HIPAA compliant texting: What you can send patients & how to communicate securely

HIPAA compliant texting is possible when a text holds no protected health information (PHI), or when the PHI travels through a secured platform. That platform needs encryption, access controls, audit logs and a signed business associate agreement (BAA). Plain SMS from a staff member’s phone has none of those, so it suits a bare appointment reminder and no clinical message.

The harder part is sorting the texts your team already sends. This guide gives you the three-lane texting rule, a verdict for 12 common practice texts with compliant wording for each. The guide also maps every safeguard to its HIPAA citation and adds the TCPA consent rules and current penalties.

Key takeaways

Standard SMS isn’t HIPAA compliant for PHI, but a text with no health, treatment or payment detail can go by plain SMS.

The three-lane texting rule sorts each message: Lane 1 by plain SMS, Lane 2 behind a secure link, Lane 3 never by text.

A texting vendor that stores or transmits PHI is a business associate, so sign the BAA before the first Lane 2 message.

Encryption is addressable under 45 CFR 164.312, which means you implement it or document why an equivalent safeguard is reasonable.

A HIPAA compliant text can still break the TCPA, and HIPAA civil penalties now reach $2,190,294 per violation in the top tier.

Is text messaging HIPAA compliant?

Standard text messaging is not HIPAA compliant for PHI. Texting becomes compliant when the message holds no PHI, or when it travels through a secured platform covered by a BAA. A bare appointment reminder qualifies, while a treatment photo from a personal phone doesn’t.

So is text HIPAA compliant? The content and the channel decide, and your practice controls both. Apple’s support documentation states that SMS and MMS messages aren’t end-to-end encrypted, so a third party can read them in transit. A plain text also leaves no audit trail your practice can review, and a copy stays in the phone’s native inbox.

Texting and HIPAA only meet when the sender is regulated. HIPAA binds covered entities and the business associates working for them. A provider becomes a covered entity by sending health information electronically in a HIPAA standard transaction, such as an electronic claim (45 CFR 160.103).

That detail matters in aesthetics. A cash-only med spa that never bills a health plan electronically may sit outside HIPAA, although state privacy laws can still apply. A practice that files even one electronic claim is covered, and HIPAA then governs every text its team sends about patients.

What turns a text message into protected health information

A text becomes protected health information when it links an identifiable patient to their health, their treatment or their payments for care.

HIPAA’s definition covers past, present and future health, the care provided, and payment for that care (45 CFR 160.103). An invoice that names a treatment is therefore PHI, even with no diagnosis in it.

Identification comes from the 18 HIPAA identifiers listed in the de-identification standard at 45 CFR 164.514(b)(2). The identifiers include names, dates, phone numbers, email addresses and full-face photographs. The list closes with any other unique identifying characteristic, which catches what the first 17 miss.

The phone number a text goes to is itself on that list. Every text to a patient is therefore identifiable, and the content decides whether it counts as PHI. Three gray areas catch practices out:

• A name that reveals a specialty. A reminder signed by a fertility or addiction center tells anyone reading the lock screen why the patient goes there.
• Before-and-after photos. A full-face image is an identifier on its own, and a close-up can still identify someone through a distinctive tattoo or scar.
• Internal shorthand. “The 2:30 filler in Room 3” identifies a patient to anyone in the building, with no name in the message.

Texting patients: The three-lane rule for what you can send

Texting patients safely means choosing the lane before you type. The three-lane texting rule is our framework, not HHS terminology. The rule applies HIPAA’s definitions and safeguards to the messages practices send every day.

• Lane 1, plain SMS: logistics only. A time, a date, a reply prompt or a link, with no treatment, result or balance in the text.
• Lane 2, secure link or platform: any message that names a treatment, shows a photo, reports a result or mentions money owed. The text carries a link, and the detail sits behind a login.
• Lane 3, never by text: card numbers, Social Security numbers and full medical histories. No message needs them, so they go through a payment page, a portal upload or a phone call.

Lane 1 rests on HHS guidance. HHS lets providers use unencrypted channels with patients if they apply reasonable safeguards, such as limiting the type of information (HHS FAQ 570). That FAQ addresses email, and we apply the same reasoning to SMS. The diagram below sorts the most common messages into their lanes.

When practices move onto Pabau, the practice management platform we build, we often find before-and-after photos and aftercare threads sitting on a provider’s personal phone. Those are Lane 2 messages traveling by Lane 1 means, and they’re the first ones to move. The table gives a compliant version of each common text.

Two rows trip teams up. A general check-in is Lane 1, but a reply describing swelling is PHI arriving by SMS. Answer that reply on the secure channel rather than continuing the plain thread.

HIPAA texting rules your practice has to meet

HIPAA texting rules set three conditions for any PHI text: Security Rule safeguards on the channel, a signed BAA with the vendor, and limited content.

The technical safeguards live in 45 CFR 164.312, and each one is either required or addressable. The table maps each safeguard, plus the BAA and Privacy Rule duties, to what it means when your team texts a patient.

Addressable doesn’t mean optional. Under 45 CFR 164.306(d)(3), you assess whether a safeguard is reasonable and appropriate, and implement it if so. If it isn’t, you document why and put an equivalent measure in place. Record that decision in your HIPAA risk assessment, so the reasoning exists on paper if OCR asks.

For texting, encryption is the safeguard to implement rather than argue around. HHS proposed in January 2025 to remove the addressable label and make encryption required (90 FR 898). As of October 2026 that rule is still a proposal, and eCFR still lists encryption as addressable.

Patient consent and the right to choose how you’re contacted

HIPAA doesn’t require written consent before you text a patient about their care. Patients can ask to be contacted another way, though, and you must accommodate reasonable requests.

That right sits in 45 CFR 164.522(b), the confidential communications standard, and you may ask for the request in writing. A patient can also start the conversation. HHS says that when a patient emails first, the provider can assume email is acceptable unless the patient says otherwise.

The consent most texting vendors ask you to collect is a TCPA requirement, covered in the next section. The same channel logic governs HIPAA compliant email, so one written policy can cover both channels.

When a patient asks for results or photos by plain SMS, warn them, offer the secure option and document their choice. HHS’s email FAQ describes the same steps: alert the patient to the risks and let them decide. A short front-desk script keeps the warning consistent:

• “Happy to text you. Regular texts aren’t encrypted, so they can be read on the way or by anyone with your phone.”
• “For results, photos or treatment details, we send a secure link that needs your login.”
• “If you’d still like those by regular text, I’ll note your choice on your record. You can change it anytime.”

Then log the date, the warning given and the patient’s decision in their record.

Texting within the care team, and the CMS position on orders

Staff texts about patients are still PHI, and they need the same safeguards as patient-facing messages. “Check the chart for your 2:30” passes. A patient’s name with a photo of their swelling, sent from a personal phone, doesn’t.

Minimum necessary doesn’t limit treatment conversations between clinicians (45 CFR 164.502(b)(2)). Front-desk and billing texts about a patient do fall under it, so they carry only what the task needs.

CMS changed its position on texted orders in 2024. Its January 5, 2018 memo said texting patient orders didn’t comply with hospital Conditions of Participation. The February 8, 2024 memo, QSO-24-05-Hospital/CAH, now permits texting patient information and orders among the care team.

Conditions apply. The texts must go through a HIPAA compliant secure texting platform and meet the Conditions of Participation. Computerized provider order entry (CPOE) remains the preferred method. Older guides still quote the 2018 ban, so check the date on any guidance you rely on.

The memo binds hospitals and critical access hospitals only. For a med spa or private practice, the memo still sets a useful bar. CMS wants a secure, encrypted platform, clear author identification and the message ending up in the record.

Beyond HIPAA: TCPA consent and carrier registration

A HIPAA compliant text can still break the Telephone Consumer Protection Act (TCPA) when you lack the right consent or ignore an opt-out.

TCPA texting rules come from the FCC, and they apply to the same messages HIPAA does. The FCC text message regulations at 47 CFR 64.1200 set three levels of consent:

• Autodialed texts to a mobile number need the patient’s prior express consent.
• Texts with advertising or telemarketing content need prior express written consent.
• Health care messages from a covered entity, as HIPAA defines them, are exempt from the written-consent requirement but still need prior express consent.

A narrower FCC exemption covers healthcare texts that are free for the patient to receive. Most practice texts are charged to the recipient’s plan, so few qualify. The exemption’s conditions still make a good checklist for any Lane 1 text:

• Send only to the number the patient gave you, and include the practice’s name and contact details.
• Keep to appointment reminders, lab results, prescription notices and pre-op or follow-up instructions.
• Leave out marketing, billing and any other financial content.
• Stay within 160 characters, one text a day and three a week.
• Offer a STOP opt-out in each message and honor it immediately.

Opt-out rules are stricter now too. Patients can revoke consent by any reasonable method, including a reply of STOP, CANCEL or UNSUBSCRIBE. You must honor the request within 10 business days, and one confirmation text sent within five minutes is allowed.

Carrier registration is the last layer, and it’s an industry requirement rather than a law. Business texts from 10-digit numbers run on A2P 10DLC, where The Campaign Registry verifies each brand and campaign before it can send. Practices can’t register directly, so your texting provider registers on your behalf.

How to send a HIPAA compliant text

To send a HIPAA compliant text, pick the message’s lane first. Plain SMS carries logistics only, and every message with PHI goes through a platform under a signed BAA.

HIPAA compliant SMS is mostly a habit your team builds, and six steps cover it:

1. Pick the lane. Check the message against the three-lane texting rule before you write it.
2. Use a platform under a signed BAA. A Lane 2 message goes out from the practice’s platform, never from a personal number.
3. Verify the number. Confirm it against the patient record, the way HHS suggests checking an email address before sending.
4. Send the least detail. Put the time or the link in the text, and keep the clinical detail behind the login.
5. Check it’s logged. The message should land on the patient’s record, where the audit trail shows who sent it.
6. Handle replies and opt-outs. Move clinical replies to the secure channel, and process STOP requests within the FCC’s 10-business-day limit.

Setting up HIPAA compliant text messaging across your practice

HIPAA compliant text messaging holds up only if the whole team works the same way. Write it into a texting policy and procedure, and adapt a HIPAA compliance policy template rather than starting from a blank page. The policy should settle seven points:

• Approved channels. Name the platform for Lane 2 and the practice number for Lane 1, and ban PHI on personal numbers.
• Personal devices. Staff phones run the texting app behind its own passcode, with message previews off on the lock screen.
• Photos. Clinical photos are taken inside the secured app, never with the native camera, so none land in the camera roll.
• Lost phones. The platform can remote-wipe its own data from a device, and staff report a lost phone the same day.
• Auto-logout. Sessions close after a set idle time, the automatic logoff specification at 45 CFR 164.312(a)(2)(iii).
• Offboarding. Access ends on a staff member’s last day, an addressable termination procedure under 45 CFR 164.308(a)(3)(ii)(C).
• Retention. HIPAA requires you to keep the policy itself for six years, under 45 CFR 164.316(b)(2).

Texts that form part of the clinical record follow your state’s rules, which our guide to medical record retention sets out by state.

Training closes the loop. HIPAA requires it for new staff within a reasonable time of joining, and again after a material policy change (45 CFR 164.530(b)). Our guide to HIPAA training for employees covers the full program, and the three lanes make a good first module.

What to look for in HIPAA compliant texting software

HIPAA compliant texting software must come with a signed BAA, because without one it can’t carry PHI, however strong its encryption is.

Treat the BAA as the gate, then test the rest. A HIPAA compliant texting app should give you each of these:

• Encryption in transit and at rest, for messages on the server and on staff devices.
• Unique logins for each user, multi-factor authentication and automatic logoff.
• An audit trail you can export, showing who sent, opened and deleted each message.
• Remote wipe of the app’s data on a lost phone or a departing staff member’s device.
• Optional message expiry, so old threads don’t pile up on devices.
• Integration with your scheduling and patient records, so texts land in the chart.
• Built-in opt-out handling, and numbers registered for A2P 10DLC.
• Independent security evidence on request, such as a SOC 2 report or HITRUST certification.

Then choose the delivery model. A HIPAA compliant messaging platform reaches patients in one of three ways, and each one trades patient effort against control:

• Native SMS with a secure link: the patient taps a link and logs in. Patient effort is lowest, and the text itself stays Lane 1.
• Browser chat: the text opens a secure web conversation, with no download needed.
• Patient app: controls are strongest, but patients must install and sign in before they can read a message.

If you’re comparing full platforms rather than standalone texting tools, our roundup of HIPAA compliance software covers the wider field. Choosing compliance software for practices that already runs your booking and records means one fewer vendor and one fewer BAA.

HIPAA texting violations and penalties

HIPAA civil penalties now run from $145 to $2,190,294 per violation, depending on culpability, after HHS’s 2026 inflation adjustment.

HHS published the current amounts on January 28, 2026 (91 FR 3665), updating the table at 45 CFR 102.3. Since 2019, OCR has applied lower annual caps to the first three tiers as a matter of enforcement discretion (84 FR 18151). The table shows both sets of caps.

Most cases never reach a fine. OCR first seeks voluntary compliance, corrective action or a resolution agreement, and imposes civil money penalties when those fail. Our breakdown of HIPAA violation penalties covers how tiers get assigned. Three other routes add to the exposure:

• Criminal charges. Knowingly disclosing PHI carries up to $50,000 and one year in prison (42 U.S.C. 1320d-6). False pretenses raise that to $100,000 and five years, and intent to sell or harm to $250,000 and 10 years.
• State attorneys general. The HITECH Act lets them sue on behalf of state residents for Privacy and Security Rule violations.
• Breach notification. A lost phone holding unencrypted patient texts can become a reportable breach.

The Breach Notification Rule covers unsecured PHI only, and PHI encrypted to the standard HHS specifies doesn’t count as unsecured (45 CFR 164.402). If a breach does occur, the deadlines are fixed:

• Notify affected patients without unreasonable delay, and no later than 60 calendar days after discovery.
• Notify prominent media outlets when more than 500 residents of a state or jurisdiction are affected.
• Notify HHS at the same time as patients when 500 or more people are affected. Log smaller breaches and report them within 60 days of year-end.

Texting patients securely with Pabau

Pabau keeps Lane 1 reminders automatic and Lane 2 detail behind a login. Reminders and confirmations go out from the practice account rather than a staff phone. Each patient’s opt-in is recorded in Pabau with its date, time and source, and a STOP reply ends the messages.

For Lane 2, the Client Portal and digital forms carry the detail. Patients complete intake and consent forms and manage their bookings behind their own login. Before-and-after photos are captured against the patient record, so they never need to sit on a provider’s camera roll.

Pabau also has a HIPAA compliance setting, found under Setup, then Business details, then Security. Alongside it sit role-based permissions, multi-factor authentication, session timeouts and audit logs of user activity. Like any tool, Pabau supports compliance alongside the policies your practice puts in place.

Text patients without putting PHI at risk

Pabau sends automated reminders from your practice account and keeps forms, consent and photos on the patient record, so treatment detail stays off staff phones.

Book a demo

Conclusion

Whether your team can text patients is settled, because it can. The useful question is which lane each message belongs in, and that answer should be written down before the next reminder goes out.

Audit a week of your practice’s sent texts against the three-lane texting rule. Lane 1 messages can stay as they are. Lane 2 messages need a platform with a signed BAA. The trade-off is one extra tap for the patient, which buys an audit trail and a smaller breach risk.

Book a demo to see how Pabau keeps patient reminders automated and treatment detail off your team’s personal phones.

Continue your research

Worried a text has already gone to the wrong person? What to do if you violate HIPAA sets out the disclosure and remediation steps to take next.

Running a smaller office without a compliance officer? HIPAA compliance for medical offices covers the policies, roles and safeguards a small practice needs.

Does your team post patient results or photos online too? HIPAA and social media explains where marketing posts cross into PHI disclosures.

Want the same safeguards across your whole record system? EHR security walks through the access controls and audit logs that protect patient records.

Need to tell patients how you use their information? Notice of privacy practices gives you a template that covers communication channels and patient rights.

Frequently asked questions