HIPAA Compliant Texting: What You May Send Patients by SMS

Your front desk texts patients every day, and at some point a vendor has told you that regular SMS is not HIPAA compliant. That line sells secure-messaging apps. It is not what HHS says. HHS guidance states that the Privacy Rule does not prohibit unencrypted email between a provider and a patient when reasonable safeguards are in place, and that a patient warned of the risk can still choose it. Texting follows the same logic.

The rules that do apply are narrower and more practical: what the message says, whether the patient asked for something else, who stores the message, which phone sends it, and what happens when it lands on the wrong phone. That last one is not hypothetical. OCR received 74,299 reports of breaches affecting fewer than 500 people in 2024, and 94% of them were unauthorized access or disclosure. The report names misdirected communications among them.

Each rule below comes with its regulation, plus a sample reminder table and a decision path for your own setup. TCPA, the separate law on whether you may text a number at all, gets one paragraph.

Does HIPAA let you text patients at all?

Yes. HHS guidance says the Privacy Rule lets providers communicate with patients electronically, including by unencrypted email, when they apply reasonable safeguards. Texting follows the same logic. What HIPAA governs is how much each message reveals, who stores it, whether the patient asked for another channel, and what you document.

The guidance is HHS FAQ 570, first published in 2008. It ties electronic messages to the safeguards standard at 45 CFR 164.530(c) and gives concrete examples: check the address before you send, and limit the amount or type of information in an unencrypted message. A separate HHS FAQ settles the most common use. Appointment reminders count as treatment, so they need no written authorization from the patient.

The Security Rule still applies to the electronic patient information you send and store. Its transmission security standard, 45 CFR 164.312(e)(1), asks you to guard against unauthorized access in transit. Encryption sits under that standard as an "addressable" specification. Addressable does not mean optional. Under 45 CFR 164.306(d)(3), you assess whether encryption is reasonable and appropriate for your practice, implement it if it is, and if it is not, document why and implement an equivalent alternative where reasonable.

That may change. On January 6, 2025, HHS proposed removing the addressable category and requiring encryption of electronic patient information at rest and in transit, with limited exceptions. One exception covers a patient who asks to receive their own records unencrypted, and the proposal names some types of text messaging as an example. It is still a proposal: the eCFR dated September 29, 2026, marks encryption addressable, and no final rule had been published by early October 2026.

So the vendor line is half right. A secure-link message is a sound safeguard, but it is one you choose after assessing risk, not a legal floor for every reminder. And no product is "HIPAA certified," because no such certification exists.

The patient's preference decides the channel

Patients can steer how you reach them. Under 45 CFR 164.522(b), you must accommodate reasonable requests for communication by alternative means, without asking why. HHS also says a patient warned that unencrypted email carries risk may still choose it, leaving you not responsible for interception in transit. Texts follow the same reasoning.

The confidential communications rule cuts both ways for texting. A patient can ask you to text instead of calling a shared landline. Another can ask you never to text a number a partner can see. You may require the request in writing, and you may ask for the alternative number or address.

The warning comes from the 2013 Omnibus Rule. In its preamble, discussing patients' requests for copies of their records, HHS said covered entities may send unencrypted email to a patient who has been advised of the risk and still prefers it, and that the entity is not responsible for unauthorized access while the message is in transmission. HHS added that it does not expect a lesson in encryption, only notice that a third party could read the message. A related FAQ on records requests sets the same pattern: a brief warning, a confirmation, then you comply.

FAQ 570 adds that when a patient starts the conversation electronically, you may treat that channel as acceptable unless the patient says otherwise. One precision: these FAQs speak of email. The January 2025 proposal names text messaging alongside it, so applying the same reasoning to SMS is the careful reading.

At intake, the warning takes a few seconds: "We can text you reminders and short updates. Regular texts are not encrypted, so someone with access to your phone or the network could read them. Would you like texts, and is this the best number?" Record 5 things in a field your texting system actually reads: the channel, the number, the date, the warning given, and who took it.

Do not assume every patient wants texts. In a 2023 JMIR Formative Research survey of 133 primary-care patients aged 47 to 78, 56% were willing to receive cancer-screening information by text, against 75% for the patient portal, 74% for email and 38% for phone. Respondents with lower income and less education preferred phone calls. One small study, but a reason to ask rather than assume.

What a reminder text may say

Keep the default text to what the patient needs to act: your practice name, the date and time, and a way to confirm. HHS gives the same advice for answering-machine messages. Anything clinical, such as a procedure, result or medication, belongs behind a portal link unless the patient chose otherwise.

You might expect the minimum necessary standard to set that limit. It does not, quite. The rule at 45 CFR 164.502(b) asks you to limit what you disclose to the minimum necessary, but paragraph (b)(2)(ii) exempts disclosures made to the patient. A text addressed to the patient is one. The pressure to keep it thin comes from the safeguards standard, which requires you to limit incidental disclosures, and from FAQ 570, which names limiting the amount or type of information as the safeguard for unencrypted messages.

The reason is that the patient is rarely the only reader. Texts appear on lock screens and in notification previews. Phones are shared by couples, read by teenagers and handed to a parent. Numbers change owners. HHS FAQ 198 handles the voicemail version of the same problem: leave your name and number and what is needed to confirm the appointment, or ask the patient to call back.

The default for every patient. A patient who chose more, after a warning, can get more.

The last row matters most for a behavioral health, fertility or addiction practice, where the sender name alone tells a reader why the patient is a patient. Ask at intake how the patient wants your texts to appear, and make every automated message honor it. State law can be stricter than HIPAA for mental health, HIV and substance use information.

TCPA is a separate federal law governing whether you may send automated texts to a number at all. The FCC's exemption for free-to-the-patient healthcare texts, 47 CFR 64.1200(a)(9)(iv), covers reminders and similar messages, caps each at 160 characters, allows 1 per day and 3 per week, excludes billing content, and requires the text to comply with HIPAA. Statutory damages run $500 per violation, up to $1,500 if willful or knowing. The consent and opt-out rules are in TCPA compliance for patient texting.

Your texting vendor signs a BAA, your phone carrier does not

Any platform that stores your messages, templates or patient numbers is a business associate and needs a signed business associate agreement before patient data flows. Phone carriers are different, because HHS treats pure transmission services as conduits. The test is persistence: a service that keeps the data is not a conduit.

HHS drew that line in the 2013 Omnibus Rule. The conduit exception covers transmission services, including temporary storage incident to the transmission. An entity that maintains patient information on your behalf is a business associate even if it never views it. HHS described the difference as transient versus persistent access. Under 45 CFR 164.502(e), you need satisfactory assurance, in the form of a BAA, before any business associate creates, receives, maintains or transmits patient information for you.

Map your own stack against that test. A texting platform that keeps message logs, delivery receipts and contact lists needs a BAA. An EHR that sends reminders from its own messaging module may already be covered, but only if your BAA covers that product. An AI receptionist that books appointments and sends confirmation texts is a business associate too. If you are evaluating one, start with what an AI receptionist does and where it stops, then put the same questions to it.

Ask every texting vendor 5 questions before you sign:

• Does the BAA name the messaging product you will use, or only the vendor's other services?
• How long are message bodies kept, and can you shorten that?
• Can you export and delete a patient's message history on request?
• Is there an audit log showing which user sent which message, and when?
• Which subcontractors handle the messages between the vendor and the carrier?

Encryption covers less than it sounds. A vendor can encrypt its own servers and its connections. It cannot encrypt the carrier leg of a plain SMS, and it cannot protect the message once it is on the patient's phone. CISA's December 2024 mobile guidance, written for senior government and political figures, states plainly that SMS messages are not encrypted. A secure-link text avoids the problem: "You have a new message from Lakeside. Log in to read it." The content stays in the portal, behind a login.

Plain SMS is permitted. These are the safeguards it does not give you by itself.

More vendor questions, including recordings and retention, are in the questions to ask about HIPAA and a BAA.

Staff texting from personal phones is the bigger exposure

The riskier texts are often not the automated reminders. They are the ones a front-desk employee sends from a personal phone to fix a schedule quickly. That message sits outside your audit trail and any business associate agreement, and it leaves with an employee who resigns or loses the phone.

The Security Rule makes the problem specific. Unique user identification is a required specification at 45 CFR 164.312(a)(2)(i): every person who touches electronic patient information needs their own identity in the system. Audit controls at 164.312(b) require a way to record and examine activity. Termination procedures, an addressable specification at 164.308(a)(3)(ii)(C), cover ending access when someone leaves. A personal phone gives you none of the three. You cannot see what was sent, prove who sent it or pull it back.

Lost and stolen devices show up in the breach data too. OCR's 2024 report counts 2,593 small-breach reports from lost electronic media or paper records and 822 from theft of devices or paper. A personal phone holding a year of patient threads is that kind of device, and it may back up to a cloud account you do not control.

Hospital regulators have already drawn this line. In a February 8, 2024 memo, CMS said texting patient information and orders among the care team is permissible for hospitals and critical access hospitals, but only through a HIPAA compliant secure texting platform, and that the platform must be encrypted. The memo does not bind a private practice, but it shows where regulators expect texting to live.

A workable policy fits on one page. Patients text one practice number on one platform. Staff never give out personal numbers. When a patient texts a staff member directly anyway, the reply moves to the practice platform and the exchange is noted in the chart. Phones that do reach the platform need a passcode and auto-lock, and access ends on the employee's last day.

Field note

Before staff text a patient

• The message goes out from the practice platform, never a personal number.
• The patient's channel preference and number were confirmed at this visit.
• The text carries only what the patient needs to act on.
• The platform storing it has a signed BAA that names messaging.

When a text reaches the wrong phone

A text sent to the wrong number is an impermissible disclosure, and HIPAA presumes it is a breach unless a documented risk assessment shows a low probability of compromise. If it is a breach, you must notify the patient without unreasonable delay and no later than 60 calendar days after discovery.

The risk assessment in 45 CFR 164.402 weighs at least 4 factors: the nature and extent of the information, including how identifying it is; who received it; whether it was actually viewed; and how far you mitigated the risk. A bare date-and-time reminder that reached a stranger and a text naming a procedure will usually score very differently on the first factor, which is one more reason to keep the default text thin.

Encryption does not help here. The right message, decrypted correctly, simply opened on the wrong phone. Breaches affecting fewer than 500 people still have to be reported: you keep a log and report them to HHS no later than 60 days after the end of the calendar year, under 164.408(c).

For 2024, OCR received 74,299 reports of breaches affecting fewer than 500 people. Of those, 69,773, or 94%, were unauthorized access or disclosure, and 68,761, or 93%, came from health care providers. The report names misdirected communications among the incidents, including emails sent to the wrong person and test results sent to the wrong patient.

Small breaches are mostly disclosures, and most come from providers. Misdirected messages are named among them.

Prevention starts with the number itself. Confirm the mobile number at every visit, not only at registration. Read it back when a patient gives it over the phone. Treat a "wrong number" reply as an incident to check, not a nuisance, and pause automated texts to that number until it is corrected. Do not text a family member's number unless the patient listed it for that purpose.

Set up patient texting you can defend

Start with what the rules actually require: thin default content, the patient's recorded preference, a BAA with every vendor that stores messages, and texts that leave from practice systems rather than personal phones. Then confirm numbers before you send. A practice that keeps those records can explain any text it has sent.

Three checks before any patient text leaves the building. Each one maps to a rule.

Walk the path once with your most common message. Anything beyond your name, the date and the time goes behind a portal link unless the patient chose text after a warning. Anything sent from a personal phone moves to the platform. An unconfirmed number gets confirmed first. The rest goes out from the platform, logged.

Start with reminders only, because they carry the least and reach the most patients. Read the first 2 weeks of message logs end to end, then add confirmations and portal notices. Every quarter, review the templates, the vendor BAA and who has platform access, and re-check the January 2025 encryption proposal.

If you are weighing an AI receptionist that would send some of these texts, our FAQ on HIPAA, BAAs and patient data answers the compliance questions up front.