HIPAA-compliant texting: rules, requirements and options

HIPAA does not ban texting. You can text protected health information (PHI) when the right safeguards are in place: a signed Business Associate Agreement (BAA) with any vendor that handles the messages, technical controls such as access control and audit logs, and a written policy your staff follow. Standard SMS and personal messengers usually don't meet those conditions. Before you compare apps, decide who is texting whom. Staff-to-staff coordination, clinician-to-clinician clinical messaging and practice-to-patient texting are three different tool categories with different requirements.

This page is general information, not legal advice. Confirm your setup with your privacy officer or legal counsel.

Is texting HIPAA compliant? The short answer

Yes, with conditions. HIPAA is technology-neutral. It doesn't name texting as allowed or forbidden. It requires covered entities and business associates to protect electronic PHI with administrative, physical and technical safeguards (45 CFR Part 164, Subpart C; the technical safeguards in 45 CFR 164.312 are access control, audit controls, integrity, person or entity authentication and transmission security). HHS has no texting-specific guidance, but its email FAQ says providers may communicate with patients electronically if they apply reasonable safeguards and comply with the Security Rule (ecfr.gov). If a texting method meets those safeguards and the vendor signs a BAA, texting PHI can be compliant.

Standard SMS and personal messengers usually fail. Common reasons:

• The carrier or app provider won't sign a BAA , though for carriers this isn't the core issue: HHS says a carrier acting merely as a conduit with only transient access doesn't need a BAA, while consumer messaging apps typically don't offer one (hhs.gov).
• There is no central control over who can read messages.
• There is no audit trail of who sent, read or deleted what.
• You can't remove a former employee's access or wipe messages from a lost phone.
• Messages sit on personal devices, in phone backups and on carrier systems.

PHI is the deciding factor. A text that says "Reminder: you have an appointment tomorrow at 10:00. Reply C to confirm" carries much less risk than one that says "Your biopsy results are in." PHI is individually identifiable health information. It includes a name, phone number or date of birth when combined with information about a person's health, care or payment for care.

Can a patient's name alone be a violation? It depends on context. "Maria, please call us back" sent to Maria's own number is low risk. A staff group text that says "Maria Lopez is coming in Thursday for her chemo consult" is PHI. So is a message from "Riverside Addiction Recovery Clinic" that includes the patient's name, because the sender identifies the type of care. The minimum necessary standard requires you to limit PHI to what the purpose needs ; more precisely, 45 CFR 164.502(b) requires reasonable efforts to limit PHI to the minimum necessary, and it doesn't apply to disclosures to the patient or to another provider for treatment, so a text to Maria herself or between her treating clinicians falls outside it (ecfr.gov). In practice, use initials or a chart number internally where possible, and leave clinical detail out of messages that don't need it.

For related topics, including HIPAA-compliant email, phone systems and AI tools, see our healthcare communication and HIPAA guides.

Three kinds of healthcare texting and why the tools differ

Most confusion about "HIPAA texting apps" comes from mixing three different jobs.

	Staff-to-staff operational	Clinician-to-clinician clinical	Practice-to-patient
Who	Front desk, admin, managers, billing, IT, clinic staff	Physicians, nurses, therapists, care teams	Practice staff and patients
Typical messages	"Room 3 needs gloves restocked," "Can someone cover Dr. Patel's front desk at 2?", "Follow up on the denied claim for chart 4471"	Consults, care coordination, orders, handoffs, critical results	Appointment reminders, two-way questions, intake or payment links
Tool category	Internal team chat with access controls	Clinical communication platform, often tied to the EHR	Patient texting software, often tied to scheduling or the EHR
Key checks	BAA, roles and permissions, offboarding, mobile apps for deskless staff	BAA, EHR integration, escalation and delivery confirmation, documentation	BAA, consent and opt-out handling, patient-facing number, integration with scheduling

Staff-to-staff operational texting replaces personal group chats about schedules, supplies, coverage and follow-ups. Some of these messages touch PHI ("call back the patient in chart 4471"), so they still need a BAA and access controls. They don't need clinical alerting.

Clinician-to-clinician clinical messaging carries orders, consults and urgent results. It needs features general chat tools aren't built or validated for, such as escalation, read receipts tied to clinical accountability and documentation back to the record. See our guide to clinical communication platforms.

Practice-to-patient texting goes to people outside your organization, on their own phones and carriers. It brings consent rules beyond HIPAA, covered below.

Many "best HIPAA texting app" lists mix all three. A patient reminder tool won't fix your staff WhatsApp group, and a team chat won't send appointment reminders. Pick the category first, then the vendor.

HIPAA texting requirements: what a compliant setup needs

Use this as a checklist for any texting method that carries PHI.

1. A signed BAA before any PHI is sent. Any vendor that creates, receives, maintains or transmits PHI for you is a business associate and must sign a BAA (45 CFR 164.308(b) requires satisfactory assurances documented in a written contract, and 45 CFR 164.504(e) sets what that contract must contain) (ecfr.gov). Check which plan the BAA requires. Many vendors offer it only on paid tiers. Integrations and add-ons connected to the tool may fall outside the vendor's BAA.

2. Technical safeguards. The Security Rule's technical safeguards cover (45 CFR 164.312; unique user identification and an emergency access procedure are required, while automatic logoff, encryption, ePHI authentication, and transmission integrity controls and encryption are addressable; HHS proposed removing the required/addressable distinction in January 2025, but that rule isn't final) (ecfr.gov):

• Unique user IDs, so every message is tied to a person, not a shared front-desk login.
• Access controls, so people see only the conversations their role needs.
• Encryption in transit and at rest. Encryption is an addressable specification, but in practice you need a documented reason if you don't use it.
• Automatic logoff or session timeouts on shared workstations.
• Audit controls that record activity.

3. Device and account controls.

• Passcodes or biometric locks on every phone that receives work messages.
• The ability to remove a user's access the day they leave, including on their personal phone.
• A clear BYOD rule: whether personal phones are allowed, which app must be used, and that PHI never goes through the phone's native SMS or a personal messenger.
• Two-factor authentication or single sign-on where the tool supports it.

4. Administrative safeguards.

• A risk analysis that explicitly covers texting and messaging (45 CFR 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of risks to ePHI; naming texting explicitly is best practice rather than rule wording) (ecfr.gov).
• A written texting policy that states what may and may not be texted, on which tools, to whom.
• Staff training at onboarding and when the policy changes.
• A retention decision: how long messages are kept, and whether anything must be copied into the medical record.

5. Remember who is responsible. No app makes a practice HIPAA compliant by itself, and HHS doesn't certify or approve texting apps ; more precisely, HHS says it doesn't endorse or otherwise recognize private organizations' HIPAA 'certifications,' and such certifications don't relieve a practice of its obligations (hhs.gov). The vendor provides safeguards and signs the BAA. Your practice configures roles, manages access, writes the policy and trains staff. For more on how to evaluate vendor claims, see what qualifies as a HIPAA-compliant app.

Texting patients: what's allowed

Patients can choose unencrypted texts. Under HIPAA, patients have the right to request communications by a method they choose. HHS has said a provider may send PHI by unencrypted text if the patient asks for it after being told about the risks ; more precisely, 45 CFR 164.522(b) requires providers to accommodate reasonable requests to receive communications by alternative means. HHS guidance addresses unencrypted email, and access requests under 45 CFR 164.524, rather than texting specifically: if a patient is warned of the risks and still prefers an unencrypted method, the provider may use it, and for access requests it isn't responsible for a breach in transit (hhs.gov). To document this:

• Explain the risk in plain words: "Regular text messages aren't encrypted and could be read by others who see your phone or by your carrier."
• Record the patient's choice in their chart or intake form, with the date and the phone number.
• Give an easy way to change the preference later.

Keep plain SMS content minimal. Appointment times, "please call the office" and links to a secure portal are reasonable. Don't send diagnoses, test results, medication changes or detailed clinical information over plain SMS, even if the patient has agreed to texts. Route those through a portal or a phone call.

Other rules also apply. HIPAA isn't the only law that governs patient texting:

• Automated or bulk texts, such as reminder campaigns, raise consent and opt-out requirements under the Telephone Consumer Protection Act and FCC rules (fcc.gov).
• Some states add privacy or consent rules for health information or for specific categories such as mental health, substance use or reproductive health.

For an overview of patient texting tools, portals and two-way messaging, see patient communication and messaging software.

Texting orders and clinical information between clinicians

Texting orders is where the rules are strictest and have changed most.

• CMS: CMS has issued guidance on texting patient orders in hospitals and critical access hospitals, and its position has changed over time. The current position is set out in QSO-24-05-Hospital/CAH (February 8, 2024): texting patient information and orders among the care team is permissible if done through a HIPAA-compliant secure texting platform and in compliance with the Conditions of Participation, and CPOE remains the preferred method of order entry (cms.gov).
• The Joint Commission: Its position on secure texting of orders is that, since June 2024, accredited organizations may text patient information and orders through a secure texting platform that transfers the information into the EHR, reversing its earlier prohibition. CPOE remains preferred. The platform must meet HIPAA Security Rule and CMS medical-record requirements and be assessed routinely, and texted orders must be dated, timed, authenticated and promptly entered in the EHR (jointcommission.org).
• Documentation: Whatever the method, orders and clinically relevant decisions must end up in the medical record. A message thread is not the record.

Clinical handoffs, critical results and urgent alerts need a purpose-built clinical communication platform and EHR documentation. A general team chat app or plain SMS doesn't provide escalation paths, guaranteed delivery or clinical accountability. Keep operational chat for operational work, such as covering a shift, chasing a supply order or assigning a callback, and keep clinical communication in clinical systems. For the wider picture, see our guide to communication between healthcare professionals.

Can therapists text clients? Guidelines for therapy practices

"Can I text my therapist?" Yes, if your therapist offers texting and you accept its limits. Ask what the texts are for, such as scheduling only or brief check-ins, when they reply, and how the messages are protected.

"Can a therapist text a client?" Yes, with informed consent, clear boundaries and appropriate safeguards.

HIPAA likely applies. Most therapists who bill insurance electronically are covered entities (under 45 CFR 160.103, a health care provider who transmits health information electronically in connection with a covered transaction, such as an insurance claim, is a covered entity) (ecfr.gov). The same texting rules apply as for any practice. See does HIPAA apply to therapists for the details, including cash-only practices.

Ethics codes and licensing boards add rules. Professional codes address electronic communication, boundaries and documentation. State licensing boards may have their own requirements. These can be stricter than HIPAA.

Policy items for a therapy practice:

• Informed consent for texting. State what texting is for, the privacy risks of the method used, and that the client can opt out.
• Response times. For "can I text my therapist anytime?": clients can send a message anytime, but the policy should state when you reply. For example: "I reply to texts Monday to Friday, 9 to 5, within one business day."
• No crisis support by text. Every consent form and auto-reply should point to emergency resources: 911, the 988 Suicide & Crisis Lifeline, or the nearest emergency room.
• When to move to a session. Clinical content that goes beyond scheduling or a brief check-in belongs in a session. Say so in the policy and in practice: "That's important. Let's talk about it on Thursday."
• Documentation. Decide which texts are clinically relevant and must be added to the client record.

Benefits and risks of secure messaging in healthcare

Benefits of a proper setup:

• Faster coordination than phone tag. A front desk can ask "Who can see a walk-in at 3:15?" and get an answer in a minute instead of paging three people.
• Fewer missed follow-ups. When a message like "call back the patient about the prior auth" has a named owner and a deadline, it doesn't get lost in a group chat.
• Staff reachable across shifts and locations. Evening staff see what the morning team agreed. A second site sees the same supply update as the first.
• A written record. You can check who agreed to what and when, instead of relying on memory.

Risks of the status quo:

• PHI in personal SMS threads and WhatsApp groups that the practice doesn't control.
• Lost or stolen phones with months of patient-related messages and no way to wipe them.
• Former staff still in the "Front Desk Team" group chat weeks after leaving.
• No record of who handled a request, so a patient callback falls through and nobody can tell why.

How to set up compliant texting for your practice

Step 1: List who texts whom, and about what. Write it down by category. For example:

• Front desk to managers: coverage and schedule changes.
• Billing to clinic staff: claim questions referencing chart numbers.
• Clinicians to clinicians: consults and results.
• Practice to patients: reminders and callbacks.

Mark which flows include PHI.

Step 2: Choose a tool per category and get a signed BAA before rollout. Don't let staff start using a tool "just for scheduling" before the BAA is signed. PHI will show up within a week. Check each vendor's current BAA scope, which plan it requires, and whether connected integrations are covered (chanty.com). Our team chat tools compared for HIPAA page summarizes common options.

Step 3: Write the policy, configure access, train staff, retire old chats.

• Write a texting policy covering approved tools, what may be texted, BYOD rules, patient consent and retention.
• Set up roles so each person sees only the conversations they need, and connect sign-in to your identity provider where possible.
• Train staff with concrete examples of what's okay and what isn't.
• Set a date to close personal group chats and remove members, and announce it.
• Add texting to your risk analysis.

The HIPAA compliance checklist for clinics covers the wider program around these steps.

Step 4: Pick an internal tool for staff coordination. For the staff-to-staff category, Chanty is one option. It's a team chat that brings chats, calls, files, announcements and assigned tasks into one workspace, with apps for iOS, Android, macOS, Windows and web. HIPAA compliance with a signed BAA is available from the Business plan, not on the Free plan (chanty.com). It's for staff coordination, not patient texting, clinical orders or urgent clinical alerting. Learn more about HIPAA-compliant chat for staff.

FAQ

Is SMS HIPAA compliant?

Standard SMS generally doesn't meet HIPAA safeguards for PHI. Carriers don't sign BAAs, and you get no access control, audit trail or remote wipe ; strictly, HHS says a carrier acting only as a conduit with transient access doesn't need a BAA, so the real gaps are the missing access control, audit trail and remote wipe (hhs.gov). The main exception is a patient who asks to receive texts after being warned of the risks.

Is texting a patient a HIPAA violation?

No, not by itself. Texting a patient is allowed when the patient has agreed and the content is appropriate for the method. Using a secure tool with a BAA, or documenting the patient's informed preference for plain SMS, keeps you on solid ground.

Can I text a patient their appointment time?

Generally yes, especially with minimal content such as date, time and a callback number. Avoid naming the specialty or reason for the visit if it reveals health information. Automated reminder campaigns also need TCPA-compliant consent and opt-out (fcc.gov).

Is texting a patient's name a HIPAA violation?

A name alone, sent to the patient, is low risk. A name combined with health details, or sent between staff on an unsecured channel, is PHI. Use initials or chart numbers internally and apply the minimum necessary standard . The standard requires reasonable efforts rather than an absolute limit, and under 45 CFR 164.502(b)(2) it doesn't apply to disclosures to the patient or to providers for treatment, so initials and chart numbers are best practice rather than a strict rule (ecfr.gov).

Can therapists text their clients?

Yes, with informed consent, clear boundaries, appropriate safeguards and a policy that excludes crisis support. Check your profession's ethics code and state board rules.

Can I text my therapist anytime?

You can send a text anytime, but your therapist will reply within the hours in their texting policy. Texting isn't for emergencies. In a crisis, call 911 or 988.

What makes a texting app HIPAA compliant?

No app is compliant on its own, and HHS doesn't approve apps. Look for a signed BAA, unique user logins, role-based access, encryption in transit and at rest, audit controls and the ability to remove access. Your practice is still responsible for configuration, policy and training.

Do I need a BAA with my texting app vendor?

Yes, if the app will create, receive, store or transmit PHI on your behalf (45 CFR 160.103 defines a business associate as one that creates, receives, maintains or transmits PHI, and 45 CFR 164.308(b), 164.502(e) and 164.504(e) require a written BAA) (ecfr.gov). Sign it before rollout, and check which plan includes it.

Can staff use their personal phones to text about patients?

Only through an approved app that your practice controls, with a device passcode and the ability to remove access when the person leaves. PHI shouldn't go through the phone's native SMS or a personal messenger. Put the rule in your BYOD policy.

Is iMessage or WhatsApp HIPAA compliant?

Neither is generally treated as a HIPAA-compliant option for PHI unless the vendor signs a BAA for the version you use, so confirm current BAA availability before any PHI is sent. Encryption alone doesn't satisfy HIPAA without a BAA, access controls and administrative safeguards.

Do we need a written HIPAA texting policy?

Yes, in practice. HIPAA requires documented policies and procedures for your safeguards, and texting is a common source of risk (45 CFR 164.316 requires reasonable and appropriate policies and procedures, kept in writing for 6 years, available to staff and reviewed periodically) (ecfr.gov). A written policy also gives staff a clear answer to "Can I text this?"