Texting patients? The HIPAA, TCPA and carrier rules every practice must follow

For many medical practices, texting has become the easiest way to reach patients, whether it's an appointment reminder, a follow-up instruction or a nudge about an unpaid bill. However, texting patients isn't quite the "set it and forget it" convenience it appears to be, because every message is subject to privacy and patient-contact rules.

Staying compliant comes down to knowing which rules apply and having a texting system built to follow them.

Why texting compliance matters

Two federal laws, the Health Insurance Portability and Accountability Act (HIPAA) and the Telephone Consumer Protection Act (TCPA), shape how practices can text patients. Noncompliance can expose practice owners to legal and financial risk, including patient lawsuits, civil penalties and reputational damage.

Carriers can also filter or block texts sent from numbers that aren't properly registered. Fortunately, practices that understand where these rules apply can build compliance into their texting from the start, so staff members aren't scrambling when a complaint or audit arrives.

The rules behind patient texting

HIPAA and the TCPA form the foundation of texting compliance, while carrier requirements and state laws add their own layers. Each deserves a closer look.

HIPAA is the natural starting point because it applies directly to health care providers. The law doesn't prohibit texting patients, but it does govern how health information in any format, including texts, is handled. HIPAA requires practices to put safeguards in place to protect the information in every patient text.

While HIPAA governs what a text to a patient says, the TCPA regulates whether a practice can send it at all. Under the TCPA, patients can revoke consent and opt out of a practice's text messages at any time and in any reasonable manner. Marketing texts require written consent, while informational texts may rely on oral consent. For practices, appointment reminders generally count as informational, but promotional messages, such as a discount on cosmetic services, generally require written permission.

Beyond federal law, phone carriers set their own rules for how businesses handle automated texts. Businesses that send automated texts from a 10-digit long code (10DLC) must register their brand and messaging campaigns, or their messages may be filtered or blocked. The Campaign Registry administers this registration, and practices typically complete it through their messaging provider.

States have also enacted their own data privacy laws, but many of the broader ones, such as those in California and Virginia, exempt information already covered by HIPAA. For texting purposes, however, Florida and Oklahoma have telemarketing laws that set their own consent requirements for marketing texts. Because these rules vary, a practice's obligations can depend on where its patients live, not just where the practice is located.

Core features of a compliant texting system

Knowing the rules is only half the picture. The other half is having a texting system that follows them, starting with four features that put those rules into practice.

1. Opt-out handling

Patients can opt out at any time and in any reasonable manner, so a compliant system must recognize more than one keyword. "Stop" should trigger an opt-out, but so should words like "unsubscribe" and "cancel," as well as plain-language requests.

Once a patient opts out, federal rules require the sender to honor the request within a reasonable time and no later than 10 business days. It's best to process the request promptly, since more messages could frustrate patients or lead to complaints.

Once the request is processed, the system should automatically block future texts to that number so no one on staff has to remember to do it. The goal is to automate the process while keeping it flexible, since regulators have revisited how far a single opt-out should reach, such as whether stopping billing reminders also stops appointment reminders.

2. Consent capture

Consent is at the core of a compliant texting system. A practice's system should record when each patient consented and in what form, whether oral or written. Written consent doesn't have to be on paper. It can also be collected electronically, such as through a web form or by a patient texting a keyword to opt in. Each record should be timestamped and easy to retrieve later, not captured once and forgotten.

A clear consent record shows that a practice respects its patients' communication preferences. It also serves as primary evidence if a patient later disputes agreeing to receive texts or brings a TCPA claim.

3. Message archiving

Every message a practice sends and receives should be easy to retrieve so staff can pull up a text for an audit, a patient dispute or a records request. Texts with clinical details may become part of a patient's record, which patients have a right to access.

Storage alone isn't enough, though. If staff can't search the archive by patient, date or phone number, the records do little good when an audit or request arrives.

4. Encryption and BAAs

Protecting patient information in texts comes down to two things: how messages are secured and who is allowed to handle them. Under HIPAA, those safeguards show up most clearly in encryption and in business associate agreements (BAAs).

Standard SMS isn't end-to-end encrypted, which means phone carriers can access text messages containing protected health information (PHI). These messages can also be exposed in transit through network interception and devices known as IMSI catchers. HIPAA's Security Rule treats encryption as an "addressable" specification rather than a strict requirement in every case, but it remains the standard safeguard for keeping PHI secure.

Encryption covers how messages are secured, and BAAs cover who handles them. Any vendor that creates, receives, maintains or transmits PHI for the practice must sign a BAA that clearly states the vendor's permitted uses of PHI. The BAA must also require the vendor to comply with HIPAA's Security Rule and report security incidents and breaches.

Questions to ask when evaluating a texting setup

Before adopting a texting setup, or when reviewing an existing one, practice owners can ask a vendor or their own IT team the following questions:

• Does the system recognize opt-out requests in any reasonable form, not just "stop," and promptly stop further automated texts to that number?
• How does the system record patient consent, including when it was given and whether it was written or oral? Can staff pull up that record later?
• Are all sent and received messages archived so staff can search by patient, date or phone number and export them when needed?
• Are messages containing PHI encrypted, and will the vendor sign a business associate agreement?
• Is the practice's texting traffic registered to meet carriers' 10DLC requirements?

With these questions, practice owners can evaluate any texting setup on the same terms and get a concrete picture of how their texting actually works.

Keeping patient texting compliant long term

Compliance is never a one-time setup. Rules and regulations change over time, so practices should periodically review their texting setup to confirm it's still compliant. For practice-specific questions, consult legal counsel.

Dylan Berger covers industry trends and insights, frequently writing at the intersection of business and technology. His work has appeared in publications such as Global Trade Mag and Tripwire.