How do I ensure my two-way patient messaging with text messaging software is HIPAA compliant?

To make two-way patient texting HIPAA-compliant, you need to treat it like any other system that creates, receives, stores, or transmits protected health information (PHI). The core idea is: use a secure platform, control access, protect data in transit and at rest, and document your compliance program.

Here’s a practical checklist:

1) Use a HIPAA-ready texting platform

Make sure the vendor explicitly supports HIPAA use and will sign a Business Associate Agreement (BAA). Without a BAA, the vendor is generally not acceptable for PHI.

Ask the vendor whether they provide:

• Encryption in transit and at rest
• Access controls and role-based permissions
• Audit logs
• Secure message storage
• Automatic logoff / session timeouts
• MFA for staff accounts
• Message retention controls and deletion policies
• Administrative controls for who can text patients
• Device management or support for lost/stolen devices

2) Get a BAA in place

A Business Associate Agreement is required when the vendor handles PHI on your behalf.

Your BAA should address:

• Permitted uses/disclosures of PHI
• Safeguards required of the vendor
• Breach notification responsibilities
• Subcontractor obligations
• Data return/destruction when the relationship ends

3) Minimize PHI in messages

Text only what is necessary.

Best practice:

• Avoid sending diagnosis, lab values, detailed treatment info, or anything sensitive unless truly needed.
• Use generic reminders like:
  • “You have an appointment tomorrow at 3 PM.”
  • Instead of: “Follow-up for diabetes complications tomorrow at 3 PM.”
• Use secure patient portal messaging for sensitive communications.

4) Obtain patient consent/opt-in

Get patients’ written or documented consent to receive texts, and tell them:

• Texting is not perfectly secure
• Standard SMS may be intercepted or seen on a shared device
• What kinds of messages they’ll receive
• How to opt out

This is especially important if you use regular SMS rather than an in-app secure messaging system.

5) Use secure authentication and access control

Only authorized staff should be able to send/receive patient messages.

Implement:

• Unique user IDs
• Strong passwords
• MFA
• Role-based access
• Automatic logout
• Prompt removal of access when staff leave or change roles

6) Protect devices and workstations

If staff use phones, tablets, or computers to text patients:

• Require screen locks
• Encrypt devices
• Allow remote wipe if possible
• Avoid shared logins
• Prevent message previews on lock screens
• Train staff not to use personal messaging apps for PHI

7) Train staff

Train everyone who can access the texting system on:

• What counts as PHI
• What can/can’t be texted
• How to verify patient identity
• How to handle wrong-number texts
• How to respond to opt-out requests
• Incident reporting and breach response

8) Set policies and procedures

Have written policies covering:

• Appropriate text content
• After-hours texting
• Response times
• Identity verification
• Escalation for urgent medical issues
• Retention and deletion
• Lost device procedures
• Breach reporting

9) Monitor and audit

Use logs and periodic reviews to detect:

• Unauthorized access
• Improper disclosures
• Staff sending PHI from personal devices
• Missing responses or workflow failures

10) Have a breach response plan

If PHI is exposed through texting, you need a response process:

• Contain the issue
• Assess what was exposed
• Determine whether notification is required
• Notify affected patients and regulators if needed
• Document the incident and corrective action

Important note about regular SMS

Standard SMS/texting is generally not end-to-end encrypted, so it may not be ideal for PHI unless you’ve implemented a HIPAA-compliant solution with appropriate safeguards and patient consent. Many organizations use SMS only for limited reminders or as a notification to log into a secure portal.

Quick vendor checklist

Before buying, ask:

• Will you sign a BAA?
• Is data encrypted in transit and at rest?
• Can you provide audit logs?
• Can we control user access and permissions?
• Can we disable storing message content on personal devices?
• How do you handle backups, deletion, and retention?
• Do you support MFA?
• What happens if a patient replies with sensitive information?

If you want, I can also give you:

1. a HIPAA texting vendor checklist,
2. a sample patient texting consent form, or
3. a policy template for staff using two-way texting.