Patient Texting Now Sits at the Center of Practice Compliance
Text messaging has become one of the fastest ways for medical practices to reach patients, whether the message is an appointment reminder, a follow-up instruction, or a billing notice. The convenience is obvious. So is the exposure. Every text sent from a practice touches a set of rules that govern privacy, consent, recordkeeping and delivery, and those rules do not disappear because the message is brief or routine.
Two federal laws frame the issue: HIPAA and the TCPA. They do different jobs, and both matter. HIPAA governs how protected health information is handled, while the TCPA governs whether a practice can text a patient at all and under what consent terms. Layer carrier rules and state privacy laws on top, and a texting workflow that looks simple to staff can become a compliance problem if it is not built carefully from the start.
Consent, Opt-Outs and the Legal Meaning of a Text
The TCPA gives patients the right to revoke consent and opt out of text messages at any time and in any reasonable manner. A compliant practice cannot assume that only the word “stop” counts. Requests such as “unsubscribe,” “cancel,” or a plain-language instruction to stop texting must be recognized and acted on. Once a patient opts out, the sender must honor the request within a reasonable time and no later than 10 business days.
A brief, routine reminder can become a legal problem the moment the patient says no more.
The kind of consent required depends on the message. Informational texts, such as appointment reminders, can rely on oral consent. Marketing texts require written consent. That line matters in daily practice because a message about a cosmetic discount or other promotional service falls into a different category than a reminder to return for a follow-up visit. The content, not the convenience of the communication channel, determines the rule.
Building a Consent Record That Can Survive a Dispute
A compliant texting program needs a durable record of consent. The record should show when consent was given and whether it was oral or written. Written consent does not have to exist on paper; it can be captured electronically through a web form or a patient’s keyword response to opt in. What matters is that the record is timestamped, preserved and easy to retrieve later.
This is not just administrative housekeeping. If a patient later disputes having agreed to receive texts, the consent record becomes primary evidence. If a TCPA claim follows, the practice needs more than a memory or a staff note. It needs documentation that can be produced quickly and tied to the actual number and message type involved.
HIPAA Security and the Limits of Standard SMS
HIPAA does not ban texting patients. It does require safeguards for any health information sent that way. The risk is especially clear with standard SMS, which is not end-to-end encrypted. Phone carriers can access messages that contain protected health information, and texts can also be exposed in transit through interception tools and devices such as IMSI catchers.
Encryption remains the strongest safeguard for protecting protected health information in transit. HIPAA’s Security Rule treats encryption as an addressable specification rather than an absolute mandate in every circumstance, but the practical message is hard to miss: if a practice is sending clinical details by text, the security model needs to be deliberate, not improvised.
A second HIPAA issue sits behind the scenes: who is handling the data. Any vendor that creates, receives, maintains or transmits PHI on behalf of the practice must operate under a business associate agreement. That agreement should define the vendor’s permitted use of PHI, require compliance with HIPAA’s Security Rule, and obligate the vendor to report security incidents and breaches. Without that paper trail, even a well-functioning texting platform can create serious compliance exposure.
Carrier Registration Can Make or Break Message Delivery
Federal law is only part of the story. Carriers now decide whether a business message gets through. Practices that send automated texts from a 10-digit long code, or 10DLC, must register their brand and messaging campaigns or risk being filtered or blocked. The Campaign Registry handles that registration, usually through the messaging vendor.
This is where compliance becomes operational. A practice may think it is texting patients reliably, only to discover that messages are being delayed, blocked or labeled as suspicious because the traffic was never properly registered. In a clinical setting, that can interrupt reminders, delay follow-up instructions and make a contact system look unreliable even when the content is lawful.
Archiving and Searchability Are Part of Compliance, Not Extras
Every sent and received message should be archived in a way that staff can actually use. If a text contains clinical details, it may become part of the patient record, and patients have a right to access it. Archiving is not enough by itself. Staff must be able to search the record by patient, date or phone number and export the messages when needed for an audit, a dispute or a records request.
This requirement sounds technical, but the bedside impact is practical. A patient asking for a copy of a communication trail should not trigger a scavenger hunt through fragmented inboxes and personal devices. The system should preserve the record in a format that is retrievable, complete and tied to the patient chart or communication log.
The Vendor Questions Practices Should Ask Before Sending the First Text
Selecting a texting platform should begin with a direct review of how the system handles consent, opt-outs and records. The vendor should be able to explain whether it recognizes opt-out requests in any reasonable form, not just a single keyword, and whether it stops future automated texts to that number promptly. It should also be able to show how patient consent is captured, whether the consent was oral or written, and how staff can retrieve that record later.
Searchable archives matter just as much. Practices should ask whether all sent and received messages are stored in a format that can be searched by patient, date or phone number and exported when needed. They should also ask whether messages containing PHI are encrypted and whether the vendor will sign a business associate agreement. If the platform uses 10DLC, the practice should confirm that brand and campaign registration is complete and current.
A compliant texting setup is not a one-time purchase. Rules change, carrier requirements change, and a process that worked last year may not be enough now. Periodic review is part of safe practice management, especially when messages contain clinical information or when a workflow mixes reminders, billing notices and promotional outreach. Legal counsel remains essential for practice-specific decisions, but the operational standard is straightforward: if a practice is going to text patients, it needs a system that can prove consent, honor opt-outs, secure PHI and keep messages deliverable over time.