Secure text messaging for healthcare: reminders, EHR tie-ins and HIPAA limits

Practice managers usually hit this question in one of two ways. Someone wants to text lab results and gets told "SMS isn't secure." Or someone wants to cut no-shows and gets quoted a secure messaging platform priced for clinical chat when all they needed was a reminder. Both requests are reasonable. They need different tools, and mixing them up either overspends or puts protected health information somewhere it shouldn't be.

This post covers three things. It separates what secure messaging is for from what plain SMS reminders are for. It shows how reminders connect to an EHR such as Practice Fusion. And it spells out what a text can contain and what consent you need first. We make Ready, an SMS platform, so we'll say clearly where SMS is the wrong answer.

Secure messaging and SMS reminders solve different problems

Standard SMS travels over carrier networks without end-to-end encryption. It sits on the patient's lock screen. It can be read by whoever holds the phone, and it lands on a recycled number if the patient changed carriers and never told you. None of that changes based on which vendor sends it. If a vendor signs a business associate agreement, that covers how the vendor handles your data. It does not make the SMS channel itself encrypted.

Secure messaging tools work differently. That means patient portals, encrypted clinical messaging apps and EHR inboxes. The patient logs in, the content stays inside an authenticated system, and you can put real clinical detail there.

Most practices end up running both: SMS gets the patient's attention, and the portal holds the substance.

What a reminder text can contain

The working rule is minimum necessary. A reminder should tell the patient there's an appointment, when it is, and how to respond. It should say nothing about why they're coming in.

A reminder that stays within those limits:

Elm Street Medical: reminder of your appointment Thu 3/12 at 9:40 AM. Reply C to confirm or R to reschedule. Reply STOP to opt out.

That's under 160 plain characters with no emoji, so it's one segment.

Fields to keep out of the body:

• Visit reason or procedure ("your colonoscopy prep", "follow-up on your biopsy")
• Provider specialty that implies a condition. A practice name like "Lakeside Oncology" or "Recovery Behavioral Health" can disclose more than any field you fill in. Consider a neutral sender name for sensitive specialties.
• Results, values or medication names
• Insurance, account or record numbers

We go field by field in the four things to never put in a patient text. The short version: if the text would embarrass the patient when read aloud by a family member, it belongs in the portal.

Two practical traps

Emoji change your bill. A single emoji switches the message to unicode. The per-segment limit drops from 160 to 70 characters (67 per part when split). A 150-character reminder with one emoji becomes 3 segments instead of 1.

Old numbers are often landlines. Older patient lists carry a lot of home phones, and texts to landlines go nowhere. See validating numbers before a recall run. On Ready, landline validation is off by default. When you switch it on, it costs $0.003 per segment.

Consent basics before the first reminder

The TCPA governs texts, and healthcare reminders are treated more gently than marketing, but "gently" isn't "anything goes." These are the basics most practices should have in place:

1. Capture the mobile number with a clear texting disclosure at intake. For example: "We'll text appointment reminders to this number. Msg & data rates may apply. Reply STOP to opt out." Record when the patient agreed and the exact wording.
2. Keep reminders informational. The moment a text promotes a new service, a sale on cosmetic treatments or a wellness package, it's marketing. Marketing needs prior express written consent.
3. Honor STOP immediately and everywhere. Opt-outs have to apply across reminders, recalls and anything else you send.
4. Respect quiet hours in the patient's time zone. Don't rely on the time zone where your front desk sits.

On Ready, inbound STOP and UNSUBSCRIBE are honored automatically. The opt-out carries across every campaign, and texts to opted-out numbers are refused up front and not charged. A campaign or drip text that lands in the patient's quiet hours is held until the window opens. A single API text is held only if sending opens within about 6 hours; otherwise the API answers 409 QUIET_HOURS_BLOCK with next_allowed_at, so your job has to send it again then.

Ready also records an attestation on each bulk send and each API send that sets consent_attested: who sent it, to how many people, and when. That gives you an audit trail of your own sending. It is not a per-contact consent record. The patient's opt-in time and wording belong in your intake system or EHR, and that's the record to keep. Patient consent to receive text messages walks through how to capture it.

Compliance stays the practice's responsibility. Tooling reduces risk; it doesn't transfer it.

Connecting reminders to your EHR

EHRs vary a lot here, so check what yours already does before buying anything. Practice Fusion and many other EHRs include some form of built-in patient reminders or partner add-ons. If the built-in option covers your volume and lets you control the wording, it may be all you need.

When practices outgrow built-in reminders, the usual reasons are these:

• They want two-way replies (C/R) that land in a shared inbox staff can work.
• They want one messaging setup across several systems, such as scheduling, billing and recall.
• They're a software company building reminders into their own product for many practices.

The pattern for connecting an EHR to an SMS API is the same whichever EHR you run. A scheduled job pulls tomorrow's appointments from the EHR's API, export or scheduling report. It builds a minimum-necessary message for each one and sends it. With Ready that's one request per patient:

POST https://api.tryready.com/v1/messages
X-API-Key: <your key>
Idempotency-Key: 6f1c2a9e-3b7d-4e51-9a0c-2d8f5e7b1c44
Content-Type: application/json

{"to": "+12125550199", "body": "Elm Street Medical: reminder of your appointment Thu 3/12 at 9:40 AM. Reply C to confirm or R to reschedule. Reply STOP to opt out.", "consent_attested": true}

A few details matter for reminders:

• Store one UUID per appointment reminder and reuse it as the Idempotency-Key. If your job retries after a timeout, the patient still gets one text, not two.
• Batch large days with POST /v1/messages/bulk. It takes up to 100 recipients per call. Bulk sends the same body to everyone, so use it for generic recall notices, not personalized times.
• Check opt-outs with GET /v1/opt-outs if you want to flag them back in the EHR. That list holds only this account's opted-out contacts, so check GET /v1/opt-outs/:phone before another tool texts a number.

The full request reference is in the messages API docs and the quickstart. Pulling appointments out of the EHR is the part you or your EHR's integration options have to supply.

Registration: pick the right use case

Every business texting from a regular 10-digit number needs A2P 10DLC registration. Unregistered traffic gets filtered by carriers.

For a practice, register reminders as notifications or customer care, not marketing. A mismatched use case is a common reason for throttling or rejection, which is covered in matching use case to what you actually send.

On Ready, registration is done in-app. There's no setup fee. The first month, $25, is charged at submit. After that it's $25/mo for registration and $2/mo per number. Most approvals take 2 to 7 days. An account can send up to 500 texts a month before it registers. The first 20 texts are free one-to-one sends, so use them before you register.

Worked example: monthly cost for a mid-size practice

Assumptions:

• 1,200 appointments a month
• Two reminders per appointment, 48 hours and 2 hours before
• Each reminder is one segment: plain text, under 160 characters, no emoji
• About a third of patients reply to the first reminder (an assumption; your rate will differ)
• One registered number

The math:

• Outbound: 1,200 × 2 = 2,400 segments
• Replies: about 400 segments. Replies are billed like sent texts.
• Total: about 2,800 segments × ($0.0075 Standard rate + $0.0045 carrier fee)
• Standard rate share: 2,800 × $0.0075 = $21, plus 2,800 × $0.0045 in carrier fees, itemized separately on the bill
• Registration: $27/mo ($25 for registration + $2 number)

That all-in figure excludes the compliance surcharge. If you switch on landline validation, add $0.003 per segment. Scrubbing is the same $0.003 per segment and is also off by default.

Compare that against what one no-show costs your schedule. A few prevented no-shows usually cover a month of reminders.

To be straight about price: raw carrier APIs like Twilio charge less per segment than Ready does. If you have developers who want to handle registration, opt-out logic and quiet hours themselves, that's a legitimate route. What Ready adds on top is in-app registration, automatic STOP handling, quiet-hours holds and a two-way inbox.

The practical takeaway

Use SMS for the nudge and the portal for the substance. Keep reminders to date, time and a reply option. Record patient consent at intake, in your own system. Register as notifications rather than marketing. Check what your EHR already does before adding a tool.

If you do want reminders running over an API with the compliance handling built in, you can sign up, send your first 20 one-to-one texts to your own staff phones, and register when you're ready to go live.