
HIPAA has its own marketing rules. HHS's marketing guidance (opens in a new tab) says a communication "made for treatment of the individual" isn't marketing, but promotional messages can be; see HIPAA marketing rules for email, which apply equally to texts. Check your state's telemarketing rules too. Practices texting patients in Canada should read CASL in Canada.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Staff texting each other about patients
Group texts between a physician, a nurse and the front desk are the most common texting risk, and the hardest to see. The messages live on personal phones with no BAA and no audit trail, and they stay there when someone leaves. Consumer apps have the same problem; see WhatsApp and iMessage.
HHS's cloud computing guidance (opens in a new tab) says providers may use mobile devices to access electronic PHI in a cloud service if they keep safeguards on the device and have BAAs with the services involved. For staff, that means a secure messaging tool with a BAA, or a covered workspace such as Slack for staff messaging on an Enterprise plan. Either way, share only what the task needs.
Choosing a secure messaging app: what to check
- A BAA that names the product and plan you'll buy.
- Encryption in transit and at rest, in the vendor's own documentation.
- Remote sign-out or wipe for lost and departed staff devices.
- Audit logs: who sent, opened and deleted what, and when.
- Message expiry and retention settings you control.
- How patients read messages: an app download, a verified web link, or a text with the full content.
- Export to your EHR when a message belongs in the chart.
- Where the data is stored, especially if you see Canadian patients.
Medfy doesn't send texts or provide messaging apps. What it does handle is the website side: its forms, and its HIPAA AI chat widget add-on, deliver patient requests into an encrypted patient CRM and inbox, covered by the BAA Medfy signs with each practice. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada; see how Medfy handles patient data. A free marketing audit shows how new patients reach you today. Other tools are on the HIPAA-compliant email and messaging hub.
Frequently asked questions
Is it a HIPAA violation to text a patient?
No, not by itself. HHS lets providers communicate with patients electronically when they apply reasonable safeguards, and patients can ask to be contacted a particular way. Problems come from what's in the message, who else can read it, and texting through a vendor that hasn't signed a BAA. Keep standard texts to logistics, and confirm your policy with your compliance officer or attorney.
Can we text appointment reminders without consent?
HIPAA doesn't require a written authorization for treatment communications; HHS's marketing guidance gives refill reminders as an example. Respect any patient who asks not to be texted. The TCPA is separate: automated texts generally need prior consent, and the FCC's healthcare exemption sets strict limits on content, length, frequency and opt-outs. Ask a simple yes or no on your intake form, and confirm with your compliance officer or attorney.
Do marketing texts need written consent?
Yes. The FCC says commercial texts require written consent, and its rule requires prior express written consent for autodialed advertising or telemarketing texts to mobile numbers: a signed agreement that clearly authorizes the messages and names the number. Patients can opt out at any time in any reasonable way. HIPAA's own marketing rules may also apply. Confirm your process with your compliance officer or attorney.
Can doctors text each other about patients?
Not over ordinary phone texting or consumer chat apps. Those messages sit on personal phones with no BAA, no audit trail and no way for the practice to remove them when someone leaves. Use a secure messaging tool whose vendor signs a BAA, or a covered staff workspace, and share only what the task needs. Confirm your staff messaging policy with your compliance officer or attorney.