How do I ensure my two-way patient messaging with text messaging software is HIPAA compliant?

To make two-way patient texting HIPAA compliant, focus on people, process, and technology—not just the software itself. Here’s a practical checklist.

1) Use the right kind of texting platform

Choose a vendor that will sign a Business Associate Agreement (BAA) and is designed for healthcare use.

Look for:

• BAA available
• Encryption in transit and at rest
• Role-based access controls
• Audit logs
• Message retention controls
• Secure authentication (MFA is best)
• Ability to limit PHI exposure
• Secure patient consent and opt-in workflows

Avoid using consumer texting tools or personal phones without a managed secure app or MDM policy.

2) Minimize PHI in texts

Even with a compliant platform, send the least amount of protected health information necessary.

Good practice:

• Use texts for alerts, reminders, scheduling, and brief follow-up
• Avoid sending diagnoses, lab results, full clinical notes, or highly sensitive information unless necessary
• Keep messages short and generic when possible

Example:

• Better: “Your appointment is tomorrow at 2:00 PM. Reply C to confirm.”
• Less ideal: “Your MRI shows a torn ACL and you need surgery.”

3) Get patient consent for texting

Have a documented process for patient opt-in to receive texts.

Include:

• The types of messages they may receive
• That standard SMS may not be fully secure if your workflow uses it
• Any risks and limits
• How they can opt out

Best practice: store the consent in the patient record.

4) Verify identity before discussing PHI

If a patient texts back asking about clinical information, confirm identity before sharing anything sensitive.

Options:

• Ask for a verification code
• Use a pre-registered phone number plus additional verification
• Route sensitive conversations to a secure portal or call-back

Never rely on a phone number alone for high-risk disclosures.

5) Define what staff can and cannot text

Create written policies for your team.

Include:

• Approved message types
• Prohibited content
• Escalation rules
• Response-time expectations
• After-hours handling
• When to move from text to phone/portal/visit

Train staff regularly.

6) Secure devices and access

Whether staff use desktops or mobile devices, protect access.

Use:

• Strong passwords and MFA
• Automatic screen lock
• Device encryption
• Remote wipe for lost/stolen devices
• No shared logins
• Access limited by role

If staff use phones, consider an MDM or managed app so PHI isn’t stored in personal SMS apps.

7) Keep audit trails and monitor use

Make sure you can track:

• Who sent or read a message
• When it was sent
• Whether it was delivered
• Any edits or deletions

Audit logs help with compliance reviews and incident investigations.

8) Set retention and deletion rules

Decide how long messages are kept and where they are stored.

You should know:

• Whether texts are part of the medical record
• How they are archived
• How long they are retained
• How they are securely deleted when no longer needed

Align this with your record retention policy and state law.

9) Have an incident response plan

If a message is sent to the wrong person or a device is lost, you need a process.

Your plan should cover:

• Containment
• Investigation
• Breach risk assessment
• Notifications
• Corrective action
• Staff retraining

10) Review state laws and special categories of information

HIPAA is not the only rule. State laws may be stricter, and certain information may need extra protection, such as:

• Mental health
• Substance use disorder records
• HIV/STD information
• Minors’ records
• Reproductive health information

Be sure your workflow meets the most restrictive applicable rules.

11) Consider whether “standard SMS” is appropriate

Standard text messaging is convenient, but it has limitations:

• Not always encrypted end-to-end
• Messages may appear on locked screens
• Phones may be shared
• Delivery can be uncertain

Many organizations use a secure messaging app or patient portal for anything beyond simple notifications.

Practical rule of thumb

Use texting for:

• Reminders
• “We need to reschedule”
• “Please call the office”
• Simple intake prompts
• Non-sensitive coordination

Use secure portal, phone, or in-person for:

• Diagnoses
• Test results
• Detailed clinical discussion
• Highly sensitive topics
• Anything requiring identity verification

Best next steps

1. Verify your vendor will sign a BAA
2. Review your message types and strip out unnecessary PHI
3. Implement patient consent and identity verification
4. Train staff and write a texting policy
5. Confirm retention, audit logs, and incident response procedures
6. Have legal/compliance review your workflow

If you want, I can help you build a HIPAA-compliant patient texting policy or a vendor evaluation checklist you can use with software providers.