7 HIPAA compliant texting apps, ranked by what they can safely send

The best HIPAA compliant texting apps sign a business associate agreement (BAA), encrypt and log every message, and keep clinical detail behind a login.

Pabau, the all-in-one practice platform we build, is our top pick for med spas and aesthetic, dental and wellness practices. Pabau keeps texting inside booking and patient records. Spruce Health suits therapists and small practices that only need a secure phone and messaging line.

HIPAA compliant texting over plain SMS works only when a message holds no protected health information (PHI), such as a bare appointment time. So we ranked seven apps by the three-lane rule, our own framework for which texts each channel can safely carry. Every price below comes from the vendor’s own website, checked in October 2026.

Key takeaways

1. Pabau — best for outpatient practices that want reminders, two-way texts and a Client Portal inside one booking and records system.

2. Spruce Health — best for therapists and small practices that need a secure phone line, texting and a messaging app in one.

3. OhMD — best for EHR-connected practices that want two-way texting with no patient app or portal.

4. Curogram — best for multi-provider practices that want texting, forms and text-to-pay synced to their EMR.

5. iPlum — best for clinicians who text patients from their own phone and need a separate business number.

6. Textline — best for front desks that work one shared text inbox and only need SMS.

7. Weave — best for dental and optometry practices that want phones, texting and bulk messages from one vendor.

The seven apps side by side

All seven HIPAA compliant texting apps on this list sign a BAA on the right plan. Where these HIPAA compliant text messaging apps differ is which lanes they cover, whether patients need an app, and what you pay. That makes the table a quicker filter than any feature list for secure messaging apps for healthcare.

1. Pabau

Pabau is the strongest HIPAA compliant texting app for outpatient practices that want patient texts, forms and records in the same system.

Pabau sends reminders and confirmations from the practice account, so no patient text leaves a staff member’s phone. Patients reply to the same two-way SMS thread, and Pabau files each message to their patient record. Bulk SMS campaigns go out from the same tool, and each patient’s opt-in is recorded with its date, time and source.

Pabau covers all three lanes. Lane 1 and Lane 2 texts go out by SMS under the BAA Pabau includes for US covered-entity customers. Lane 3 content moves to the Client Portal, where patients complete intake and consent forms and see shared photos behind their own login.

The fit question is scope. Pabau runs booking, charting, payments and marketing as well as texting, so it suits a practice ready to move those into one system. A practice that wants only a texting line beside another EHR will find a standalone app quicker to set up.

Pricing

Pabau publishes its Solo price and quotes larger teams on a demo call. Every plan includes the core features, annual billing saves up to 20%, and SMS draws on top-up credits.

2. Spruce Health

Spruce Health is the best HIPAA compliant texting app for therapists and small practices that want calls, texts and secure messaging in one app.

Spruce Health gives each clinician a work number for calls, texts, fax and video, so patient contact stays off personal numbers. That makes it a practical secure texting app for healthcare teams of one to five, mental health practices especially. Spruce says more than 50,000 providers use it.

Spruce Health covers all three lanes. Standard conversations are plain SMS that patients read without an app, so they carry Lane 1 and consented Lane 2 texts. Secure conversations stay inside Spruce, and that is the Lane 3 channel. Spruce says every trial and paid plan includes a BAA automatically.

The trade-off is patient effort. To read a secure conversation, a patient downloads the Spruce app or creates an account in a browser. Spruce also has no scheduling or charting, so notes and results still live in a separate system.

Pricing

Both prices exclude taxes and fees. Outbound SMS adds a one-time $19.50 carrier registration fee, and Spruce says larger practices may need an annual commitment.

3. OhMD

OhMD is the pick for EHR-connected practices that want two-way texting patients answer from their own phone, with no app to install.

OhMD HIPAA compliant texting runs on plain SMS. In OhMD’s own words: “No app. No portal. Just SMS.” OhMD says conversations sync to the EHR, and it integrates with 85 EHR and practice management systems. Its higher plan adds AI that answers calls and texts.

OhMD covers Lanes 1 and 2. Its pricing page lists a BAA across plans, so consented Lane 2 texts are covered. OhMD also lists lab result updates among its text conversations. Under the three-lane rule the result itself still belongs behind a login, so pair OhMD with your EHR’s patient portal.

Pricing

OhMD publishes starting prices only, and calling usage on the higher plans is billed separately.

4. Curogram

Curogram is best for multi-provider practices that want texting, forms and payments tied to an EMR they already run.

Curogram bundles two-way texting, reminders, mass messaging, secure online forms, text-to-pay and missed-call-to-text. It connects to the practice’s EMR, so reminders follow the schedule and texts reach the right chart.

Curogram covers all three lanes. Patients get standard SMS or secure web links, and Curogram says they never need to download an app. Curogram’s compliance page says it signs BAAs with all clients and holds SOC 2 Type 2 certification from an independent audit.

One detail to check against your policy: Curogram says it never deletes message history. That gives you a permanent audit trail, but your retention schedule has to account for it.

Pricing

Curogram publishes no prices on its website, so expect a quote after a demo.

5. iPlum

iPlum is the simplest way for a clinician to text patients from a personal phone without exposing a personal number.

iPlum is a HIPAA-compliant phone app that puts a second business number on an existing iPhone or Android. That makes it HIPAA compliant texting for medical professionals who work alone or on the move. Calls, texts and voicemail run on the business number, and the personal number stays private. HIPAA fax is a separate iPlum plan.

iPlum covers all three lanes on its Professional plan. Regular texts reach any patient number, which covers Lanes 1 and 2 once the BAA is in place. For Lane 3, patients set up a free iPlum account and read secure texts in the app or an app-less web portal.

Watch the plan name. iPlum’s Standard plan has no HIPAA features and no BAA, so a practice on Standard can’t text PHI at all.

Pricing

iPlum notes that The Campaign Registry charges a one-time $20 per business to register US texting.

6. Textline

Textline is a strong HIPAA compliant texting service for front desks that answer patient texts as a team from one shared inbox.

Textline gives several staff members one number and one inbox, with routing, tags and saved replies. Announcements send a message to a large contact list at once. Its integrations are CRM and helpdesk tools such as Salesforce, HubSpot and Zendesk rather than EHRs.

Textline covers Lanes 1 and 2 on its HIPAA plans. Textline sends a BAA for e-signature during HIPAA onboarding, and patients read messages in their own texting app. Base plans sit outside HIPAA, and Textline charges an additional fee for its HIPAA plans.

On its HIPAA page, Textline lists data encryption, multi-factor authentication, automatic sign-out, role-based access and sensitive data redaction. It also says it is SOC 2 compliant. Before HIPAA-protected texts go out, Textline requires double opt-in, so each patient replies YES first.

Pricing

Textline says its HIPAA plans carry different base fees because of their security requirements, so it quotes them on request. Add-on message credits cost $0.03 each.

7. Weave

Weave is the pick for dental and optometry practices that want their phones and patient texting from one vendor.

Weave combines VoIP phones with appointment reminders, two-way texting, bulk texting, online scheduling and digital forms. Its integrations cover dental, medical, optometry and veterinary practice management systems.

Weave covers Lanes 1 and 2, plus Lane 3 for forms and payments. Weave publishes a business associate addendum that supplements its terms of service with each client. Digital forms and text-to-pay keep intake and balances behind a link, but Weave has no portal for photos or results.

TCPA compliance stays with the practice on Weave. Its terms require you to complete 10DLC registration for your account and hold each recipient’s consent before texting. Weave can ask for proof of that consent, so keep a dated opt-in record for every patient.

Pricing

Weave says its plans start from $199 per month but quotes each plan individually.

Is text messaging HIPAA compliant?

Text messaging is HIPAA compliant when the text holds no PHI, or when PHI travels through an encrypted platform whose vendor has signed a BAA.

What makes texting HIPAA compliant is the content and the channel, and your practice controls both. Apple’s support documentation states that SMS and MMS messages aren’t end-to-end encrypted. A plain text also leaves no audit trail your practice can review, and a copy stays in the phone’s inbox.

HIPAA compliant SMS therefore depends on the platform behind it. Consumer apps fail for a different reason. iMessage and WhatsApp encrypt messages. Neither gives your practice a signed BAA, an audit trail or a way to file the thread to the chart.

Texting and HIPAA only meet when the sender is regulated. A provider becomes a covered entity by sending health information electronically in a HIPAA standard transaction, such as an electronic claim (45 CFR 160.103). A cash-only med spa that never bills a health plan electronically may sit outside HIPAA, although state privacy laws can still apply.

What turns a text message into protected health information

A text becomes PHI when it links an identifiable patient to their health, their treatment or their payments for care (45 CFR 160.103). An invoice that names a treatment is therefore PHI, even with no diagnosis in it.

Identification comes from the 18 HIPAA identifiers in the de-identification standard at 45 CFR 164.514(b)(2), which include names, dates, phone numbers and full-face photographs. The phone number a text goes to is on that list, so the content decides whether you text PHI. Three gray areas catch practices out:

• A name that reveals a specialty. A reminder signed by a fertility or addiction center tells anyone reading the lock screen why the patient goes there.
• Before-and-after photos. A full-face image is an identifier on its own, and a close-up can still identify someone through a distinctive tattoo or scar.
• Internal shorthand. “The 2:30 filler in Room 3” identifies a patient to anyone in the building, with no name in the message.

The three-lane rule: which texts each app can carry

The three-lane rule sorts each text by content: plain SMS for no PHI, a BAA-covered app for limited PHI, a portal for clinical detail. The rule is our framework, not HHS terminology, and it applies HIPAA’s definitions to the messages practices send every day.

• Lane 1, plain SMS: logistics only. A time, a date, a reply prompt or a link, with no treatment, result or balance in the text.
• Lane 2, BAA-covered texting app: limited PHI, such as a treatment name, for a patient who has agreed to texts. The message carries the least detail needed, and the platform logs it.
• Lane 3, secure portal or app: photos, results, invoices, forms and clinical answers. The text carries only a link, and the detail sits behind a login.

Lanes 1 and 2 rest on HHS guidance. HHS lets providers use unencrypted channels with patients who accept the risk, given reasonable safeguards (HHS FAQ 570). That FAQ addresses email, and we apply the same reasoning to SMS. The diagram below maps each lane to its example texts and to the apps on this list that cover it.

In practices we onboard, we often find before-and-after photos and aftercare threads sitting on a provider’s personal phone. Those are Lane 2 and Lane 3 messages traveling by Lane 1 means, and they’re the first to move. The table gives a compliant version of 12 common texts.

The quickest way to see the rule at work is one reminder rewritten. The first version below fails on three counts, and the second carries the same appointment in Lane 1.

Two rows trip teams up. A general check-in is Lane 1, but a reply describing swelling is PHI arriving by SMS. Answer that reply on the secure channel rather than continuing the plain thread.

HIPAA texting rules your practice has to meet

HIPAA texting rules set three conditions for any PHI text: Security Rule safeguards on the channel, a signed BAA with the vendor, and limited content.

The technical safeguards live in 45 CFR 164.312, and each one is either required or addressable. The table maps each safeguard, plus the BAA and Privacy Rule duties, to what it means when your team texts a patient.

The minimum necessary rule in HIPAA, at 45 CFR 164.502(b), is what keeps Lane 2 texts short. It applies to front-desk and billing texts about a patient, while treatment talk between clinicians and disclosures to the patient are exempt.

Addressable doesn’t mean optional. Under 45 CFR 164.306(d)(3), you assess whether a safeguard is reasonable and appropriate, and implement it if so. If it isn’t, you document why and put an equivalent measure in place. Record that decision in your HIPAA risk assessment.

For texting, encryption is the safeguard to implement rather than argue around. HHS proposed in January 2025 to make encryption required (90 FR 898). As of October 2026 that rule is still a proposal, and eCFR still lists encryption as addressable.

State laws can add to HIPAA, and some are stricter. California’s Confidentiality of Medical Information Act (CMIA) is one example, so check your state’s rules before you text.

Patient consent and the right to choose how you’re contacted

HIPAA doesn’t require written consent before you text a patient about their care. Patients can ask to be contacted another way, though, and you must accommodate reasonable requests under 45 CFR 164.522(b).

When a patient asks for results or photos by plain SMS, warn them, offer the secure option and document their choice. HHS’s email FAQ describes the same steps. The same channel logic governs HIPAA compliant email, so one written policy can cover both. A short front-desk script keeps the warning consistent:

• “Happy to text you. Regular texts aren’t encrypted, so they can be read on the way or by anyone with your phone.”
• “For results, photos or treatment details, we send a secure link that needs your login.”
• “If you’d still like those by regular text, I’ll note your choice on your record. You can change it anytime.”

Then log the date, the warning given and the patient’s decision in their record.

Texting within the care team, and the CMS position on orders

Staff texts about patients are still PHI, and they need the same safeguards as patient-facing messages. “Check the chart for your 2:30” passes. A patient’s name with a photo of their swelling, sent from a personal phone, doesn’t.

CMS changed its position on texted orders in 2024. Its January 5, 2018 memo said texting patient orders didn’t comply with hospital Conditions of Participation. The February 8, 2024 memo, QSO-24-05-Hospital/CAH, now permits texting patient information and orders among the care team.

The texts must go through a HIPAA compliant secure texting platform, and computerized provider order entry remains the preferred method. The memo binds hospitals and critical access hospitals only. For a med spa or private practice, it still sets a useful bar. CMS wants a secure platform, clear author identification and the message ending up in the record.

TCPA texting rules and carrier registration

Yes, texting a patient without consent can be illegal: the TCPA requires prior express consent for most automated texts, and written consent for marketing.

TCPA texting rules come from the FCC, and they apply to the same messages HIPAA does. The FCC regulations at 47 CFR 64.1200 set three levels of consent:

• Autodialed texts to a mobile number need the patient’s prior express consent.
• Texts with advertising or telemarketing content need prior express written consent.
• Health care messages from a covered entity, as HIPAA defines them, are exempt from the written-consent requirement but still need prior express consent.

A narrower FCC exemption covers healthcare texts that are free for the patient to receive. Most practice texts are charged to the recipient’s plan, so few qualify. The exemption’s conditions still make a good checklist for any Lane 1 text:

• Send only to the number the patient gave you, and include the practice’s name and contact details.
• Keep to appointment reminders, lab results, prescription notices and pre-op or follow-up instructions.
• Leave out marketing, billing and any other financial content.
• Stay within 160 characters, one text a day and three a week.
• Offer a STOP opt-out in each message and honor it immediately.

Patients can revoke consent by any reasonable method, including a reply of STOP, CANCEL or UNSUBSCRIBE. You must honor the request within 10 business days, and one confirmation text sent within five minutes is allowed.

Carrier registration is the last layer, and it’s an industry requirement rather than a law. Business texts from 10-digit numbers run on A2P 10DLC, where The Campaign Registry verifies each brand and campaign. Your texting vendor usually handles the filing, and some pass on a one-time fee, such as Spruce Health’s $19.50.

How to choose HIPAA compliant texting software

Choose HIPAA compliant texting software in this order: a BAA on your plan, the lanes it covers, then where its messages land in your records.

Most HIPAA compliant messaging software looks alike on a features page, whichever specialty it’s sold to. The differences show up in the contract and the setup, so put these questions to the vendor before you sign:

• Which plan includes the BAA? iPlum’s Standard plan and Textline’s base plans have none, so the cheapest tier can’t carry PHI.
• Is PHI encrypted at rest as well as in transit? Ask about the server and the staff app on each device.
• Can we export the audit log? You want who sent, opened and deleted each message, in a file you can keep. If you take payments by text, ask whether each payment link is logged too.
• How long do you keep messages, and can we delete them? Your retention policy should decide, not the vendor’s default.
• Does the patient need an app or an account? Every install step costs replies, so match it to your patient base.
• Do you enforce MFA, unique logins and automatic logoff? A shared front-desk login fails the unique user identification standard.
• Where does each message land? A thread filed to the patient record beats one stuck in a separate inbox.
• Who registers our number for A2P 10DLC, and at what cost? Spruce Health and iPlum both publish a one-time fee.

A SOC 2 report or HITRUST certification tells you an auditor tested the vendor’s controls. Treat it as a signal, not proof, because your own use of the app decides compliance. A HIPAA compliant secure texting platform still fails if staff text photos from the native camera roll.

Then choose the delivery model. HIPAA compliant messaging apps reach patients in one of three ways, and each trades patient effort against control:

• Native SMS with a secure link: the patient taps a link and logs in. Pabau, Curogram and Weave work this way.
• SMS only: no install and no login, which suits Lanes 1 and 2. OhMD and Textline work this way.
• Patient app or account: controls are strongest, but patients must sign in first. Spruce Health and iPlum use this for secure messages.

If you’re comparing full platforms rather than texting tools, our roundup of HIPAA compliance software covers the wider field. Choosing compliance software for practices that already runs your booking and records means one fewer vendor and one fewer BAA.

Setting up a HIPAA compliant messaging platform in your practice

A HIPAA compliant messaging platform only protects you if the whole team uses it the same way. Roll it out in this order:

• Sign the BAA. Do it before the first message that holds PHI, and file the signed copy with your vendor list.
• Configure roles and logins. Give every user their own login, turn on MFA and set automatic logoff (45 CFR 164.312(a)(2)(iii)).
• Capture consent. Record each patient’s texting opt-in and any request to avoid PHI by text, with the date and source.
• Build templates per lane. Write the Lane 1 reminders and Lane 3 link messages once, so staff never improvise PHI into a text.
• Set device rules. Staff phones run the app behind its own passcode, previews stay off the lock screen, and clinical photos never touch the native camera.
• Train the team. HIPAA requires training for new staff and after a material policy change (45 CFR 164.530(b)).
• Review the audit log. Check sent messages each month for PHI in the wrong lane, and end access on a leaver’s last day.

Write those rules into a texting policy by adapting a HIPAA compliance policy template. HIPAA requires you to keep the policy itself for six years (45 CFR 164.316(b)(2)). Texts that form part of the clinical record follow your state’s medical record retention rules.

Our guide to HIPAA training for employees covers the full program, and the three lanes make a good first module.

HIPAA texting violations and penalties

Five texting mistakes map directly onto common HIPAA violations: PHI on personal phones, wrong-number texts, missing BAAs, unencrypted lost devices and over-detailed messages.

• PHI on personal phones. Photos and threads outside a managed platform break the Security Rule’s access and audit controls.
• Wrong-number texts. A result sent to an unverified number is an impermissible disclosure.
• Missing BAAs. A texting vendor that stores PHI without a signed BAA breaks 45 CFR 164.502(e).
• Unencrypted lost devices. A lost phone holding unencrypted patient texts can become a reportable breach.
• Over-detailed messages. A reminder that names a treatment and a balance breaks the minimum necessary standard.

HIPAA civil penalties now run from $145 to $2,190,294 per violation, depending on culpability. HHS published the current amounts on January 28, 2026 (91 FR 3665), updating the table at 45 CFR 102.3. Since 2019, OCR has applied lower annual caps to the first three tiers as enforcement discretion (84 FR 18151).

Most cases never reach a fine. OCR first seeks voluntary compliance, corrective action or a resolution agreement. Our breakdown of HIPAA violation penalties covers how tiers get assigned. Three other routes add to the exposure:

• Criminal charges. Knowingly disclosing PHI carries up to $50,000 and one year in prison (42 U.S.C. 1320d-6). False pretenses raise that to $100,000 and five years, and intent to sell or harm to $250,000 and 10 years.
• State attorneys general. The HITECH Act lets them sue on behalf of state residents for Privacy and Security Rule violations.
• Breach notification. PHI encrypted to the HHS standard doesn’t count as unsecured (45 CFR 164.402). Unencrypted texts on a lost phone start the 60-day notification clock.

Texting patients securely with Pabau

Many practices we onboard text patients from three places at once: a reminder tool, the front-desk phone and a provider’s own mobile. Pabau replaces all three with one account that sends reminders, handles replies and files each message to the patient record.

Lane 3 content gets its own home, so your team never has to decide how much detail fits in a text. Patients complete intake and consent forms through the Client Portal. Before-and-after photos are captured against the patient record rather than a camera roll.

Pabau’s HIPAA compliance setting sits under Setup, then Business details, then Security. Role-based permissions, MFA, session timeouts and audit logs sit alongside it, and the BAA comes as standard for US customers. Like any tool, Pabau supports compliance alongside the policies your practice puts in place.

Text patients without putting PHI at risk

Pabau sends automated reminders from your practice account and keeps forms, consent and photos on the patient record, so treatment detail stays off staff phones.

Book a demo

Conclusion

Pick the app by the lanes your practice texts in. If your team only sends reminders, any BAA-covered SMS tool on this list will do. Once photos, results and forms enter the picture, you need a Lane 3 channel too, and fewer vendors means fewer BAAs to track.

The BAA is the line that doesn’t move. Audit a week of your sent texts against the three-lane rule, then confirm the vendor signs on the plan you’d buy. The trade-off is one extra tap for the patient, which buys an audit trail and a smaller breach risk.

Book a demo to see how Pabau keeps reminders automatic and treatment detail behind a patient login.

Continue your research

Worried a text has already gone to the wrong person? What to do if you violate HIPAA sets out the disclosure and remediation steps to take next.

Running a smaller office without a compliance officer? HIPAA compliance for medical offices covers the policies, roles and safeguards a small practice needs.

Does your team post patient results or photos online too? HIPAA and social media explains where marketing posts cross into PHI disclosures.

Want the same safeguards across your whole record system? EHR security walks through the access controls and audit logs that protect patient records.

Need to tell patients how you use their information? Notice of privacy practices gives you a template that covers communication channels and patient rights.

Frequently asked questions