This is general information, not legal advice.
Yes, a practice can text patients without breaking HIPAA. HIPAA does not ban texting, and it does not approve any particular texting tool either. What it expects is reasonable care. Keep the content limited, respect how each patient asks to be contacted, and have a business associate agreement (BAA) with any vendor that stores or sends messages for you. A second law, the Telephone Consumer Protection Act (TCPA), adds rules about consent and opting out.
What HIPAA says about contacting patients
The Privacy Rule lets a practice use patient information for treatment, payment and health care operations without a signed authorization. HHS has confirmed that providers may communicate with patients about their care "through the mail or by phone or in some other manner," and it uses appointment reminders as the example.
The most detailed HHS guidance on electronic messages is about e-mail. It says the Privacy Rule allows providers to communicate electronically with patients, provided they apply reasonable safeguards. Unencrypted e-mail is not prohibited for treatment-related communication, but HHS says other safeguards should be applied, such as limiting the amount or type of information in the message.
We have not found an HHS FAQ written specifically about texting patients. The e-mail guidance is the closest official statement. Applying it to text messages is a reasonable reading, not a guarantee, so ask a health care attorney if you need certainty.
The Security Rule applies too. HHS explains that encryption in transit is an "addressable" specification. The practice must assess the risk, choose appropriate protection and document the decision. For texting, that means writing down what you will and will not send, and why.
What belongs in a text
HIPAA does not publish a list of banned words. The table below is our practical reading of the HHS advice to limit what a message reveals. Assume any text can be read on a lock screen by someone other than the patient.
| Usually fine | Think twice | Keep out of texts |
|---|---|---|
| Practice name and phone number | A provider or specialty name that reveals a condition | Diagnoses and symptoms |
| Appointment date and time | Preparation steps tied to a procedure | Test results |
| A request to call or confirm | Balance and payment reminders | Medication names |
| A link to forms or a portal | Answers to clinical questions | Insurance member IDs |
When a conversation turns clinical, move it to a phone call or a portal message.
Patient preferences come first
The Privacy Rule says a provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations, and it may not require the patient to explain why. If a patient asks for calls only, or for no messages on a shared phone, record the request and follow it.
Your texting vendor and the BAA
A vendor that creates, receives, maintains or transmits patient information on your behalf is a business associate, and HIPAA requires a written agreement with it. There is a narrow exception for a pure conduit, such as the postal service. HHS limits that exception to transmission-only services with nothing more than temporary storage.
A texting platform that keeps your patient list and message history does more than transmit. Plan on needing a BAA, and sign it before any patient data goes in. If a vendor will not sign one, do not use it for patient messages.
"HIPAA compliant" is not a certification
HHS says it does not certify any persons or products as "HIPAA compliant." It also says that outside certifications do not absolve a covered entity of its legal obligations under the Security Rule.
Treat a "HIPAA certified" badge as marketing. Compliance is an obligation of the practice, as the covered entity, and of its vendors under their BAAs.
The second law, TCPA consent and opt-outs
The TCPA is enforced by the FCC and is about automated calls and texts, not privacy. The FCC's consumer guide says texts sent to a mobile phone using an autodialer require the recipient's consent, that consent to informational texts may be oral, and that commercial texts require written consent. Four points matter for a clinic.
- Giving a number counts, within limits. In a 2015 ruling, the FCC said that a patient who gives a phone number to a health care provider has given prior express consent to health care calls from that provider and its business associates, within the scope of the consent given and absent instructions to the contrary.
- One exemption is narrow. FCC rules exempt certain health care messages from the consent requirement, but only if the patient is not charged for them. The message must go to the number the patient provided, name the practice with contact details, serve a listed purpose such as an appointment reminder, carry no marketing or billing content, run 160 characters or less, stay within one message a day and three a week, and offer an opt-out by replying STOP. Recorded consent is the simpler foundation.
- Promotions need more. Automated marketing texts generally require prior express written consent. The same rule drops the written requirement for "health care" messages from HIPAA covered entities, but whether a given promotion counts depends on the facts. HIPAA has its own marketing rule too, which is strictest when a third party pays you to send the message. For specials, memberships or events, collect a clear written opt-in.
- Opt-outs must work. Patients may revoke consent in any reasonable way, and replies such as stop, quit, end, cancel or unsubscribe count. The rule requires requests to be honored within a reasonable time that does not exceed ten business days. In practice, stop at once.
One caveat. The TCPA's autodialer rules turn on the technology used to send a message, and the Supreme Court narrowed the definition of an autodialer in 2021. States can add their own rules, and Florida's statute covers sales texts, for example. The practical answer is to collect consent and honor opt-outs as if the rules apply.
Consent wording and a reminder template
Add a line like this to your intake form, then record the date and how consent was given.
I agree to receive text messages from [practice name] about appointments, forms and follow-up care at the mobile number I provided. Message and data rates may apply. Reply STOP to opt out. I understand that text messages are not a secure channel and may be seen by anyone with access to my phone.
Name promotions or review requests in a separate opt-in. A reminder can be this short.
[Practice name] reminder. You have an appointment on [day] at [time]. Reply C to confirm or call [phone number]. Reply STOP to opt out.
A setup checklist
- List the kinds of texts you will send.
- Add consent wording to intake and store the date and source for each patient.
- Sign a BAA with the texting vendor before loading patient data.
- Write templates that carry only what the patient needs.
- Test that STOP works and that the opt-out reaches every system that texts.
- Record requests for a different contact method and follow them.
- Stop staff from texting patients on personal phones.
Klauve runs automated text and email workflows and keeps each patient's messages on one activity thread, so the history sits in one place. That is a convenience, not compliance. The obligations in this guide stay with the practice and its vendors.
If you want to talk through how patient texting would work at your practice, talk to us.
Frequently asked questions
Is it a HIPAA violation to text a patient?
Not by itself. HIPAA permits practices to contact patients about their care, and HHS asks for reasonable safeguards instead of banning a channel. A text becomes a problem when it reveals too much, ignores a patient's stated preference or passes through a vendor with no BAA.
Do we need a patient's consent before texting appointment reminders?
HIPAA does not require a signed authorization to contact patients about their care, and that includes appointment reminders. Under the TCPA, the FCC has said that a patient who gives their number to a provider has consented to health care messages within the scope of that consent. Written consent at intake is still the cleaner record, and every opt-out must be honored.
Do we need a BAA with our texting vendor?
Plan on it. A vendor that stores patient names, numbers and message history on your behalf fits the HHS description of a business associate. The conduit exception for transmission-only services is narrower than that.
Can we text test results or a diagnosis?
HIPAA does not flatly forbid it, but HHS advises limiting the type of information sent by unencrypted e-mail, and the same caution fits texts. The safer habit is to text that a result is ready and ask the patient to call or check the portal. If a patient asks for details by text, document the request and get advice before agreeing.
What should we do when a patient replies STOP?
Stop texting that patient and record the opt-out. FCC rules allow one confirmation text with no marketing content and require opt-outs to be honored within a reasonable time, not to exceed ten business days. After that, use a contact method the patient has agreed to.