Key takeaways
- HIPAA does not ban texting or emailing patients; it requires reasonable safeguards for protected health information.
- Patients may ask to receive communications by unencrypted email or text after being informed of the risks.
- Keep message content to the minimum necessary, and avoid sensitive details in subject lines and previews.
- Vendors that send messages containing PHI on your behalf need a business associate agreement.
Patients expect appointment reminders by text and updates by email. Many providers hesitate, worried that HIPAA forbids it. It does not, but it does require thought about content, consent, vendors and security.
This article is general guidance, not legal advice. Communication rules can also be affected by other laws, such as telemarketing and consumer protection rules, and by state law.
What HIPAA allows
HHS guidance recognizes that providers may communicate with patients by email and text, provided they apply reasonable safeguards. Patients also have the right to request communications by alternative means, and HHS has stated that if a patient requests unencrypted email after being informed of the risks, providers may honor that preference. Document the patient’s preference and the warning.
Minimum necessary content
| Lower risk | Higher risk |
|---|---|
| “You have an appointment tomorrow at 10:00. Reply C to confirm.” | Diagnosis, test results or treatment details in the message |
| “A new message is waiting in your patient portal.” | Detailed clinical notes by email |
| Generic clinic name in the sender | Program names that reveal sensitive treatment, such as addiction services |
A good pattern is to send a notification by text or email and deliver sensitive content through a secure portal that requires login.
Vendors and BAAs
SMS platforms, email services, CRMs and patient engagement tools that create, receive or transmit PHI on your behalf are business associates. Sign BAAs before sending PHI through them, and confirm that their security, logging and retention meet your requirements.
Automating messages from your CRM
- Store each patient’s communication preferences and consent on their record.
- Use approved templates with minimum-necessary content.
- Respect opt-outs automatically, including keywords such as STOP for SMS.
- Log every message sent against the patient record.
- Restrict who can create or edit templates.
- Test that merge fields never expose another patient’s data.
Special care for sensitive services
Behavioral health and substance use disorder providers should be especially careful. Messages that reveal treatment can cause harm if seen by others, and substance use disorder records may also be subject to 42 CFR Part 2. Use neutral sender names and content, and confirm preferences carefully.
Practical checklist
- Written policy for patient communications by channel.
- Consent and preference capture at intake.
- BAAs with messaging and CRM vendors.
- Approved templates with minimum necessary content.
- Opt-out handling and logging.
- Staff training on what never to send by text or email.
We build compliant patient communication workflows in Salesforce for healthcare and behavioral health organizations; see our industry solutions.
A practical message flow
A clinic sends a text two days before each appointment: the clinic’s general name, the date and time, and a reply option to confirm or reschedule. Replies update the appointment record in the CRM automatically. If a patient needs paperwork completed, the text links to a secure portal login rather than including forms or details in the message. Patients who opted out of texts receive the reminder by their preferred channel instead.
What to keep out of messages
- Diagnoses, medications, test results and treatment details.
- Names of specialized programs that reveal sensitive care.
- Insurance and payment details beyond what is necessary.
- Information about other family members.
Frequently asked questions
Can we send appointment reminders by text?
Yes, generally, with appropriate safeguards, minimum necessary content and respect for patient preferences and other applicable laws.
Do we need encrypted email for all patient emails?
Encryption is strongly recommended for PHI. Patients may request unencrypted email after being informed of the risks, and that preference should be documented.
Is a standard SMS platform HIPAA compliant?
Only if the vendor signs a BAA and provides appropriate safeguards. Many consumer-grade services do not.
