Texting a client can be HIPAA compliant. HHS says the Privacy Rule lets covered health care providers communicate electronically with patients when they apply reasonable safeguards, and it names limiting the amount or type of information sent over an unencrypted channel as one of those safeguards (HHS). For reminder messages left on an answering machine, HHS says a provider "might want to consider" leaving only its name, a number, and what the client needs to confirm the appointment (HHS). A reminder text can follow the same limit, and clinical detail belongs in an encrypted channel covered by a business associate agreement (BAA), such as secure messaging inside your client portal.
This guide is for health and wellness practitioners who text clients: dietitians, coaches, therapists, and functional medicine providers. It sets out four questions that decide whether a given text is compliant, what HHS says when a client asks for their records by text, what to look for in a HIPAA compliant texting app, and how to set texting up in your practice. It follows the same structure as our guide to whether email is HIPAA compliant, so if you have read that one, the logic will feel familiar.
Run any text you plan to send through these questions in order. Questions 1 to 3 apply to every text. Question 4 applies when the text carries clinical detail. A logistics-only reminder that stays within question 1's limits can go by standard SMS, and a text with clinical detail goes only through a channel that clears question 4.
Read the message as a stranger holding your client's unlocked phone would. HHS's guidance on reminder messages left on an answering machine is to limit what you disclose, for example by leaving only your practice name and number and the details needed to confirm an appointment, or by asking the person to call back (HHS). Hold a text to the same standard.
Clients have a right to ask you to contact them by a different method or at a different location, and you accommodate the request if it is reasonable. HHS's example is a client who asks for appointment reminders by email instead of on a postcard (HHS). The same guidance says that when an unencrypted channel is unacceptable to a client, you offer a more secure option. Recording the channel each client agreed to, text included, in their file at intake is good practice, and it gives your team one place to check before sending.
HHS says that when a patient starts a conversation by email, you can assume email is acceptable to them unless they have said otherwise. If you think they are unaware of the risk, you can explain it and let them decide whether to continue (HHS). HHS wrote that guidance about email. When a client texts you about their health, the cautious application is the same: reply without repeating the details, offer secure messaging, and if they want to keep texting, explain the risk and note their choice in their record.
Answer this one for any message that goes past logistics. It is the question that turns texting with clinical content into HIPAA compliant texting. Two Security Rule requirements apply.
Standard SMS travels unencrypted and has no BAA behind the carrier, which is why our email guide reserves plain texting for logistics. A secure messaging app covered by your BAA answers yes to this question, and clinical conversation can happen there.
The trade-off is convenience. Secure messaging is in-app or portal messaging, separate from SMS, so the client opens the portal or app to read each message. In Practice Better, clients read and reply from the Client Portal or the Practice Better mobile app (Practice Better).
A request for copies of records falls under a client's right of access, and HHS treats it differently from everyday messages. Clients have a right to receive copies of their records by unencrypted email if they ask. Before you send, you give a brief warning that a third party could read the information in transit and confirm they still want it that way (HHS).
For other unsecure methods, HHS says the answer depends on whether the method is within your capabilities and whether it presents an unacceptable risk to the records on your own systems, based on your Security Rule risk analysis. In every case, you cannot require a client to accept an unsecure method to get their records (HHS).
Once a warned client accepts the risk, HHS limits your responsibility to reasonable safeguards in sending, such as entering the address correctly, and a disclosure in transit falls outside it (HHS). Offer a secure option first, and keep text for a client who still asks for it after the warning.
Yes. A messaging app can carry client health information when the vendor signs a BAA with you and the app supports the Security Rule's safeguards. Ask any texting or messaging vendor these five questions before you send a single client message through it:
Practice Better's secure messaging gives you a single source for client dialogue, in the same platform as your scheduling and client records. Practice Better states that all messaging in the platform is HIPAA-compliant and encrypted end-to-end, and that Secure Messaging is included in all subscription plans (Practice Better). Practice Better lets you sign your BAA directly from your practitioner portal (Practice Better).
Your phone can be part of a compliant setup when client conversations happen in an app covered by your BAA and the phone itself is protected. Treat any texting channel with no BAA behind it as logistics-only, under question 1 above. Encryption on a messaging app, iMessage included, leaves the BAA question open. HIPAA requires a vendor that stores or transmits client health information for you to give its safeguarding assurances in writing (HHS), so check whether an app's vendor will sign a BAA with you before client health details go through it. For clinical conversation on the go, the Practice Better mobile app gives you secure messaging and instant alerts on your phone (Practice Better), and Practice Better states that instant alerts work on the mobile app for iOS and Android (Practice Better).
Protect the device too. Set a passcode, keep client conversations inside the app covered by your BAA, and add the phone to your risk analysis as a place client information can appear.
Six steps, in this order:
For the wider set of safeguards these steps sit inside, see our guide to understanding HIPAA compliance for health and wellness professionals.
Texting earns its place in a practice for the jobs it does well: a reminder the day before, a confirmation, a nudge to check the portal. Secure messaging handles the conversation that follows, with encryption, a signed BAA, and a single place for client dialogue. Setting that split up once, in your reminder templates and your intake notes, means nobody on your team has to decide it again for each message.
Practice Better puts SMS and email reminders, HIPAA-compliant secure messaging, and the client record in one platform. Start your free trial and set up your reminder templates and secure messaging in the same afternoon.
{{operations-checklist-for-better-group-practice-simple-text}}
HHS says the Privacy Rule lets providers communicate electronically with patients when they apply reasonable safeguards, including limiting the amount or type of information sent over an unencrypted channel (HHS). A text carrying clinical detail over a channel with no encryption and no business associate agreement is where the risk sits.
Yes. HHS confirms providers can communicate with patients about their care by mail, phone, or other means. For reminder messages left on an answering machine, HHS says a provider might want to consider leaving only its name, number, and what the client needs to confirm the appointment (HHS). Keep reminder texts to that. Noting each client's agreement to receive them is good practice.
You need one with any vendor that stores or transmits client health information for you, including a texting or messaging platform. HHS requires the vendor's assurances that it will safeguard the information to be in writing, which is what a business associate agreement is (HHS). Practice Better lets you sign your BAA directly from your practitioner portal (Practice Better).
Reply briefly without repeating the details, and move the conversation into your secure messaging. If the client prefers to keep texting, explain the risk of an unencrypted channel, let them decide, and note their choice in their record. HHS describes the same approach for clients who start a conversation by email.
HHS says clients can ask for copies of their records by an unsecure method. You warn them briefly that a third party could read the information in transit and confirm they still want it that way. Whether you have to agree to a specific method such as text depends on your capabilities and your Security Rule risk analysis. You can never require a client to accept an unsecure method (HHS).
Yes. Practice Better states that all messaging in the platform is HIPAA-compliant, that messages are encrypted end-to-end, and that Secure Messaging is included in all subscription plans (Practice Better). Clients message you from the Client Portal on a computer or from the Practice Better mobile app.
{{free-trial-simple-text}}
Texting a client can be HIPAA compliant. HHS says the Privacy Rule lets covered health care providers communicate electronically with patients when they apply reasonable safeguards, and it names limiting the amount or type of information sent over an unencrypted channel as one of those safeguards (HHS). For reminder messages left on an answering machine, HHS says a provider "might want to consider" leaving only its name, a number, and what the client needs to confirm the appointment (HHS). A reminder text can follow the same limit, and clinical detail belongs in an encrypted channel covered by a business associate agreement (BAA), such as secure messaging inside your client portal.
This guide is for health and wellness practitioners who text clients: dietitians, coaches, therapists, and functional medicine providers. It sets out four questions that decide whether a given text is compliant, what HHS says when a client asks for their records by text, what to look for in a HIPAA compliant texting app, and how to set texting up in your practice. It follows the same structure as our guide to whether email is HIPAA compliant, so if you have read that one, the logic will feel familiar.
Run any text you plan to send through these questions in order. Questions 1 to 3 apply to every text. Question 4 applies when the text carries clinical detail. A logistics-only reminder that stays within question 1's limits can go by standard SMS, and a text with clinical detail goes only through a channel that clears question 4.
Read the message as a stranger holding your client's unlocked phone would. HHS's guidance on reminder messages left on an answering machine is to limit what you disclose, for example by leaving only your practice name and number and the details needed to confirm an appointment, or by asking the person to call back (HHS). Hold a text to the same standard.
Clients have a right to ask you to contact them by a different method or at a different location, and you accommodate the request if it is reasonable. HHS's example is a client who asks for appointment reminders by email instead of on a postcard (HHS). The same guidance says that when an unencrypted channel is unacceptable to a client, you offer a more secure option. Recording the channel each client agreed to, text included, in their file at intake is good practice, and it gives your team one place to check before sending.
HHS says that when a patient starts a conversation by email, you can assume email is acceptable to them unless they have said otherwise. If you think they are unaware of the risk, you can explain it and let them decide whether to continue (HHS). HHS wrote that guidance about email. When a client texts you about their health, the cautious application is the same: reply without repeating the details, offer secure messaging, and if they want to keep texting, explain the risk and note their choice in their record.
Answer this one for any message that goes past logistics. It is the question that turns texting with clinical content into HIPAA compliant texting. Two Security Rule requirements apply.
Standard SMS travels unencrypted and has no BAA behind the carrier, which is why our email guide reserves plain texting for logistics. A secure messaging app covered by your BAA answers yes to this question, and clinical conversation can happen there.
The trade-off is convenience. Secure messaging is in-app or portal messaging, separate from SMS, so the client opens the portal or app to read each message. In Practice Better, clients read and reply from the Client Portal or the Practice Better mobile app (Practice Better).
A request for copies of records falls under a client's right of access, and HHS treats it differently from everyday messages. Clients have a right to receive copies of their records by unencrypted email if they ask. Before you send, you give a brief warning that a third party could read the information in transit and confirm they still want it that way (HHS).
For other unsecure methods, HHS says the answer depends on whether the method is within your capabilities and whether it presents an unacceptable risk to the records on your own systems, based on your Security Rule risk analysis. In every case, you cannot require a client to accept an unsecure method to get their records (HHS).
Once a warned client accepts the risk, HHS limits your responsibility to reasonable safeguards in sending, such as entering the address correctly, and a disclosure in transit falls outside it (HHS). Offer a secure option first, and keep text for a client who still asks for it after the warning.
Yes. A messaging app can carry client health information when the vendor signs a BAA with you and the app supports the Security Rule's safeguards. Ask any texting or messaging vendor these five questions before you send a single client message through it:
Practice Better's secure messaging gives you a single source for client dialogue, in the same platform as your scheduling and client records. Practice Better states that all messaging in the platform is HIPAA-compliant and encrypted end-to-end, and that Secure Messaging is included in all subscription plans (Practice Better). Practice Better lets you sign your BAA directly from your practitioner portal (Practice Better).
Your phone can be part of a compliant setup when client conversations happen in an app covered by your BAA and the phone itself is protected. Treat any texting channel with no BAA behind it as logistics-only, under question 1 above. Encryption on a messaging app, iMessage included, leaves the BAA question open. HIPAA requires a vendor that stores or transmits client health information for you to give its safeguarding assurances in writing (HHS), so check whether an app's vendor will sign a BAA with you before client health details go through it. For clinical conversation on the go, the Practice Better mobile app gives you secure messaging and instant alerts on your phone (Practice Better), and Practice Better states that instant alerts work on the mobile app for iOS and Android (Practice Better).
Protect the device too. Set a passcode, keep client conversations inside the app covered by your BAA, and add the phone to your risk analysis as a place client information can appear.
Six steps, in this order:
For the wider set of safeguards these steps sit inside, see our guide to understanding HIPAA compliance for health and wellness professionals.
Texting earns its place in a practice for the jobs it does well: a reminder the day before, a confirmation, a nudge to check the portal. Secure messaging handles the conversation that follows, with encryption, a signed BAA, and a single place for client dialogue. Setting that split up once, in your reminder templates and your intake notes, means nobody on your team has to decide it again for each message.
Practice Better puts SMS and email reminders, HIPAA-compliant secure messaging, and the client record in one platform. Start your free trial and set up your reminder templates and secure messaging in the same afternoon.
{{operations-checklist-for-better-group-practice-simple-text}}
HHS says the Privacy Rule lets providers communicate electronically with patients when they apply reasonable safeguards, including limiting the amount or type of information sent over an unencrypted channel (HHS). A text carrying clinical detail over a channel with no encryption and no business associate agreement is where the risk sits.
Yes. HHS confirms providers can communicate with patients about their care by mail, phone, or other means. For reminder messages left on an answering machine, HHS says a provider might want to consider leaving only its name, number, and what the client needs to confirm the appointment (HHS). Keep reminder texts to that. Noting each client's agreement to receive them is good practice.
You need one with any vendor that stores or transmits client health information for you, including a texting or messaging platform. HHS requires the vendor's assurances that it will safeguard the information to be in writing, which is what a business associate agreement is (HHS). Practice Better lets you sign your BAA directly from your practitioner portal (Practice Better).
Reply briefly without repeating the details, and move the conversation into your secure messaging. If the client prefers to keep texting, explain the risk of an unencrypted channel, let them decide, and note their choice in their record. HHS describes the same approach for clients who start a conversation by email.
HHS says clients can ask for copies of their records by an unsecure method. You warn them briefly that a third party could read the information in transit and confirm they still want it that way. Whether you have to agree to a specific method such as text depends on your capabilities and your Security Rule risk analysis. You can never require a client to accept an unsecure method (HHS).
Yes. Practice Better states that all messaging in the platform is HIPAA-compliant, that messages are encrypted end-to-end, and that Secure Messaging is included in all subscription plans (Practice Better). Clients message you from the Client Portal on a computer or from the Practice Better mobile app.
{{free-trial-simple-text}}
