The short answer
Yes, if your practice is a HIPAA covered entity. HIPAA does not prohibit texting patients — it requires reasonable safeguards and permits unencrypted channels when the patient has been warned of the risk and still requests them. Under 45 CFR 164.522(b) you must accommodate reasonable requests for alternative communication means, and the request and warning should be documented.
Does HIPAA ban texting?
No. This is the most persistent myth in medical practice administration. The Office for Civil Rights has stated that the Privacy Rule allows covered health care providers to communicate electronically with their patients, provided they apply reasonable safeguards when doing so. Nothing in the Privacy Rule prohibits unencrypted email or SMS for treatment-related communication with the patient themselves.
Two provisions do most of the work. Under 45 CFR 164.522(b), an individual may request to receive communications by alternative means or at alternative locations, and a covered health care provider must accommodate reasonable requests. Under the right of access at 45 CFR 164.524(c)(2), an individual may request their information in the form and format they prefer, including by unsecure email, once they have been warned of the risk — OCR has been explicit that a provider is not responsible for unauthorised access occurring in transit after the individual made an informed choice.
The Security Rule still applies to electronic PHI you create, receive, maintain or transmit. Encryption under 45 CFR 164.312(a)(2)(iv) and (e)(2)(ii) is an addressable implementation specification, meaning you must assess whether it is reasonable and appropriate and document the decision — not that you may simply ignore it.
What are the actual risk points?
| Practice | Risk |
|---|---|
| Appointment reminder with no clinical detail | Low; minimum necessary satisfied |
| "Your Botox follow-up is Thursday" | Discloses treatment type to anyone reading the lock screen |
| Patient texts a post-treatment photo | Creates ePHI on a personal device; belongs in the chart |
| Staff texting from personal phones | No control, no retention, no wipe capability, no audit trail |
| Group texts and marketing blasts | Can expose one patient's number and status to others |
| Messaging via a third-party platform | Vendor is a business associate; a BAA is required |
The device question tends to matter more than the channel. A patient's own phone is outside HIPAA — the patient can share their own information however they like. Your staff's phones are not. A workforce member texting clinical content from an unmanaged personal device creates records you cannot retain, produce, secure or delete, which fails several Security Rule requirements at once and makes a breach analysis nearly impossible.
Marketing texts are a separate legal regime entirely. The Telephone Consumer Protection Act and FCC rules require prior express written consent for marketing messages to mobile numbers, with a working opt-out. A patient consenting to appointment reminders has not consented to promotional texts, and TCPA claims carry statutory damages per message.
What this means for your paperwork
Add a communication preferences section to intake that captures the channel the patient wants, the numbers and addresses to use, a plain-language risk warning for unencrypted channels, the patient's acknowledgment, whether messages may be left with others or on voicemail, and a separate opt-in for marketing messages. Under 164.522(b) you should record accommodations and any denial of an unreasonable request.
Then write a workforce texting policy: which platform is approved, that clinical content goes into the chart rather than living only on a phone, that personal devices are either enrolled in mobile device management or not used, what happens on staff departure, and how message threads containing clinical content are retained under your record retention schedule.
Sign business associate agreements with every messaging, scheduling and reminder vendor that touches PHI, and include their handling in your risk analysis under 45 CFR 164.308(a)(1)(ii)(A). Keep those agreements and your policies at least six years under 45 CFR 164.530(j)(2).
Related questions
This answer is educational and is not legal or medical advice. Requirements vary by state and change over time — verify with your own legal and clinical advisors before applying anything here in practice.