Patient communication software: types, HIPAA rules and how it differs from staff chat

Patient communication software is any tool a practice uses to exchange messages with patients outside the visit: two-way texts, automated reminders, portal messages, website chat and calls. This guide explains each type, the HIPAA and consent questions to ask any vendor, and where patient-facing tools end and internal staff communication begins. We publish this as a staff-communication company. We don't sell patient messaging, so this is a map of the category, not a pitch.

What patient communication software is

Patient communication software covers the tools a practice uses to reach patients and hear back from them between appointments. That includes appointment reminders by text, a secure message thread about a lab-order form, a portal inbox, a chat window on the practice website, and the phone system. For related topics, see our healthcare communication and HIPAA guides.

There are two basic modes:

• Two-way communication. A staff member and a patient have a conversation. For example, a patient texts asking whether they need to fast before a visit, and the front desk replies.
• One-way (automated) communication. The system sends messages based on rules or schedule data, such as reminders, recall notices and post-visit surveys. Patients can sometimes reply with a keyword like "C" to confirm, but no one is typing.

Patient communication is different from staff communication. In patient communication, one end of the conversation is a patient. In staff communication, both ends are employees: the front desk asking billing about a claim, or the practice manager posting a schedule change. These are different tool categories, with different compliance questions and different systems of record. Decide which one you're shopping for before you take vendor calls.

Vendors use "platform," "system," "solution" and "software" interchangeably. A "patient communication platform" and "patient messaging software" may be the same product, or one may be a broader suite that also handles intake, payments or reviews. Judge a product by its feature list, not its label.

Main types of patient communication and messaging tools

Two-way patient texting and secure messaging apps. These let staff text patients from a practice number rather than a personal phone. Messages usually land in a shared inbox the whole front desk can see. Typical uses:

• Answering logistics questions
• Sending a link to intake forms
• Following up after a missed call
• Checking in after a procedure

Some tools send a plain SMS. Others send a notification that opens a secure web page, which changes the compliance picture (see the HIPAA section below).

Automated patient messaging. These tools handle:

• Appointment reminders and confirmations
• Recall and reactivation messages ("You're due for your annual exam")
• Waitlist offers
• Post-visit surveys

They usually connect to the practice management or scheduling system, so messages fire from real appointment data. When that connection breaks, reminders go out for cancelled appointments or don't go out at all. Ask how sync failures are detected and reported.

Patient portals. Portals are usually part of the EHR. Patients log in to view results, request refills and send secure messages to the care team. Portal messaging keeps conversations inside the clinical record. The tradeoff is that patients must create an account and remember to log in, which many don't.

Website live chat, phone systems and fax.

• Website chat handles questions from prospective and current patients. Our guide to HIPAA-compliant live chat for websites covers when chat transcripts become PHI.
• Phone is still the main channel for many practices. Voicemail, call recording and texting from the practice number all raise the same BAA questions. See HIPAA-compliant phone systems.
• Fax persists for records requests and referrals, often through cloud fax services.

Telehealth video. Telehealth is related but separate. It replaces the visit itself rather than handling communication around it. If you need video visits, read our overview of HIPAA-compliant telehealth platforms.

Specialty variations: dental, optometry, orthopedic, urgent care, hospitals

Dental and optometry. These practices run on recall. Hygiene visits every six months and annual eye exams mean much of the messaging volume is reminders, recall notices and reactivation campaigns for patients who haven't booked in a while. Look for:

• Recall rules driven by the practice management system
• Family scheduling, so one message can cover a parent and two kids
• Easy confirmation by reply

Orthopedic and surgical practices. Care episodes run for weeks or months, from consult through surgery, physical therapy and follow-ups. Messaging centers on:

• Pre-op instructions (stop certain medications, arrive at a set time)
• Post-op check-ins
• Answering recovery questions

Because these messages carry more clinical detail, the boundary between "communication tool" and "clinical record" matters more. Ask where those threads are stored and how they reach the chart.

Urgent care. Volume is high, and much of it is walk-in. Messaging focuses on:

• Online check-in
• Wait-time updates ("You're next. Please return to the clinic in 15 minutes")
• Discharge follow-ups

Speed and simple patient-side experience matter more here than long conversation threads.

Hospitals. Health systems often buy enterprise patient engagement suites that combine portals, outreach campaigns, digital front door features and call centers across many departments. Procurement, integration and governance are on a different scale. A product built for a three-location dental group is rarely the right fit for a hospital, and the reverse is also true.

HIPAA and patient messaging: what actually applies

HIPAA doesn't ban texting or email, and it doesn't approve them automatically. Whether patient messaging is permissible depends on who handles the data, what the message says, and what the patient has agreed to.

Vendors that handle PHI need a BAA. A vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate and needs a signed business associate agreement before PHI flows through its system Under 45 CFR 160.103, a business associate is a person or entity that, on behalf of a covered entity and not as a workforce member, creates, receives, maintains or transmits PHI for a regulated function or activity, including data transmission services that need routine access to PHI. (ecfr.gov). Treat appointment details tied to a named patient as PHI unless your privacy officer advises otherwise. That means even a reminder-only tool usually needs a BAA.

Patients can choose less secure channels, with a warning. A patient may prefer plain SMS or regular email to a secure portal. HHS guidance indicates that patients can ask to receive communications by unencrypted text or email if they are told about the risk and still prefer it To be precise, the HHS guidance covers email, not text messages. Under 45 CFR 164.522(b), providers must accommodate reasonable requests to receive communications by alternative means. HHS's email FAQ says unencrypted email isn't prohibited, and that a provider can alert the patient to the risks and let the patient decide. (ecfr.gov). In practice, this means you should:

• Explain the risk
• Record the patient's preference
• Respect it

Don't default everyone to plain SMS without that step.

Keep message content to the minimum necessary. Include only the details a message actually needs. Here's how that looks in practice:

• Acceptable: "Reminder from Lakeside Family Dental: appointment Tue 9:30 a.m. Reply C to confirm."
• Too much: "Reminder: your root canal follow-up with Dr. Patel, bring your antibiotic list."

Lock-screen previews are visible to anyone holding the phone.

Automated texts have rules beyond HIPAA. The Telephone Consumer Protection Act and FCC rules govern automated texts and calls, including consent and opt-out handling. There are specific provisions for healthcare messages such as appointment reminders Under 47 CFR 64.1200(a)(9)(iv), healthcare texts to wireless numbers that are free to the recipient are exempt from prior consent only for listed purposes, such as appointment and exam confirmations and reminders. Each message must name the provider, be 160 characters or fewer, and offer a reply-STOP opt-out that is honored immediately, with no more than one message per day and three per week. FCC order FCC 26-67 (released October 1, 2026) also changed how opt-out requests apply across message categories. (ecfr.gov). Confirm with counsel which of your messages fall under those provisions. Marketing-style messages, like a whitening promotion, are typically treated differently from care-related reminders.

Consumer apps like WhatsApp and personal SMS. The first question for any consumer messenger is whether the provider will sign a BAA for your use. There are also operational problems even when the content seems harmless:

• Patient threads end up on staff members' personal phones.
• There is no central record.
• Access is hard to remove when someone leaves.

Our guide to HIPAA-compliant texting rules and options covers the alternatives in more detail.

How to choose patient communication software

Use these questions in demos and get the answers in writing.

Integration with your EHR or practice management system

• Does it read appointments and patient demographics from your specific system and version?
• Does it write messages or confirmations back to the chart?
• Is the integration native, through a partner, or file-based?

Messaging features

• Two-way texting from a practice number, including a number you already own
• Automation rules: reminder timing, recall intervals, and what happens when a patient replies "Can I move this?"
• Multi-location support: separate numbers, inboxes and templates per site, with roll-up reporting
• Shared inbox: assignment, internal notes and status, so two front desk staff don't answer the same patient

Compliance basics to confirm in writing

• A signed BAA, plus its scope (does it cover subcontractors and add-on modules?)
• Encryption in transit and at rest
• Role-based access controls and individual user logins (no shared passwords)
• Audit logs showing who viewed and sent what
• Message retention settings and export options

Consent, opt-out and preferences

• How consent is captured and stored
• How STOP and other opt-out replies are handled automatically
• How a patient's channel preference (text, email, portal) is recorded
• Support for message templates in the languages your patients speak

Pricing model

• Is pricing per provider, per location, per user, per message, or a mix?
• Are there charges for extra numbers, overage or integration setup?
• Is the BAA included or tied to a higher tier?

Patient communication vs. staff communication: why they are separate tools

	Patient communication	Staff communication
Who uses it	Staff on one end, patients on the other	Employees only: front desk, clinicians, billing, managers, IT
Typical content	Reminders, confirmations, form links, questions about visits, bills and refills	Coverage changes, task handoffs, procedures, supply issues, internal questions
System of record	EHR, PM system or patient messaging platform	Internal team chat, task lists, shared files
Compliance questions	BAA, patient consent, TCPA, opt-outs, unencrypted-channel requests	BAA if PHI is discussed, access control, offboarding, retention
Example tool categories	Two-way texting, automated reminders, portals, web chat, phone	Team chat, internal announcements, task tools

The two categories meet constantly. A patient message often creates internal work:

• A refill question needs a clinician's sign-off.
• A billing dispute goes to the billing lead.
• A missing insurance card means someone has to chase a form before Thursday.

The patient tool records the conversation with the patient. The follow-up between staff needs its own home, with an owner and a deadline. That kind of coordination is covered in our piece on communication between healthcare professionals.

When both kinds of conversation happen in one personal messenger, things break down:

• Patient details sit next to lunch plans.
• Nobody can tell who agreed to call the patient back.
• A departing employee leaves with both on their phone.

That's why many practices run three separate systems: a patient communication tool, the EHR, and a separate internal team chat.

Where internal team chat fits

Chanty is internal team communication for staff, not patient messaging. It handles the staff side after a patient contact:

• Turn a message into a task with an owner and a deadline ("Call Mrs. R back about the prior auth by 3 p.m.").
• Keep procedures in shared files.
• Post staff announcements to every location.

HIPAA compliance with a signed BAA is available from the Chanty Business plan, not the Free plan (chanty.com). The practice still configures roles and access, offboards users, and sets staff policies and training. See internal communication software for clinic staff and Chanty security, HIPAA and BAA details.

Quick checklist before you buy

1. Sort your conversations. List which are patient-facing (reminders, questions, form requests) and which are staff-only (handoffs, schedule changes, internal requests). Choose tools for each list.
2. Get a BAA from every vendor that touches PHI. That includes add-on integrations, automation services and file-storage connectors, not just the main platform. If any of them use AI, check whether AI tools like ChatGPT are HIPAA compliant.
3. Confirm consent and opt-out handling. Know how consent is captured, how STOP replies work, and how unencrypted-channel preferences are recorded for texts.
4. Write a one-page channel policy and train on it. For example: "Patient questions go through the texting inbox; anything that needs a colleague becomes a task in team chat; nothing goes through personal WhatsApp." Review it at onboarding and once a year.

FAQ

What is patient communication software?

It's software a practice uses to message patients outside the visit. That includes two-way texting, automated appointment reminders and recalls, portal messaging, website chat and phone. Some products do one of these. Others bundle several into one platform.

What is the difference between patient messaging and staff messaging?

Patient messaging has a patient on one end. Staff messaging is between employees only. They use different tools, store records in different places, and raise different compliance questions. Patient messaging adds consent and TCPA considerations that internal chat doesn't.

Is texting patients HIPAA compliant?

It can be, under certain conditions. The texting vendor should sign a BAA, message content should be kept to the minimum necessary, and access should be controlled. If a patient asks for plain unencrypted texts after being told the risk, practices can generally honor that preference That HHS guidance actually addresses email rather than texts. 45 CFR 164.522(b) requires practices to accommodate reasonable requests for alternative means of communication, and HHS's email FAQ says a provider can alert the patient to the risks of unencrypted email and let the patient decide. (ecfr.gov). Texting isn't automatically allowed or automatically prohibited.

Can a medical practice use WhatsApp to message patients?

Start with whether Meta will sign a BAA covering your use. Beyond that, using staff members' personal accounts creates problems with access control, record-keeping and offboarding. Most practices use a dedicated patient messaging tool instead.

Do I need a BAA with my patient messaging vendor?

If the vendor creates, receives, maintains or transmits PHI on your behalf, yes This follows the business associate definition in 45 CFR 160.103. (ecfr.gov). Appointment reminders tied to named patients typically count. Get the BAA signed before you send any live data.

What is automated patient messaging used for?

It's used for appointment reminders and confirmations, recall and reactivation notices, waitlist offers, and post-visit surveys. It usually runs from scheduling or practice management data and must follow consent and opt-out rules Note that the FCC's healthcare exemption in 47 CFR 64.1200(a)(9)(iv) covers only listed purposes, such as appointment and exam confirmations and reminders. Recall and reactivation notices, waitlist offers and post-visit surveys may therefore need prior patient consent, so have counsel review them. (ecfr.gov).

Is a patient portal the same as patient messaging software?

Not quite. A portal is usually part of the EHR, and patients have to log in to read and send messages. Patient messaging software typically reaches patients by text or notification without requiring a login. Many practices use both.

Is Chanty a patient communication platform?

No. Chanty is internal team communication for staff: chats, calls, announcements, files and assigned tasks. It isn't used to message patients. Practices use it alongside their patient communication tools and EHR to coordinate the internal work that patient contacts create.