Where Clinical Questions Should Go: A Channel Map for Therapy Teams

It is 6:40 on a Tuesday evening and an occupational therapy assistant has a real question: can tomorrow’s first patient practice car transfers yet, or is she still non-weight-bearing on the left? The supervising therapist is at her kid’s soccer practice. The chart would answer it, but the assistant is driving. So the question goes where every question in the practice goes — the group text — with the patient’s first name, her surgery, and her weight-bearing status now sitting in three employees’ personal phone backups, next to memes and dinner plans, where no one will ever find it again.

Nothing about that exchange involved a bad employee. The assistant asked a good clinical question at the moment it arose; the therapist answered it; the patient got the right session. The failure is structural: the practice never decided where clinical questions should go, so they go to the fastest channel available, and the fastest channel is always the personal text thread. This article is about making that decision deliberately — a channel map that gives every message type in a therapy practice one designated home, with a protected health information (PHI) rule attached to each. PHI is any health information that identifies a patient — a first name plus a diagnosis is enough — and where it may travel is the single constraint the whole map is built around.

Texting wins because it is genuinely better at the thing your team needs most: reaching a specific person fast, on the device already in their hand, with a reasonable chance of an answer inside ten minutes. No practice ever voted to make SMS its clinical communication system. It happens one urgent question at a time, each one individually defensible, until the thread is where scheduling changes, weight-bearing statuses, and “can you co-sign my eval” all live together.

The problem is what standard texting was never built to do. The HIPAA Security Rule requires a practice to implement technical safeguards against unauthorized access to electronic PHI being transmitted over a network — and ordinary SMS between personal phones offers essentially none of them. Messages travel unencrypted, persist in carrier systems and personal cloud backups, sit behind whatever lock screen each employee chose, and remain on the phone after the employee leaves the practice. None of that is under the practice’s control, which is precisely what the Security Rule holds the practice responsible for.

There is a second cost that has nothing to do with compliance: decisions made in message threads never reach the chart. When the therapist answers “no car transfers yet, still toe-touch only,” that is clinical direction — and it now exists solely in a text thread the practice cannot search, audit, or produce. Six months later, when someone asks why the assistant held off on transfer training, the record is silent. A practice that runs on ad-hoc messaging is quietly building a second, invisible chart it does not own.

Channel decisions feel overwhelming when you approach them tool-first — there are dozens of apps, and every vendor claims to be the one place for everything. Approach it message-first instead and the problem collapses, because the traffic in a therapy practice sorts into four types. First: information that belongs in the patient record — observations, clinical decisions, direction from a supervising therapist, anything a future reader of the chart would need. Second: clinical questions that need an answer today but are not themselves the record — “is she cleared for transfers,” “which goal are we prioritizing this week.” Third: operational logistics — schedule changes, room conflicts, coverage, supplies — some of which name patients and some of which do not. Fourth: genuine urgencies, where minutes matter and the only acceptable channel is the fastest reliable one.

Each type has a different natural home, a different PHI exposure, and a different cost when it lands in the wrong place. A chart-bound decision that stays in chat is a documentation gap. A clinical question forced into the EHR inbox dies waiting for someone to log in. The map below assigns each type one home — and just as importantly, names the channel it must never use.

The “never” column is the one to print. Most teams can guess the right home for a message; what they lack is a shared, explicit statement of what is off-limits, which is why every violation starts with “I just figured it was fine to…”. Notice also what the map does not say: it never asks anyone to stop asking questions, and it keeps a genuinely free channel — the patient-free one — so the team’s social fabric does not have to route through a compliance filter.

The channel map is not a compliance document; it is an operations document that happens to keep you compliant. But it stands on three rules worth knowing in their own right, because they answer the “why can’t I just…” questions the rollout will surface.

First, the Security Rule is technology-neutral — and that cuts both ways. HHS does not publish a list of banned apps, and nothing in the rule prohibits texting as a technology. What the rule requires is that the practice implement safeguards — access controls, transmission security, and the rest — appropriate to its size and risks, and that a written risk analysis be the place where those judgments live. Encryption specifically is an “addressable” implementation specification, which does not mean optional: it means the practice must implement it if reasonable and appropriate, or document an equivalent alternative. For PHI moving between team members’ phones, it is difficult to write an honest risk analysis that concludes unencrypted SMS is fine — which is the real reason “can we just text?” is the wrong question. The right question is “can we show our safeguards were reasonable?”, and with ordinary SMS the answer is no by construction, because the practice controls none of the transport, storage, or access.

Second, any vendor that transmits or stores PHI on your behalf is a business associate, and HHS requires a written business associate agreement (BAA) before PHI touches their systems. This is the sharpest, most usable test in the whole area, because it converts a fuzzy security evaluation into a yes-or-no fact: if the messaging vendor will not sign a BAA — and the free tiers of consumer chat tools generally exist precisely so the vendor does not take on that obligation — then patient information cannot go there, whatever the app’s marketing says about encryption. One signature requirement quietly sorts the entire market for you.

Third, the minimum necessary standard — the Privacy Rule’s requirement to limit PHI to what the purpose needs — has a nuance most vendor marketing gets wrong: HHS is explicit that it does not apply to disclosures to or requests by a health care provider for treatment purposes. Two clinicians discussing a shared patient’s care can say what the care requires; HIPAA is not a gag rule between treating providers. The reason to keep messages lean anyway is practical, not legal: every detail that enters a chat thread is a detail living outside the chart, in a system with its own retention, its own export behavior, and its own breach surface. Say enough to get the answer; put the substance where the record lives.

If you want evidence that “no texting, ever” is not the standard, the clearest signal comes from the Centers for Medicare & Medicaid Services. In memo QSO-24-05, issued February 8, 2024, CMS revised its position for hospitals and critical access hospitals: texting patient information — and, newly, patient orders — among members of the care team is permissible when done through a HIPAA-compliant secure texting platform, with computerized provider order entry remaining the preferred route for orders. That memo does not govern a private outpatient therapy practice; it is survey guidance for hospital conditions of participation. But it is worth reading anyway, because it shows exactly where the federal line sits: not between texting and not texting, but between secure platforms — encrypted, access-controlled, with reliable author identification, feeding the record promptly — and consumer SMS, which sits on the wrong side of every one of those criteria.

Channel policies fail socially before they fail technically. The group text is comfortable, and a memo announcing its death reads as management taking away the one tool that works. The rollout below treats that resistance as the main engineering problem — the same posture that makes a standard operating procedure stick when a laminated binder never did.

1. 01

   Inventory a real week of messages

   Before choosing anything, skim the last week of the existing threads — with permission, not as surveillance — and tally what actually travels: how many chart-bound decisions, how many clinical questions, how many logistics. The inventory kills the two reflexive objections, “we don’t really text PHI” and “we’d never fit in one tool,” with the team’s own data.

2. 02

   Assign one home per message type, in writing

   Fill in the channel map for your actual stack: your EHR’s messaging and task queues, one secure channel for same-day clinical questions, and one deliberately free channel for patient-free logistics. The output is a one-page document — the map, the “never” column, and what to do when unsure. If it does not fit on a page, it will not survive a busy Tuesday.

3. 03

   Close the paperwork before the migration

   Sign the BAA for the secure channel, confirm named accounts for every user rather than shared logins, and write down the offboarding step — who removes a departing employee’s access, the same day, alongside the EHR deactivation. A channel someone can still read after their last day is the map’s quietest failure.

4. 04

   Have leadership move first, and redirect gently

   The owner and the lead therapists post their own clinical questions in the new channel from day one, and answer misrouted messages with the answer plus a nudge — “moving this to the clinical channel” — rather than a citation. The map is enforced by where answers appear: once the fast, reliable replies live in the right channel, the group text starves on its own.

5. 05

   Review at ninety days, then annually

   After a quarter, re-run the one-week inventory. Look for the two persistent leaks: clinical decisions still dying in the channel instead of reaching the chart, and patient details drifting into the free channel. Fold the map into onboarding and your annual HIPAA training so it survives staff turnover — a policy only the founders remember is not a policy.

None of this asks your team to communicate less, or more formally, or through more layers. It asks for exactly one thing: that the practice, rather than habit, decides where each kind of message lives. Do that once, write it on one page, and the 6:40 p.m. question still gets its ten-minute answer — in a channel you control, with the decision landing in the chart where the next clinician, the payer’s reviewer, and the patient’s daughter can all find it.