Is Text Messaging (SMS) HIPAA Compliant? What to Use Instead

Short answer: No. Standard SMS text messaging is not HIPAA compliant. SMS is not encrypted end to end, carriers will not sign a BAA for it, and there is no access control or audit trail, so sending PHI by SMS is a HIPAA risk.

Why standard SMS falls short

SMS travels through carrier networks in a form that can be intercepted or stored, and messages sit on personal devices with no organisational control. There is no BAA covering the carrier as your business associate, no way to prove who accessed a message, and no retention policy you control. All four of HIPAA’s core needs (BAA, encryption, access control, audit trails) are missing.

The appointment-reminder nuance

Sending a plain reminder that contains no PHI (“You have an appointment tomorrow at 10am”) is lower risk. The moment a message includes diagnosis, treatment, lab results, or anything that identifies a patient’s health information, standard SMS is the wrong channel. When in doubt, treat it as PHI.

What to do instead

Use secure, HIPAA-ready messaging that encrypts content, sits under a BAA, logs access, and, ideally, lets you keep data in your own infrastructure. A chat and messaging API gives you patient texting that is actually compliant.

Related

• Is WhatsApp HIPAA Compliant?
• Is iMessage HIPAA Compliant?
• Is Google Chat HIPAA Compliant?
• HIPAA-compliant chat & messaging API
• Healthcare chat SDK

Frequently asked questions

Can I text patients appointment reminders?

Reminders without PHI are lower risk; anything clinical needs a compliant channel.

Is encrypted SMS HIPAA compliant?

Encryption helps, but you still need a BAA, access control, and audit trails.