Is texting patients HIPAA compliant?

What HIPAA actually says about electronic messages

HIPAA does not have a rule titled texting. The answer comes from how the Privacy Rule and Security Rule apply to any electronic communication.

In its published FAQ on email, the HHS Office for Civil Rights explains that the Privacy Rule allows covered health care providers to communicate electronically with patients, provided they apply reasonable safeguards. Examples HHS gives include checking an address before sending and limiting the amount or type of information in the message. The same logic applies to texts.

The Privacy Rule also requires reasonable safeguards against incidental disclosures (45 CFR 164.530(c)) and gives patients the right to request communication by alternative means (45 CFR 164.522(b)). The Security Rule, in 45 CFR Part 164 Subpart C, governs the systems that create, store and transmit electronic PHI, including the software that sends your texts and keeps the replies.

The three tests every texting program must pass

1. The content test. Does the message say only what it needs to? A text with the practice name, a time and reply options passes easily. A text naming a diagnosis, a medication or a test result is far riskier, because standard SMS is not end-to-end encrypted and texts are routinely seen by people other than the patient.
2. The system test. Is the software that sends and stores the messages built for PHI? That means access controls with unique logins, audit logs, encryption of stored data and in transit between systems, and a process for handling incidents, as the Security Rule expects.
3. The contract test. Has the vendor signed a Business Associate Agreement with your practice? A messaging platform that stores your patients' numbers, appointment times and replies is a business associate. Without a BAA, giving it that data is not permitted, no matter how secure it is.

The "HIPAA-compliant app" myth

Many products advertise themselves as HIPAA compliant or HIPAA certified. Treat both phrases with caution. HHS has stated in its Security Rule FAQ that it does not endorse or otherwise recognize private organizations' certifications, and that such certifications do not relieve covered entities of their obligations.

A tool can only be part of a compliant program. Whether your texting is compliant depends on how your practice uses it: the templates you write, the people you give access to, the BAA you sign and the way you respond when something goes wrong. Ask vendors for specifics, not labels.

The personal phone problem

The riskiest texting in many practices does not run through any platform. It happens when a staff member, trying to be helpful, texts a patient from a personal cell phone.

That message now lives on a device the practice does not control, backed up to a personal cloud account with no BAA, readable by anyone who picks up the phone, and gone from the practice's records when the employee leaves. There is no audit trail and no way to honor an opt-out across the team.

Set a clear policy: patient texts go through the practice's approved system only. If staff need to reach a patient urgently, they call from a practice line. Train on this at onboarding and repeat it at annual HIPAA training.

When the patient wants more detail by text

Sometimes the patient is the one pushing for detail: "Just text me my results." HIPAA gives patients strong rights over their own information. Under the right of access, HHS has explained that a patient may ask to receive their information through an unsecure channel such as unencrypted email. The provider should first warn the patient that there is some risk the information could be read by a third party. If the patient still wants it that way, the provider may send it, and is not responsible for unauthorized access while in transmission based on that request.

Even so, a practice can steer sensitive details to a better channel, such as a secure portal or a phone call, while still honoring the patient's right to access. Document the patient's request and the warning you gave if you do send something sensitive at their direction.

If a text goes to the wrong person

Wrong numbers happen. When one does, the response matters more than the mistake:

• Stop sending to that number immediately and correct the patient record.
• Write down what the message said, when it was sent and how you learned it was misdirected.
• Assess the incident under the Breach Notification Rule's four-factor test. A reminder with only a practice name and a time is a very different case from a message with a diagnosis.
• Keep the documentation. Even incidents that are not reportable breaches should be logged as part of your compliance records.