HIPAA Text Messaging Rules: What a Practice May Send

HIPAA has no approved-app list: HHS does not certify any person or product, so the rules that matter are your own safeguards, a written contract with any vendor that handles patient information, and what each message says. A second law, the TCPA (Telephone Consumer Protection Act), governs automated texts to cell phones.

I am not a lawyer, and this is not legal advice; your counsel decides how these sources apply to your practice.

Quick answer

Keep texts short, with no diagnoses or results. Sign a BAA with your texting vendor first, record consent at intake and honor every opt-out. Promotions go on a separate written-consent list. The one-page policy below holds all of it.

Why do the search results sell a label?

Vendor pages fill the top Google results for "HIPAA compliant text messaging". Google Ads Keyword Planner estimates for the US, October 2026, show about 480 searches a month at an average click price of $62.28, a US-wide figure, not what any practice pays.

HHS and its Office for Civil Rights say they do not certify any persons or products as compliant (HHS, checked 2026-10-12). HHS also says a business associate cannot self-certify or be certified by a third party in place of a contract or other written arrangement (HHS, checked 2026-10-12).

What does HHS allow when you text a patient?

HHS's FAQ covers email, not texts: providers may communicate with patients electronically "provided they apply reasonable safeguards", and while unencrypted email is not prohibited for treatment-related messages, limiting the amount or type of information in it is one such safeguard (HHS, checked 2026-10-12). A patient may ask for reminders by another reasonable means, including when unencrypted email is unacceptable to them, and a patient who emails first can be told the risks and left to decide.

HHS's right of access guidance adds that when a patient asks for a copy of their records by unencrypted email, the practice gives a brief warning that someone could read it in transit, confirms the patient still wants it, and then complies (HHS, checked 2026-10-12). Neither page states a rule for texts, so I would not stretch them to appointment texts.

These HHS pages are US rules. In Canada the safeguard duty comes from PIPEDA, whose ten principles include safeguards; an organization covered by a provincial law deemed substantially similar is generally exempt from PIPEDA within that province, and Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have such laws for personal health information (OPC Canada, checked 2026-10-12).

When does a texting vendor need a signed contract?

Under HHS guidance, a vendor that creates, receives, maintains or transmits protected health information (PHI, health information tied to a person) on your behalf is generally a business associate and needs a written business associate agreement (BAA) with you; HHS's examples include a health care app developer that contracts with a practice and handles patients' PHI for services such as patient messaging (HHS, checked 2026-10-12).

HHS limits the conduit exception to "entities that only provide transmission services" for PHI, including any temporary storage, with examples such as the US Postal Service, certain private couriers and their electronic equivalents; entities that access PHI on a regular or frequent basis to perform a service for you are not conduits (same page). In my reading, a platform that keeps your message history and sends on your schedule does more than transmit. I do not rule on any product or promise a BAA myself.

In Canada, PIPEDA keeps an organization responsible for personal information it transfers to a third party for processing and requires contractual or other means to provide a comparable level of protection (PIPEDA, Schedule 1, clause 4.1.3, checked 2026-10-12).

Ask the vendor in writing:

• Will you sign a BAA before I upload patient numbers?
• Where are messages stored, for how long, and can I delete them?
• Is there a log of who sent or opened each message?
• Does each staff member get their own login?
• Do patient replies reach the chart or stay in your inbox?
• What does the lock screen show?

What does the FCC require, separately from HIPAA?

The FCC treats a text message as a call under the TCPA (FCC 15-72, paragraph 107, checked 2026-10-12). Under its rule, an autodialed call (from an automatic telephone dialing system) to a cell phone needs prior express consent, and one that advertises needs prior express written consent: a signed agreement that clearly authorizes advertising or telemarketing messages to that number (FCC, 47 CFR 64.1200, checked 2026-10-12). The written-consent requirement exempts calls that deliver a "health care" message from a HIPAA covered entity or its business associate, so ask counsel before treating a promotion as one.

The FCC has also said that a patient who gives a provider their number has consented to health care calls covered by HIPAA within the scope of that consent, absent instructions otherwise. Separately, the same 2015 ruling exempts some health care calls and texts to wireless numbers from the consent requirement: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications and home healthcare instructions (FCC 15-72, paragraphs 141 and 146 to 148, checked 2026-10-12). Its conditions, now in 47 CFR 64.1200(a)(9)(iv), must all be met:

• Only to the wireless number the patient gave you, naming the provider with contact information.
• No telemarketing, solicitation, advertising, accounting, billing, debt-collection or other financial content, and content that complies with HIPAA privacy rules.
• Concise, generally 160 characters or fewer, and at most one message a day and three a week to each patient, calls and texts counted together.
• An easy opt-out in every message; a text must say the patient can reply STOP, and opt-outs are honored immediately.
• Free to the patient, not even counted against the plan's text limit.

For texts sent with consent, the current rule lets a patient revoke by any reasonable method: a reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" always counts, the sender may not name one exclusive way to revoke, and the request must be honored within a reasonable time, at most ten business days (FCC, 47 CFR 64.1200(a)(10), checked 2026-10-12). The exemption still names STOP as the exclusive opt-out for exempted texts, so I would stop on any of the seven words for every kind of text.

These FCC rules are US rules. In Canada, CASL covers commercial texts: it requires consent, identification and an unsubscribe mechanism, and its test is whether one purpose of the message is to encourage commercial activity (CRTC, checked 2026-10-12).

Which texts carry which obligations?

My own reading; treat every row as PHI, since a clinic's text links a person to care.

HHS defines marketing as a communication about a product or service that encourages people to buy or use it, and generally requires the patient's written authorization first. Refill reminders, care coordination and a covered entity describing its own health-related products or services are not marketing; where a third party pays the practice for marketing, the authorization must say so (HHS, checked 2026-10-12). The page is dated December 3, 2002, revised April 3, 2003, and last reviewed July 26, 2013, so have counsel check it against the current rule.

What about my own staff texting?

CMS addressed this for hospitals and critical access hospitals only. Its memo QSO-24-05-Hospital/CAH of February 8, 2024 says texting patient information and orders among the health care team is permissible through a secure texting platform, which CMS expects to meet the HIPAA Security Rule's requirements, and in compliance with the Conditions of Participation (Medicare and Medicaid standards for hospitals); computerized provider order entry remains the preferred method for orders (CMS, checked 2026-10-12). That changed CMS's memo of January 5, 2018, which said texting patient orders would not comply (CMS memo, checked 2026-10-12). A private practice is outside those conditions; I read the memo only as a signal.

Settle in writing which channel staff use with patients. A personal phone or group thread sits outside any contract or log.

Illustrative: how fast do three texts a week run out?

Illustrative: every number below is made up for an imaginary two-dentist practice, and none comes from a client.

Dr. A's patient has a cleaning on Friday. Monday brings a confirmation (1), Wednesday a reminder (2), Thursday a day-before reminder (3). If the recall system also texts her that week about an overdue exam, that is message 4, over the exemption's weekly cap of three.

Formula to repeat: messages per patient per week = confirmations + reminders + instructions + results notices + recalls + automated calls. Above 3, merge texts.

What goes in the practice's texting policy?

• Who may text patients, and from which system.
• What a text may contain: practice name, time, place, callback number and the STOP line; never a diagnosis, test, result or balance.
• How consent is recorded at intake, and how an opt-out is removed the same day.
• The promotion list, kept apart, with written consent on file.
• Where the vendor's BAA is kept and when it is reread.
• What staff do when a patient texts symptoms.
• What happens when a phone is lost or someone leaves.

For reminder wording and timing, see appointment reminder texts and patient appointment reminders; the same vendor-contract question comes up in medical answering service. My own work, HIPAA-conscious conversion tracking, keeps patient details out of ad platforms.