What You Can Text a Patient — and What Needs a Secure Channel

A parent texts the practice number at 7:40 a.m.: “Running late, be there by 8:15 — also, did the feeding eval show anything?” The first half of that message deserves a fast, friendly text back. The second half, answered in kind, would put a child’s name next to an evaluation finding in an unencrypted channel that lives on in two phones, two carrier systems, and whatever cloud backups either phone feeds. Same thread, same thumb, two completely different compliance situations — and the front desk has about thirty seconds to tell them apart.

Most practices resolve this tension in one of two bad ways. Some ban texting entirely and lose the one channel patients reliably answer, bleeding attendance to protect against a risk HIPAA never actually demanded they eliminate. Others drift the opposite direction: texting starts with reminders, and six months later test scores and home-program changes are riding in SMS because nobody ever drew the line. This article draws it — what federal privacy law actually says about texting patients, which messages can ride in a plain text, which need a secure channel, and the consent footing to put under all of it.

Start with what the law does not say: HIPAA contains no rule against texting patients, and no requirement that every patient-facing message be encrypted. The Department of Health and Human Services (HHS) addresses the question directly in its guidance on emailing patients, and the logic transfers to any unencrypted electronic channel: the Privacy Rule permits providers to communicate electronically with patients, provided they apply reasonable safeguards when doing so. HHS is explicit that unencrypted email is not prohibited for treatment-related communication with a patient — but that other safeguards, like limiting the amount of information in the message and confirming the address before sending, should carry the protective load instead.

The second principle is that the patient, not the practice, picks the channel. HHS says that when a provider is concerned a patient may not understand the risks of an unencrypted channel, the move is to warn the patient and let them decide — and if an unencrypted channel is unacceptable to a patient who asks for confidential communications, the practice should offer and accommodate something more secure, or fall back to mail or phone. That patient right has regulatory teeth: under 45 CFR 164.522(b), a covered health care provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations, may require the request in writing, and may not demand an explanation as a condition of honoring it.

The third principle comes from the Security Rule, and it is where “texting is fine” meets its limit. Electronic protected health information (ePHI) — any health information that identifies a patient, and a first name next to a diagnosis is enough — triggers 45 CFR 164.312(e): technical safeguards against unauthorized access to ePHI transmitted over a network. Encryption there is an “addressable” specification, which does not mean optional; it means your practice must assess whether it is reasonable and appropriate, implement it or an equivalent, and document the decision in its risk analysis. Standard SMS is unencrypted and outside your control once it leaves the phone. A practice can defensibly conclude SMS is acceptable for low-content logistics a patient has agreed to — what it cannot do is skip the analysis and let the channel decide for itself.

Those three questions — consent, content, channel — are the entire test. Every row of the map below is just the three applied to one message type.

Print this, tape it where the front desk can see it, and the thirty-second decision becomes a lookup. The dividing line running through every row is logistics versus care: a plain text may establish that an appointment exists; it may not say what the appointment is for, how it went, or what comes next clinically.

The consent conversation happens once, at intake, or it happens badly in fragments forever. One paragraph in the intake packet does three jobs at the same time: it delivers the risk warning HHS expects, it records the patient’s channel choice, and it sets the scope of what texting will be used for — which is what keeps the channel from drifting into clinical content later. It also collects the one fact the TCPA cares most about: that the patient gave you this number and agreed to receive these messages at it.

Two details in that language earn their place. “Scheduling purposes only” is the scope limit — it is what makes the later “no” easy when a parent asks for results by text, because the practice is honoring its own stated policy rather than improvising a refusal. And the no-reason-needed withdrawal line is not generosity; it mirrors 45 CFR 164.522(b), which forbids conditioning a confidential-communication accommodation on an explanation.

HIPAA is not the only federal law in the thread. The Telephone Consumer Protection Act (TCPA), enforced by the Federal Communications Commission (FCC), governs automated calls and texts to mobile numbers — which is exactly what a reminder platform sends. Its baseline is prior express consent, and the FCC has long held that a patient who voluntarily provides a mobile number has consented to be contacted at it for purposes closely related to why the number was given. That is the practical reason the intake form above captures the number and the purpose together.

In its July 2015 declaratory ruling (FCC 15-72), the Commission also exempted certain time-sensitive healthcare treatment messages — appointment reminders among them — from the prior-express-consent requirement, but under strict conditions: messages must be free to the recipient, sent only to the number the patient provided, identify the provider, stay concise, offer an opt-out that is honored immediately, and stay within one message per day and three per week per provider. Billing and collection messages are expressly outside the exemption. You do not need to memorize the conditions — you need a texting platform that enforces them and a policy that does not lean on the exemption for anything but genuine treatment logistics.

“Use a secure channel” is useless advice until you can say what qualifies. Three properties separate a secure channel from a consumer app with an encryption badge. First, encryption in transit — the property SMS lacks. Second, practice control: access that ends when an employee leaves, messages that live behind authentication rather than on a lost phone’s lock screen, and an audit trail of who saw what. Third — the one most often missed — a business associate agreement. Under 45 CFR 164.308(b), a vendor that creates, receives, maintains, or transmits ePHI on your behalf is a business associate, and you need their written assurances before the first message moves. Your reminder platform and your secure-messaging tool are business associates; the phone carrier delivering an SMS is a mere conduit and is not.

That third property is why a consumer messaging app with end-to-end encryption still fails the test. The transmission may be encrypted, but the practice controls nothing: no BAA, no access management, no audit trail, and the thread lives in employees’ personal accounts. For most therapy practices the secure channel is not exotic — it is the patient portal attached to the EHR, or a messaging feature inside a platform that already signs a BAA. The text message then has one honest job: “you have a message waiting in the portal.” The notification travels unencrypted and reveals nothing; the content sits behind a login.

Patients do not read your communication policy before texting you a question, and HHS has addressed the equivalent situation for email: when a patient initiates the exchange, the provider can assume that channel is acceptable to them unless they have said otherwise — and if the provider suspects the patient does not grasp the risk, the move is to warn once and let the patient decide. What the patient’s opening text does not do is license the practice to answer anything in kind. The parent who texts “did the feeding eval show anything?” has consented to texting; they have not asked for results by SMS, and they are probably not picturing where that answer will be stored.

The workable reply answers the logistics and moves the clinical: “Happy to go over the eval — I’ve sent the summary to your portal, and we can talk at Thursday’s session or by phone today after 3.” It takes ten seconds, honors the patient’s channel, discloses nothing, and quietly teaches every family where clinical answers live. If a patient then explicitly says “just text it to me, I understand it’s not secure,” that is a confidential-communications preference the practice may honor — warn once, get it in writing, note it in the chart, and still keep the content to what the patient actually asked for.

1. 01

   Write the one-sentence policy

   Decide what texting is for — “scheduling logistics only” is the version that survives contact with a busy front desk — and put it in your policies and the intake packet. The scope line is what makes every later channel decision a lookup instead of a judgment call.

2. 02

   Add the consent paragraph to intake

   Risk warning, scope, opt-out, and the number in the patient’s own hand. Run existing patients through it at their next visit rather than retrofitting all at once.

3. 03

   Stand up the secure channel before you need it

   Confirm the portal or messaging tool has a signed BAA, and build the reflex reply — “sent to your portal, happy to discuss by phone” — into front-desk scripts so the secure route is the easy route.

4. 04

   Wire opt-outs and preferences into the schedule

   A STOP reply must halt automated messages immediately, and a patient’s request for a different channel — or a different number, when a patient asks you not to use the home phone — gets recorded where scheduling actually looks, not in a note nobody reopens.

5. 05

   Document the decision and train to the map

   Record the SMS-for-logistics decision in your security risk analysis, post the message map at the front desk, and make the waiting-room test part of onboarding. The policy that lives only in a binder is the one that drifts.