How do I ensure my patient follow-up messages with scheduling software are compliant with HIPAA and PHI rules?

To keep patient follow-up messages compliant with HIPAA and PHI rules when using scheduling software, focus on what you send, where you send it, and how your software is configured.

Key principles

1) Minimize PHI in messages

Only include the least amount of information necessary.

Safer example:

• “Hi, this is Dr. Smith’s office. Please call us at 555-123-4567 to schedule your follow-up.”

Riskier example:

• “Hi John, your MRI showed X and you need a follow-up for your diabetes treatment next Tuesday at 3 PM.”

Avoid including:

• Diagnosis
• Test results
• Medications
• Procedure details
• Full DOB
• Insurance details
• Anything highly specific about the patient’s condition

2) Use secure, approved communication channels

Make sure the scheduling software:

• Is configured for HIPAA-compliant messaging
• Has a Business Associate Agreement (BAA) if the vendor handles PHI
• Uses encryption in transit and at rest
• Has access controls and audit logs
• Supports role-based permissions

If the software is just sending standard SMS/texts, remember that regular SMS is generally not secure and should not be used for sensitive PHI.

3) Separate reminders from clinical content

Scheduling reminders should ideally only contain:

• Appointment date/time
• Clinic name
• A callback number
• Basic instructions like “Please arrive 15 minutes early”

Do not mix scheduling reminders with clinical advice unless the channel is explicitly approved for that purpose and the minimum necessary standard is applied.

4) Get patient consent/communication preferences

Ask patients how they want to be contacted and document it.

• Phone call
• Secure portal message
• Email (if approved and risk-assessed)
• Text reminder with limited content

Make sure patients understand the risks if they choose less secure channels.

5) Configure templates carefully

Use standardized message templates that exclude PHI by default. For example:

• “You have an upcoming appointment. Reply or call if you need to reschedule.”
• “Please contact our office about your follow-up visit.”

Avoid templates that auto-populate:

• Diagnosis or reason for visit
• Notes from the chart
• Provider comments
• Lab/imaging summaries

6) Limit staff access and training

Only authorized staff should be able to send or modify messages. Train them on:

• What counts as PHI
• What can/can’t be included in texts or emails
• How to verify identity before discussing anything sensitive
• What to do if a message is sent to the wrong person

7) Maintain documentation and policies

Have written policies covering:

• Approved communication methods
• Patient consent
• Template use
• Message retention
• Incident response for misdirected messages or breaches

8) Review vendor security and compliance

Before using any scheduling platform, confirm:

• HIPAA support
• BAA availability
• Data retention/deletion practices
• Subcontractor compliance
• Breach notification terms

Practical safe-message guidelines

A compliant follow-up message usually:

• Identifies the office/practice
• Says there is an upcoming or needed appointment
• Includes a phone number or secure link
• Avoids specific medical details

Good vs. bad examples

Good:

• “This is ABC Clinic reminding you to schedule a follow-up visit. Please call 555-123-4567.”

Better if using portal:

• “You have a message from ABC Clinic in your secure portal.”

Bad:

• “Your biopsy results require a follow-up for possible melanoma.”

Important note

HIPAA compliance depends on the entire workflow, not just the message text. Even a short message can become a problem if it’s sent through an insecure channel or exposed to unauthorized users.

If you want, I can also give you:

1. a HIPAA-safe message template set,
2. a vendor compliance checklist, or
3. a policy draft for staff.