Is Texting Patients HIPAA Compliant? Tools and RulesWhat HHS says about messages to patients, what belongs in a text, and which texting tools sign a BAA.

Only if the practice puts safeguards in place: texting patients fits HIPAA when the texting tool signs a Business Associate Agreement (BAA), each message carries little detail, and the patient's preference is honored. A plain text from a personal phone meets none of those conditions by default. We read HHS and vendor pages on October 9, 2026. This guide lists the rules and the tools.

HIPAA compliant texting at a glance

• HIPAA does not ban texting. HHS says the Privacy Rule "permits health care providers to communicate with patients regarding their health care."
• The Security Rule covers patient information in transit. It requires measures "to guard against unauthorized access."
• Standard SMS is not a private channel. Spruce Health puts it this way: "SMS travels over the public telecom network."
• A vendor that sends or stores patient messages for you needs a BAA. Spruce Health and OhMD state that every plan includes one. Twilio limits its BAA to two editions.
• The HHS pages we read today do not name text messaging. They address email and phone messages. Ask a qualified adviser how they apply to your practice.

Is texting a patient a HIPAA violation?

No, not by itself. HHS answers a close question about phone messages. Its FAQ says the Privacy Rule "permits health care providers to communicate with patients regarding their health care." The same FAQ tells providers to "limit the amount of information disclosed on the answering machine." HHS last reviewed that FAQ on December 28, 2022.

The risk comes from exposure. A text shows on a lock screen. A family member can read it. A wrong number can receive it. Treat each text like a voicemail that a stranger may hear.

Is SMS texting HIPAA compliant?

Standard SMS suits low-detail messages only. The Security Rule standard at 45 CFR 164.312(e)(1) requires "technical security measures to guard against unauthorized access to electronic protected health information" in transit. The rule lists encryption as an "Addressable" specification, to be used "whenever deemed appropriate." Ask your compliance adviser what that label requires of your practice.

Patient preference matters too. HHS addressed unencrypted email in a FAQ dated June 24, 2016. A patient may ask for records by unencrypted email. The practice "must provide a brief warning to the individual that there is some level of risk" and then confirm the choice. HHS extends this to other unsecure methods, "assuming the individual requests the mode and accepts the risk." That FAQ covers email and access requests. It does not name texting.

What can a practice send by text?

Send the least detail that does the job. HHS tells providers who leave phone messages to "limit the amount of information disclosed." The table applies that idea to texting. It is our working guide. It is not an HHS list.

Which texting tools sign a BAA?

We read three vendors' own pages on October 9, 2026. A fourth vendor, Klara, blocked automated reading of its security page. We give no verdict on Klara.

OhMD states: "OhMD provides an automatic BAA for every user." Spruce Health states that its BAA is "included in terms of service with every plan." Twilio states: "Customers wishing to sign a BAA with Twilio must have our Security Edition or Enterprise Edition."

Twilio is a developer platform. It is not a ready-made texting app. We could not open Twilio's HIPAA Eligible Products and Services list today. Confirm on that list that your messaging product is covered before you sign.

How do you set up HIPAA compliant texting?

Follow five steps. Step 3 has a rule behind it. HHS cites 45 CFR 164.522(b): a provider must accommodate a patient's reasonable request to be contacted by other means or at another location.

1. 1

   Pick one tool and get the BAA

   Choose a texting tool that signs a BAA on the plan you will buy. Save a copy of the agreement.

2. 2

   Move staff off personal phones

   Give staff the practice tool for every patient text. A personal number has no BAA and gives the practice no record.

3. 3

   Record each patient's preference

   Ask how the patient wants to be contacted. Explain that plain texts carry some risk. Record the answer with a date.

4. 4

   Write message templates

   Write short templates for reminders and call-back requests. Leave out diagnoses, results and medication names.

5. 5

   Review the setup each year

   Add texting to your security risk analysis. Check user accounts, retention settings and the vendor's terms.

How Webpatch helps

Texting often starts on the website. A form collects a mobile number. A chat widget offers a text back. A click-to-text button opens the patient's phone. Webpatch builds and manages websites for healthcare practices, and we check each of those entry points. We review which vendors receive patient data from the site and whether a BAA is in place. We also run The Webpatch Tracker Check to find trackers that send visitor data to ad platforms.

Two related guides cover the tools around texting: Is Google Voice HIPAA Compliant? and Which Online Forms Are HIPAA Compliant?

We are not a law firm. We work alongside your compliance adviser. Contact Webpatch to review how your site collects and uses patient phone numbers.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.