Is SMS HIPAA compliant? Rules for healthcare and regulated messaging

No channel is "HIPAA compliant" by itself. HIPAA regulates what covered entities and their business associates do with protected health information (PHI). It does not certify phones, apps or carriers. So "is SMS HIPAA compliant?" really asks three things: what you put in the message, who you send it to and with what consent, and what kind of message it is. That third question decides which rules apply, and teams most often get it wrong.

This post covers all three for medical practices, dental groups, clinics, and the software platforms that text on their behalf. It is practical guidance, not legal advice. Have counsel review your specific workflows.

The short answer: texting is allowed, PHI in the body is the risk

HHS has said for years that covered entities can communicate with patients by text and unencrypted email. The conditions are that the patient prefers that channel, has been told the risks, and that you apply the "minimum necessary" standard. Standard SMS is not encrypted end to end. It sits on the patient's lock screen, in carrier systems, and on a shared family iPad.

The safe operating model for most practices is simple: design messages so they carry no PHI at all. A text that says "You have an appointment tomorrow at 2:30 PM. Reply C to confirm" tells a stranger almost nothing. A text that says "Reminder: your follow-up with Dr. Patel at the Oncology Center tomorrow" discloses a diagnosis category by implication.

We cover the specific fields in the four fields to never put in a patient text. The quick version:

• Never include diagnosis, condition, medication names, test results, or a specialty department name that implies a condition.
• Avoid full patient name plus date of birth, or any identifier that links a person to a record.
• Fine in most cases: practice name, appointment date and time, a callback number, a link to a secure portal that requires login.

If your workflow does need PHI in the message, you are in different territory. You need the patient's informed preference documented, and you need a vendor willing to sign a business associate agreement (BAA). Ask any vendor about a BAA before PHI goes through it, and that includes us. Most practices can avoid the question entirely by keeping PHI behind a portal login.

Marketing vs. treatment: the classification that changes everything

The slug of this post says "direct marketing classification" for a reason. Two separate laws care whether a text is marketing, and they define it differently.

Under HIPAA

HIPAA's marketing rule requires the patient's written authorization before you use PHI to send communications that encourage someone to buy a product or service. Several categories are carved out and are generally not "marketing" under HIPAA:

• Appointment reminders and scheduling
• Treatment communications from the provider about that patient's own care
• Refill reminders for a drug currently prescribed (within cost limits on any payment you receive)
• General health communications that don't promote a specific third-party product

A practice texting "Time for your 6-month cleaning, book here" to its own patients usually falls under treatment or health care operations. A practice texting its patient list a promotion for a whitening kit made by a manufacturer that paid for the outreach is marketing. That second case needs authorization.

Under the TCPA

The TCPA asks a different question: is the text telemarketing, and did you send it with an automated system? Marketing texts generally need prior express written consent. Informational texts, like appointment reminders, generally need prior express consent, which providing a number for that purpose can often satisfy. The FCC has carved out a narrow exemption for certain health care messages, but it has strict conditions. Don't build a program on it without counsel.

The practical trap: a reminder with an upsell attached ("Your appointment is Tuesday. Ask about our new Botox packages!") can turn an informational message into a marketing one under the TCPA. Split them into separate messages under separate consent. Our prior express written consent vs implied consent post walks through the line.

Under the carriers (10DLC)

A third classifier is the 10DLC campaign you register. Carriers review your use case and sample messages. If you register "Marketing" and send reminders, or register reminders and send promotions, you invite throttling or suspension. Healthcare senders also hit extra scrutiny on anything that looks like prescription drug promotion. See matching your use case to what you actually send.

Consent: what to collect and where it lives

Get consent at intake, separately for each purpose:

1. Appointment and care texts: a checkbox on the intake form or portal that states the number, the purpose, frequency ("varies"), "Msg & data rates may apply" and "Reply STOP to opt out."
2. Promotional texts: a separate, unchecked-by-default box with explicit written-consent language. Don't make it a condition of care.
3. PHI-by-text (if you do it at all): a documented preference plus a risk acknowledgment.

Store the timestamp, the exact wording shown, the form or page URL, and the source (front desk, portal, web form). That record belongs in your EHR, practice management system or CRM. Ready records the sender's attestation on each bulk send and each API send that sets consent_attested: who sent, to how many contacts, and when. That is an audit trail of your promises. It is not a per-contact consent record, and a keyword reply doesn't create one. Your system has to keep the per-patient proof. How to get and record patient consent has form language you can adapt.

Safe message templates

Each of these is GSM-7 with no emoji and under 160 characters, so each is one segment:

• "Hi from Lakeside Dental: your appointment is Thu 3/14 at 10:00 AM. Reply C to confirm or call 555-0142. Reply STOP to opt out."
• "Lakeside Family Clinic: you have a new message in your patient portal. Log in at portal.example.com. Reply STOP to opt out."
• "Lakeside Dental: it's been 6 months since your last visit. Book at example.com/book or call 555-0142. STOP to opt out."
• "Your prescription refill is ready for pickup at Lakeside Pharmacy. Questions? 555-0188. Reply STOP to opt out."

None of them names a condition, a drug or a provider specialty. The refill one names no medication, which is deliberate.

What a platform should handle for you

If you run a healthcare SaaS product or a practice-management platform that texts on behalf of many practices, these are the controls worth requiring from your messaging layer. Ready includes each of them:

Landline validation matters more in healthcare than most verticals. Older patient lists carry a lot of home numbers. See validating numbers before a recall run.

For developers, a single reminder goes through POST /v1/messages with consent_attested: true, which is your promise that this patient agreed to texts:

POST https://api.tryready.com/v1/messages
X-API-Key: <key>
Idempotency-Key: 6f1c2a9e-3b7d-4e21-9a0f-5c8d2e7b1a44

{"to": "+12125550199", "body": "Lakeside Dental: your appointment is Thu 3/14 at 10:00 AM. Reply C to confirm. STOP to opt out.", "consent_attested": true}

Keep the body PHI-free here as well. Full reference: docs.tryready.com/api/messages.

What it costs: a worked example

Assumptions for this example: a practice sends 2,000 one-segment reminders a month, and about 600 patients reply once ("C").

• Outbound: 2,000 × $0.0075 = $15, plus 2,000 × $0.0045 carrier fee
• Replies (billed like a sent text): 600 × $0.0075 = $5, plus 600 × $0.0045
• Registration: $25 at submit, then $25/mo for registration + $2 per number

That all-in figure excludes the compliance surcharge. If you switch on both scrubbing and landline validation, add $0.003 per sent segment each: 2,000 × 2 × $0.003 = $12 (replies are not surcharged).

One emoji changes the math. A 140-character reminder with a single emoji becomes 3 segments instead of 1, which roughly triples that line of the bill. That's another reason to keep healthcare texts plain.

Raw CPaaS APIs such as Twilio, and GoHighLevel's LeadConnector, price lower per segment than our Standard rate. If you already have registration, STOP handling, quiet hours and scrubbing built, they may be the right call. What we include is that layer, so your team doesn't build and maintain it. Current rates are at tryready.com/pricing.

The practical takeaway

Texting patients is permitted. The risk comes from what's in the message and how you classify it:

• Keep PHI out of the body and behind a portal login.
• Treat reminders and promotions as separate programs, with separate consent and separate 10DLC campaigns.
• Store per-patient consent proof in your own system.
• Use STOP handling, quiet hours and scrubbing to reduce risk. They are good practice, not immunity. Compliance stays the sender's responsibility.

For the wider TCPA and HIPAA checklist, read healthcare SMS compliance requirements. If you want to test the setup, sign up and use your first 20 free one-to-one texts to check your reminder wording before you register.