HIPAA-Compliant Texting: The Complete Guide for Healthcare
Patients expect text communication from their healthcare providers, but HIPAA regulations make it complicated. SMS is not HIPAA-compliant. Most texting platforms are not HIPAA-compliant. This guide explains exactly what HIPAA requires for text messaging and how to implement compliant patient communication.
Why Healthcare Needs Compliant Texting
Patients overwhelmingly prefer text messaging for healthcare communication. Studies show that 80% of patients prefer texts over phone calls for appointment reminders, prescription alerts, and care coordination. The problem is that healthcare organizations must comply with HIPAA (Health Insurance Portability and Accountability Act), and most text messaging solutions do not meet HIPAA requirements.
The result is a frustrating gap: patients want texts, providers want to send texts, but the compliance requirements have historically made it difficult, expensive, or impossible. Many healthcare organizations still rely on phone calls and patient portals that patients rarely check.
This gap has real consequences. No-show rates in healthcare average 20-30%, costing the U.S. healthcare system an estimated $150 billion per year. Better communication reduces no-shows. Text reminders that patients actually see and respond to reduce no-shows by up to 50%.
The solution is not to avoid texting. It is to use a platform that meets HIPAA requirements. Let's break down exactly what that means.
What HIPAA Requires for Text Messaging
HIPAA's requirements for electronic communication apply to any system that transmits, stores, or has access to Protected Health Information (PHI). For text messaging, the key requirements are:
1. Business Associate Agreement (BAA)
Any third-party service that handles PHI must sign a BAA with your organization. This is non-negotiable. If your texting provider will not sign a BAA, they are not HIPAA-compliant. Period.
2. Encryption in Transit
Messages containing PHI must be encrypted during transmission. This prevents interception by third parties, including network operators and intermediaries.
3. Encryption at Rest
Messages stored on servers must be encrypted at rest. This protects PHI in the event of a data breach or unauthorized server access.
4. Access Controls
The system must have role-based access controls that limit who can view PHI. Authentication, authorization, and session management must meet HIPAA standards.
5. Audit Trails
All access to PHI must be logged. The system must maintain audit trails showing who accessed what data and when. These logs must be retained and available for compliance audits.
6. Minimum Necessary Standard
Only the minimum necessary PHI should be included in messages. A text reminder should say "You have an appointment tomorrow at 2pm" rather than including diagnosis codes or treatment details.
Why SMS Is NOT HIPAA-Compliant
Standard SMS fails HIPAA requirements in multiple ways:
No encryption in transit. SMS messages travel through carrier networks (AT&T, T-Mobile, Verizon) in plaintext. Carriers can read, store, and access the content of every SMS message. This is a fundamental architecture issue that cannot be fixed with configuration changes.
Carrier storage. Carriers retain SMS message content for varying periods. T-Mobile has acknowledged storing message content. This means PHI sent via SMS is stored on third-party servers without a BAA, without encryption at rest, and without access controls.
Third-party access. SMS messages may pass through multiple intermediaries (aggregators, resellers) between the sender and recipient. Each intermediary has potential access to the message content. None of them have signed BAAs with your organization.
No audit trail. Standard SMS provides no logging of message access or delivery confirmation sufficient for HIPAA audit requirements.
No access controls. Anyone with physical access to the recipient's phone can read SMS messages. While this is true of any messaging system, the lack of encryption and the carrier storage issue make SMS uniquely problematic.
To be clear: you cannot make SMS HIPAA-compliant by adding a disclaimer. The underlying architecture prevents compliance regardless of what you say in the message or what consent you obtain. Patient consent does not override the BAA and encryption requirements.
iMessage for Healthcare: End-to-End Encryption by Default
iMessage addresses the core technical issues that make SMS non-compliant:
End-to-end encryption. Every iMessage is encrypted using keys that only the sender and recipient possess. Apple cannot read the messages. Carriers cannot read the messages. No intermediary can access the content. This is not optional or configurable. It is the default for every iMessage.
No carrier storage. Because iMessages travel through Apple's servers (not carrier infrastructure), carriers do not have access to message content. Messages are encrypted on Apple's servers and can only be decrypted by the intended recipient.
Delivery confirmation. iMessage provides delivery receipts and read receipts, creating a partial audit trail. You know the message was delivered and, optionally, when it was read.
Important caveat: iMessage alone does not make you HIPAA-compliant. You still need a texting platform provider that will sign a BAA, maintain proper access controls, provide audit trails, and handle PHI according to HIPAA standards. iMessage provides the encryption layer. The platform provider handles the rest.
This is where Sendblue comes in. Sendblue is SOC 2 Type II certified, provides BAA agreements for healthcare customers, maintains comprehensive audit logs, and implements access controls that meet HIPAA requirements. Combined with iMessage's end-to-end encryption, this provides a fully compliant texting solution for healthcare.
Healthcare Use Cases with Sendblue
Appointment Reminders
Send automated iMessage reminders 24 and 2 hours before appointments. With 98% open rates and read receipt confirmation, you know the patient saw the reminder. Include a link or reply option for easy rescheduling. Healthcare organizations using iMessage reminders report 40-50% reductions in no-show rates.
Prescription Alerts
Notify patients when prescriptions are ready for pickup, when refills are due, or when medication changes occur. iMessage's immediacy ensures time-sensitive medication information reaches patients quickly.
Lab Results Notification
Alert patients that lab results are available (without including the results in the message, per the minimum necessary standard). Direct them to your patient portal to view the full results. The iMessage gets their attention. The portal provides the secure access.
Care Coordination
Coordinate between providers, patients, and caregivers. iMessage group conversations can include the patient, their primary care physician, and specialists, all in an encrypted thread.
Post-Visit Follow-Up
Send care instructions, satisfaction surveys, and follow-up appointment scheduling via iMessage after visits. The high response rate on iMessage makes it ideal for collecting patient feedback.
// Send a HIPAA-compliant appointment reminder
await sendblue.sendMessage({
number: patientPhone,
content: 'Reminder: You have an appointment tomorrow, March 30, at 2:00 PM with Dr. Smith. Reply YES to confirm or RESCHEDULE to change.',
});Implementation Guide
Step 1: Contact Sendblue for a BAA
Request a demo and let us know you need HIPAA compliance. We will provide a BAA for your organization to review and sign.
Step 2: Set up your Sendblue account
Create your account and configure your dedicated phone number. This number will be used for all patient communication and can be added to your practice's contact information.
Step 3: Integrate with your EHR/Practice Management System
Use the Sendblue API to connect your electronic health record system or practice management software. When appointments are created, trigger reminder messages. When lab results arrive, trigger notifications.
Step 4: Configure webhooks for patient responses
Set up webhooks to handle patient replies. Route confirmation replies to your scheduling system. Route questions to your front desk or triage team.
Step 5: Train your staff
Ensure staff understand the minimum necessary standard. Messages should contain the minimum PHI needed for the communication purpose. Appointment reminders include date, time, and provider name. They do not include diagnosis codes, treatment details, or sensitive clinical information.
Frequently Asked Questions
Can I send PHI via iMessage?
With proper safeguards in place (BAA, audit trails, access controls, and the minimum necessary standard), yes. iMessage's end-to-end encryption provides the technical safeguard for transmission. Sendblue's HIPAA-compliant platform provides the administrative and organizational safeguards.
Do I need patient consent to text them?
Yes. HIPAA requires that patients consent to electronic communications. Collect consent during intake and document it in your EHR. Include information about what types of messages they will receive and how to opt out.
What if the patient has an Android phone?
iMessage is only available to iPhone users. For Android patients, you need a separate compliant SMS solution, or you can use Sendblue's automatic fallback which will use RCS or SMS when iMessage is unavailable. Note that SMS fallback messages have different encryption properties. Consult your compliance officer about your organization's policy for non-iMessage patients.
Is Sendblue SOC 2 certified?
Yes. Sendblue holds SOC 2 Type II certification, which covers security, availability, and confidentiality controls. This is independently audited and verified.
What about Apple Messages for Business?
Apple Messages for Business is a different product that sends gray bubble business chats (not real iMessages). It requires customer-initiated contact and does not support proactive outbound messaging. Sendblue sends real blue bubble iMessages that you can initiate. Learn more about the difference.
Ready to send your first iMessage?
Get API access in minutes. Free sandbox, no credit card required.