Is SMS HIPAA Compliant? A Guide for Medical Practices

TLDR: SMS is not inherently HIPAA-compliant. HHS does not certify SMS platforms as compliant. But text messaging is acceptable (and widely used) for appointment reminders, confirmations, and portal notifications that do not contain Protected Health Information. For anything containing PHI, use your patient portal; for everything else, text is fine.

The Short Answer First

If you need one sentence: text messaging is safe for appointment reminders, confirmations, and “log in to your portal” notifications, not for lab results, diagnoses, or medication detail inside the message body.

That’s true for every SMS vendor. It’s a protocol limitation, not a software feature. The good news: once you understand the pattern, running patient SMS is simple, effective, and compliant.

Why SMS Isn’t Inherently HIPAA-Compliant

The SMS protocol (known as SS7) was designed in the 1980s for text between phones, not for healthcare communication. Three things about SMS are worth knowing:

• The carrier network transmits SMS in plaintext. When a text leaves a vendor’s platform, it passes across the public carrier backbone on its way to the recipient’s phone. The radio link between the cell tower and the phone is encrypted at the network layer, but the message itself is not encrypted end-to-end.
• No SMS vendor can change this. Large or small, enterprise or startup, US or international, every vendor hands messages to the same carrier network. End-to-end encryption is not available in the SMS protocol.
• HHS has not certified any SMS platform as “HIPAA-compliant.” HIPAA doesn’t work that way. HIPAA is a set of rules; covered entities (healthcare providers) are responsible for complying with them. Vendors can be “HIPAA-aware” or offer Business Associate Agreements for specific services, but the compliance obligation stays with the practice.

What HHS Actually Says About SMS

The Department of Health and Human Services (HHS), which enforces HIPAA, has issued guidance that’s more practical than many vendors admit:

• Appointment reminders by text are permitted when the message is limited to the reminder itself (date, time, “reply Y to confirm”).
• Patients can consent to receive information by text, but providers should warn them that text is not a secure channel for PHI.
• General notifications such as “log in to your patient portal, a new message is waiting” are routinely used and accepted.
• Specific clinical information (results, diagnoses, prescription details) should not be placed in the SMS body.

The simplest mental model: SMS is like a postcard. Fine for “come to my party Saturday.” Not fine for your medical history.

The “Conduit Exception”: What It Is and Why It Matters

Under HIPAA, a “conduit” is an organization that transports information without meaningfully accessing or storing it (think the postal service, or a telecom carrier). Conduits are not considered Business Associates and don’t need to sign BAAs.

Cell carriers routing SMS typically fall under the conduit exception. This is why your wireless carrier isn’t signing a BAA with every medical practice that uses a cell phone.

SMS platforms themselves are usually not pure conduits, because they store and log messages to provide delivery tracking and history. That’s why HIPAA-focused vendors offer BAAs covering their platform-level handling. But the network between the vendor and the recipient remains what it is: an open carrier network.

Incidental Disclosure vs. Intentional Disclosure

HIPAA draws a clear distinction between:

• Intentional disclosure of PHI, which requires proper authorization and a secure channel. Not appropriate for SMS.
• Incidental disclosure: small, unavoidable exposures that happen as a byproduct of an otherwise compliant process. HHS explicitly allows for incidental disclosures when reasonable safeguards are in place.

A patient’s name and appointment time in a consented reminder text is generally acceptable under incidental-disclosure reasoning. A diagnosis in an SMS is not. That’s intentional disclosure through an insecure channel.

What Actually Counts as PHI?

Protected Health Information under HIPAA is any information that identifies a patient combined with health information. Common examples:

• Diagnoses (“Your test came back positive for…”)
• Lab results and values (“Your A1C is…”)
• Medications and prescription details (“Your prescription for [drug] is ready”)
• Treatment specifics (“After your chemotherapy session…”)
• Mental health information of any kind

Generally not considered PHI in the SMS context, when sent to a consented patient:

• Appointment reminders (“You have an appointment tomorrow at 3pm”)
• Confirmation requests (“Reply Y to confirm, N to reschedule”)
• Practice operational updates (“Our office is closed Monday for the holiday”)
• Portal nudges (“A new message is waiting. Log in: portal.example.com”)

Safe vs. Unsafe SMS Examples

Notice the pattern: every unsafe example could be rewritten as “a new message is waiting, please log in.” Same urgency. Same response rate. Zero PHI in the SMS body.

What a Business Associate Agreement (BAA) Does, and Doesn’t Do

A BAA is a contract between a covered entity (provider) and a business associate (vendor) that handles PHI on the provider’s behalf. It specifies:

• How the vendor will safeguard PHI
• Breach notification procedures
• Access controls and audit logging
• What happens to data upon termination
• The provider’s right to audit the vendor

A BAA is important for vendors that store PHI (your EHR, your patient portal, your billing service). For an SMS vendor, a BAA covers how stored messages and logs are handled. But a BAA does not make the SMS protocol itself secure for PHI transmission. No contract can change how the carrier network works.

For most SMS use cases (reminders, confirmations, portal nudges), a BAA is not strictly required because no PHI is transmitted. For larger health systems that require a BAA as part of their vendor policy (even when following PHI-free messaging practices), BAAs are available from some vendors on enterprise tiers.

The Right Architecture: Notification by Text, Detail by Portal

The pattern used by compliant medical practices across the country is simple:

1. Your secure, HIPAA-compliant patient portal holds the PHI.
2. When there’s something for a patient to see, you send a short SMS: “A new message from Dr. Lee is waiting. Log in: portal.example.com”
3. The patient opens the portal over a secure, authenticated connection and sees the detail there.

You get the speed and response rate of SMS. The PHI stays where it belongs. The practice has a timestamped record that the patient was notified.

This architecture works with any EHR, any portal, and any SMS vendor that respects the line.

How TextBolt Supports This Pattern

TextBolt email to sms gateway is built for the notification side of this architecture: the reminders, confirmations, and portal nudges that don’t carry PHI. Two layers work together: the compliance layer and the practice-workflow layer.

The Compliance Layer

• Registered 10DLC business sender: legitimate, non-spam delivery
• Automatic STOP / opt-out handling: TCPA-aligned by default
• Timestamped audit log: delivery confirmation and message history
• Per-user attribution: every send tied to a specific staff member
• Encryption in transit and at rest: TLS on every API call, AES-256 on stored data
• Role-based access: practice managers control who can send and view
• Business number: patients see a consistent practice number; staff personal phones stay private

The Practice-Workflow Layer

• One composer for every message: send to a single patient, a small group, or an entire list from one screen (start a new conversation)
• Reusable message templates with merge tags like {first_name}, {appointment_date}, {appointment_time}, so your front desk stops retyping the same sentences dozens of times a day (create a template)
• A shared patient contact book with custom fields, so every patient your practice texts lives in one searchable place (open the contact book)
• Smart lists for patient segments (think Gmail labels): “Pediatric,” “Annual physicals due,” “Dr. Lee’s patients,” then send a targeted message with one click (manage lists)
• Team access: front desk, hygienists, providers, and office managers all work from the same practice number, each sending from their own email, with full attribution (invite your team)
• Email-based workflow: staff send from the Gmail they already use; no new app, no training

For standard medical and dental practices, this is the toolkit to run compliant patient SMS without a BAA, because no PHI is transmitted.

For hospital systems and multi-site practices that require a BAA as part of enterprise vendor policy, TextBolt offers a dedicated enterprise deployment with BAA, custom SLA, and isolated infrastructure. Book a call to scope an enterprise deployment.