HIPAA Compliant Texting: Rules, Consent, and Apps (2026)
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-compliant-texting
Last updated: October 20, 2026
HIPAA compliant texting works in three lanes: lean reminders, plain SMS a patient chose after a warning, and secure apps under a signed BAA. A BAA is the Business Associate Agreement a vendor signs before it handles patient data for you. Standard SMS on its own is not safe for clinical content. CISA warns that SMS messages are not encrypted. A copy also stays on each phone that receives one. But the answer is not "never text patients." Practices text patients every day, lawfully. The rules of HIPAA compliant texting decide which lane a message belongs in. Reminders can go by plain text with safeguards. Clinical details need a covered app. And a patient can choose plain texting for themselves, once you warn them and write it down. This guide to HIPAA compliant text messaging maps the lanes, the HIPAA and TCPA consent rules, and the apps.
Disclosure: we sell no texting tool. We host the booking forms, consent records and reminder automations that HIPAA compliant texting depends on, so weigh our view with that in mind.
TL;DR: Quick answer
HIPAA compliant texting has three lanes. Lean reminders by SMS. Patient-chosen plain texting, documented. Secure apps with a BAA for everything clinical.
HHS treats appointment reminders as part of treatment, so they need no patient authorization. Keep the body lean: practice name, date, time and a callback number.
Never put a diagnosis, test result, or medication in a plain text unless the patient chose that channel after a warning. Otherwise it needs a BAA-covered app.
The TCPA sits on top of HIPAA. Get consent at booking, name your practice in each text, and honor STOP at once.
Without a BAA, keep consumer SMS, iMessage, and WhatsApp out of clinical content, unless the patient chose that channel after a warning. TigerConnect and Spruce publish their BAAs, and Twilio signs one for Security or Enterprise Edition customers, checked October 20, 2026.
We host the forms, consent records and automations behind the texts. Our BAA covers the servers and services we run; your texting vendor signs its own.
When is a text PHI?
A text is PHI when it ties a person to their health. A reminder with a name, a date, and your practice name carries minimal PHI. HHS says providers may contact patients about their care by mail, by phone or "in some other manner," and should limit what a message discloses. Its example for an answering machine message is the practice name, a number, and what is needed to confirm the appointment. HHS also lets providers communicate with patients electronically, with reasonable safeguards such as limiting what an unencrypted message says. A diagnosis, a test result, or a medication in the message body is a different matter. That content needs a covered channel. The line runs through the message body, not the medium. That line is where HIPAA compliant texting starts. It is the same logic that governs HIPAA compliant email, applied to a channel with even fewer built-in protections.
What are the three lanes of HIPAA compliant texting?
Three lanes make HIPAA compliant texting work in practice. Here is the map.
Lane | What it covers | What it requires |
|---|---|---|
Lean reminders by plain SMS | Name, date, time, practice, callback number | Minimal PHI only, TCPA consent or the FCC healthcare exemption, STOP honored, safeguards documented |
Patient-chosen plain texting | Whatever the patient asked to receive that way | Patient request, risk warning given, choice documented, sending system still controlled |
Secure messaging app with a BAA | Clinical content, results, care conversations, care team orders | Signed BAA, encryption, access controls, audit logs |
Lane one: can you text appointment reminders to patients?
Yes. HHS says appointment reminders are part of treatment, so they need no patient authorization. Keep the body lean. Name, date, time, practice, a number to call. No condition, no test, no treatment. A reminder that says "Dr. Reyes, Tuesday 2pm" passes. A reminder that says "your therapy session" just disclosed a service type. Get consent at booking and honor STOP; the TCPA section below explains why. Lean templates are the cheapest form of HIPAA compliant texting there is. Write them once, review them once, and lock them.
Lane two: can a patient choose plain texting?
Yes. HIPAA lets patients ask for communications by alternative means, and providers must accommodate reasonable requests (45 CFR 164.522(b)). HHS gives an example: a patient may ask for appointment reminders by email instead of a postcard. For copies of their records, patients can even insist on unencrypted email under the right of access (45 CFR 164.524). The provider must first give a brief warning about the risk and confirm the choice. HHS also says a provider may not force an unsecure method on a patient. HHS spells this out for email, not texting. The safe course is to apply the same warn and document steps to SMS. That record is what keeps this lane of HIPAA compliant texting defensible. Your side still needs controls on the sending system. And staff should never expand the content beyond what the patient asked for.
Lane three: which secure texting apps sign a BAA?
This is where secure messaging platforms earn their fee. This lane of HIPAA compliant texting covers real care conversations. The vendor must sign a BAA before the first message with PHI, and you still own the setup. Here is how the BAA works at three common vendors, checked on October 20, 2026.
Vendor | How the BAA works | What to know |
|---|---|---|
TigerConnect | Published BAA (last updated April 22, 2026) that forms part of the services agreement | Built for care team messaging. Says messages are secure in transit and at rest, with end-to-end encryption. |
Spruce | BAA built into the terms for every eligible organization, on trials and paid plans | SMS texting and secure app messaging. Basic $24 and Communicator $49 per user per month, before taxes and fees. Outbound SMS needs a one-time $19.50 carrier registration fee. |
Twilio | Business Associate Addendum to its terms, arranged through Twilio sales; requires Security Edition or Enterprise Edition | Use only products on its HIPAA eligible list (updated June 30, 2026). Only SMS and MMS traffic to and from US area codes is eligible. |
Twilio suits teams that build their own HIPAA compliant texting flows, such as reminders. Its eligible list added a Compliance Toolkit, which checks texts for quiet hour and opt-out risks, on June 30, 2026. The shared responsibility rule applies there too. Twilio's BAA covers Twilio's platform. Any SMS, from Twilio or Spruce, still crosses the carrier network, so the lane one and lane two content rules still apply. Your setup covers the rest, the same way it does for the AWS HIPAA eligible services a healthcare app runs on.
Suite channels like Teams chat sit under the Microsoft 365 HIPAA umbrella, and Microsoft lists Teams among the services its BAA covers. Video visits raise the same question, answered in HIPAA compliant video conferencing. Email has the same BAA question; the vendor comparison is in best HIPAA compliant email.
Can hospital care teams text patient orders?
Yes, since February 8, 2024. That day CMS sent memo QSO-24-05-Hospital/CAH to state survey agencies. It says hospital care teams may text patient information and orders through a HIPAA compliant secure texting platform. That reversed a 2018 CMS memo, which said texting orders did not comply with the Conditions of Participation. The memo covers hospitals and critical access hospitals. The platform must be secure and encrypted and must protect author identification. Orders still have to be dated, timed, authenticated and promptly placed in the medical record. Computerized provider order entry (CPOE) remains the preferred way to enter orders. CMS also expects the platform to meet the HIPAA Security Rule. For hospital teams, the secure app lane of HIPAA compliant texting is now a clinical workflow tool. Plain SMS, which CISA says is not encrypted, does not meet that bar.
What does the TCPA add on top of HIPAA?
HIPAA decides what a text may say. The Telephone Consumer Protection Act (TCPA) decides whether you may send it at all. Under the FCC's rules, texts sent to a cell phone with an autodialer need prior express consent unless an exemption applies (47 CFR 64.1200(a)(1)). Marketing texts need written consent. Health care messages from a covered entity or its business associate are carved out of that written consent rule.
The FCC also exempts some healthcare texts from the consent rule (47 CFR 64.1200(a)(9)(iv)). The conditions are strict. The text must be free to the patient and go only to the number the patient gave you. It must name your practice and give contact details. Allowed purposes include appointment reminders, lab results and prescription notifications. It must be concise, generally 160 characters or fewer, with no marketing or billing content. You may send one such message a day, and three a week at most. Each text must tell the patient they can reply STOP, and you must honor it immediately.
Outside that exemption, consent rules apply. A patient can revoke consent by any reasonable means. Replies such as stop, quit, end, revoke, opt out, cancel or unsubscribe count automatically. You must honor them within ten business days at most (47 CFR 64.1200(a)(10)). The simple path for HIPAA compliant texting is to collect consent at booking, name your practice in every text, and stop at the first STOP.
What is texting drift, and why is it a risk?
A covered platform alone does not remove the risk. The risk that remains is drift. A clinician answers a patient from a personal phone. A front desk texts results because the patient asked twice, with no warning on file. Every one of those messages moves PHI through an uncovered channel. The fix is a policy with teeth. HIPAA compliant texting happens only in the covered lanes. Staff know which lane is which. Personal phones stay out of clinical conversations. It is the same drift pattern we document for personal Zoom accounts.
Where do the texting lanes start?
On your website. The booking form that captures the phone number and the consent checkbox lives on your site. The automation that fires the reminder reads from your site's database. Those pieces hold PHI before HIPAA compliant texting even starts. They need BAA-covered hosting and clean HIPAA compliant WordPress forms. Otherwise the texting lane leaks before the first message sends.
If that automation runs on n8n, our guide to an n8n HIPAA compliant setup shows where the data from each run lands. The booking side is mapped in is Calendly HIPAA compliant. The wider visit path is in HIPAA compliant telehealth.
How we handle it: We sell no texting tool. We host the booking forms, consent records and reminder automations behind your texts on single-tenant AWS. Our BAA is signed within 24 hours of signup, before patient data moves. It covers the servers and services we run, so your texting vendor still signs its own. Every plan of our HIPAA compliant hosting includes a web application firewall, encryption at rest and in transit, six-year audit logging and tested encrypted backups. We support 17 platforms, including WordPress and n8n. Managed plans start at $229 a month, and the Performance tier for n8n hosting starts at $259. Plans are monthly, with no long-term contract; see pricing.
We are the wrong choice if all you need is a texting app. Sign a BAA with a messaging vendor instead. To see which other practice systems need a HIPAA host, read healthcare IT hosting.
Frequently asked questions
Is texting HIPAA compliant?
It can be, in three lanes. Lean appointment reminders by SMS with safeguards. Plain texting a patient chose after a documented risk warning. And secure messaging apps under a signed BAA. Without that patient choice, standard SMS is not HIPAA compliant texting for clinical details.
Can I text appointment reminders to patients?
Yes. HHS treats appointment reminders as treatment, so no authorization is needed. Reminders are the simplest form of HIPAA compliant texting. Keep the body to name, date, time, practice and a callback number. Under the TCPA, get consent at booking or meet every condition of the FCC healthcare exemption.
Can a patient ask me to text them normally?
Yes. HIPAA requires providers to accommodate reasonable requests for other ways of communicating. Warn the patient that plain SMS is not secure. Document the warning and their choice, then honor it. Your sending system still needs its own controls.
Is WhatsApp or iMessage HIPAA compliant?
Not for clinical content without a BAA. Apple's iCloud terms bar covered entities from using iCloud for PHI or in a way that makes Apple a business associate. Meta's WhatsApp Business Platform terms say Meta is not a business associate and the platform is not HIPAA compliant. Encryption without a BAA fails the contract test.
Do I need a BAA with my texting platform?
Yes, for any platform that creates, receives, maintains or transmits PHI for you (45 CFR 164.308(b)). TigerConnect and Spruce publish their BAAs. Twilio signs one through its sales team, and only for Security or Enterprise Edition customers. Get the BAA signed before the first patient message.
Is texting clients HIPAA compliant for therapists?
Yes. HIPAA compliant texting works for therapists in the same three lanes. Session reminders should name only the practice, date and time, never the service type. Plain texting can work when the client chose it after a documented warning. Anything clinical belongs in a secure app under a BAA.
Can hospital staff text patient orders?
Yes, under CMS memo QSO-24-05 from February 8, 2024. Care team members may text orders through a HIPAA compliant secure texting platform. CPOE remains the preferred route. Plain SMS does not meet the memo's secure and encrypted bar.
Recap: HIPAA compliant texting
To recap, HIPAA compliant texting runs in three lanes. Keep reminder texts lean and consented. Let patients choose plain texting only after a documented warning. Put everything clinical in a secure app under a signed BAA. Follow the TCPA on consent and STOP. Keep personal phones out of it. And remember the lanes start at your website. The forms, consent capture, and automations behind the texts need BAA-covered infrastructure of their own.
Request a quote for your practice, request a quote for a healthtech build, or compare plans on pricing.
This article is general information, not legal advice. HHS guidance, FCC TCPA rules, the CMS memo and vendor BAA terms were checked on October 20, 2026 and can change. Confirm current terms with each vendor, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting, not texting services. Reviewed October 2026.
Sources
HHS: Are appointment reminders allowed under the HIPAA Privacy Rule without authorizations?
HHS: May physician's offices or pharmacists leave messages for patients at their homes?
45 CFR § 164.522(b) (confidential communications): law.cornell.edu
45 CFR § 164.524 (right of access): law.cornell.edu
45 CFR § 164.308(b) (business associate contracts): law.cornell.edu
45 CFR § 164.312(e) (transmission security): law.cornell.edu
FCC TCPA rules, 47 CFR § 64.1200 (consent, healthcare exemption, revocation): law.cornell.edu
CMS: Memo QSO-24-05-Hospital/CAH, Texting of Patient Information and Orders (February 8, 2024)
TigerConnect: Business Associate Agreement and Clinical Collaboration platform
Spruce: Plans and pricing and Terms of Service for Organizations (Attachment A, BAA)
Twilio: Twilio and HIPAA, HIPAA Eligible Services and Architecting for HIPAA on Twilio
Apple: iCloud Terms and Conditions
Meta: Meta Terms for WhatsApp Business Platform (Section 4.2)
Microsoft: HIPAA and the HITECH Act (in-scope services)