To make broadcast messaging with two-way texting HIPAA-compliant and consent-based, you need to address both privacy/security rules and patient authorization/opt-in rules. Here’s a practical checklist.

1) Decide whether the messages will include PHI

A text message is usually not a good place for sensitive PHI unless you’ve built the right controls.

• Best practice: keep broadcast texts non-clinical and minimal.
• Avoid including:
  • diagnoses
  • lab results
  • medications
  • appointment details that reveal sensitive treatment
  • insurance or billing specifics
  • any other information that could identify a patient’s health status

If a message contains PHI, your texting platform must support HIPAA safeguards and you need the right legal agreements in place.

2) Use a HIPAA-ready vendor and sign a BAA

Your texting provider should be willing to sign a Business Associate Agreement (BAA).

Confirm that the vendor has:

• BAA support
• encryption in transit and at rest
• role-based access controls
• audit logs
• message retention controls
• secure authentication
• administrative tools for consent tracking and opt-outs

If they won’t sign a BAA, don’t use them for PHI.

3) Get explicit patient consent before texting

For consent-based messaging, patients should clearly agree to receive texts.

Your opt-in should explain:

• that messages will be sent by text
• what kinds of messages they’ll receive
• message frequency, if applicable
• that standard message/data rates may apply
• how to opt out
• that texting may not be fully secure

Good practice

Use a written or electronic consent form and store it in the patient record or CRM.

Example consent language

“By providing my mobile number, I consent to receive text messages from [Practice Name] regarding appointments, reminders, care coordination, and other practice-related communications. Message frequency may vary. Message and data rates may apply. I understand texting may not be fully secure and I may opt out at any time by replying STOP.”

4) Make consent specific and granular

Don’t use one blanket opt-in for everything if you can avoid it.

Consider separate consent options for:

• appointment reminders
• billing messages
• general practice updates
• care coordination
• marketing/promotional texts

This helps ensure patients knowingly consent to each category.

5) Provide a clear opt-out mechanism

Every broadcast should include a simple way to unsubscribe.

Common practice:

• “Reply STOP to opt out”
• “Reply HELP for help”

Your system should:

• process opt-outs immediately or as quickly as possible
• suppress future texts to that number
• maintain an audit trail of the opt-out

6) Limit broadcast content to the minimum necessary

Under HIPAA’s minimum necessary principle, send only what is needed.

Examples:

• Good: “Reminder: You have an appointment tomorrow at 3 PM. Reply C to confirm.”
• Better than: “Reminder: You have a behavioral health follow-up tomorrow at 3 PM with Dr. Smith regarding medication adjustment.”

7) Verify the phone number belongs to the patient

Before sending messages, confirm:

• the number is correct
• the patient owns or regularly uses it
• the patient understands texts may be seen by others who have access to that phone

This is especially important for shared family phones.

8) Use role-based access and internal policies

Only authorized staff should be able to:

• send broadcast messages
• view message history
• access patient contact lists
• edit consent settings

Create policies for:

• approving broadcast content
• reviewing compliance
• handling wrong-number incidents
• handling patient complaints
• escalation if a privacy issue occurs

9) Train staff

Your team should know:

• what can and cannot be texted
• how to document consent
• how to handle opt-outs
• how to avoid accidental PHI disclosure
• how to use templates and approved messaging workflows

10) Document everything

Keep records of:

• consent/authorization
• opt-in source and date
• opt-out requests
• message templates
• vendor BAA
• access logs
• any incidents or complaints

If questioned later, documentation is critical.

11) Review whether marketing rules apply

If the broadcast is promotional or marketing-related, you may need separate HIPAA authorization.

Examples of marketing:

• promoting a service
• advertising a new provider or treatment
• encouraging patients to purchase something

Appointment reminders and treatment-related messages are generally treated differently from marketing, but you should review with legal/compliance counsel.

12) Have a breach response plan

If a message is sent to the wrong person or includes improper PHI:

• stop further messages
• assess the scope
• document the incident
• notify internal compliance/privacy leadership
• determine whether breach notification is required

---

Simple compliance formula

A safe broadcast texting program usually has:

1. explicit patient opt-in
2. BAA with the texting vendor
3. minimum-necessary message content
4. easy opt-out
5. secure platform and access controls
6. documented policies and staff training

---

Practical example

A compliant appointment broadcast might say:

“[Clinic Name]: Reminder that you have an appointment on Thursday at 2 PM. Reply C to confirm or STOP to opt out.”

This is much safer than: “Reminder: follow-up for diabetes management and medication review with Dr. Lee on Thursday at 2 PM.”

---

Best next steps

If you want to implement this correctly, I’d suggest:

• reviewing your vendor’s HIPAA documentation and BAA
• creating an opt-in/opt-out workflow
• limiting broadcasts to approved templates
• having your compliance or legal team review the program

If you want, I can also help you create:

• a HIPAA-compliant SMS consent form
• a broadcast texting policy
• or a sample compliant message template set