Patient Revenue Library
HIPAA & Patient Texting
Business Associate Agreements, minimum-necessary texting and consent, in plain English.
AI vendors and HIPAA: questions to ask before an AI tool touches patient dataBefore an AI tool touches patient data, ask these questions about BAAs, model providers, training on your data, retention, minimum necessary and human review.Breach notification basics for practicesWhat counts as a HIPAA breach, the four-factor risk assessment, the 60-day deadlines for patients, HHS and media, and what to do in the first days.Consent for appointment reminder textsWhat consent a practice needs before texting appointment reminders under HIPAA, the TCPA and carrier rules, with sample intake wording and a front desk script.Does my vendor need a BAA? How to tellA three-question test for deciding whether a vendor needs a HIPAA Business Associate Agreement, with common vendors sorted and the exceptions explained.Email vs text for patient messagesA practical comparison of email and text for patient messages: speed, privacy, the laws that apply to each, and which channel fits which kind of message.Encryption at rest and in transit, explainedWhat encryption at rest and in transit mean, what HIPAA requires today, how encryption creates a breach safe harbor, and the questions to ask vendors.Is texting patients HIPAA compliant?HIPAA does not ban texting patients. Here is what the Privacy and Security Rules actually require, where practices get into trouble, and how to text safely.Minimum necessary patient textingHow HIPAA's minimum necessary principle applies to patient texts, with before-and-after message examples and a checklist your front desk can use.State texting laws practices should knowFlorida, Oklahoma, Maryland and Texas have their own texting and telemarketing laws. What they cover, why reminders differ from promotions, and what to do.STOP and opt-out handling for patient textsHow a practice should handle STOP replies and other opt-outs from patient texts under the FCC's 2025 rules and carrier standards, with sample replies.The TCPA and patient textingHow the TCPA applies to appointment reminder texts: consent, the FCC's healthcare exemption and its conditions, opt-out rules and recent court changes.Vendor security questions to askA practical security questionnaire for practices vetting any vendor that will handle patient data, with what a good answer sounds like and the red flags.What happens to your data when you leave a vendorWhat HIPAA requires when a practice ends a vendor relationship: return or destruction of patient data, backups, subcontractors, and an exit checklist.What is a Business Associate Agreement?A plain-English guide to the HIPAA Business Associate Agreement: who needs one, what it must contain, and the red flags to catch before you sign. 