Yes, staff can message each other about patients, as long as the message travels through a tool that has signed a Business Associate Agreement (BAA) with your practice and they share only what the other person needs. Over regular SMS, WhatsApp, iMessage or any personal messaging app, the honest answer is no, because those vendors will not sign a BAA and the practice has no control over the messages.
The short version
HIPAA does not say staff may not text. It says that protected health information (PHI), any information that identifies a patient and relates to their health, care or payment, must be protected by the practice (a covered entity) and by any vendor that handles it for the practice (a business associate). The vendor part is handled by a Business Associate Agreement (BAA), a contract in which the vendor promises to protect PHI the way HIPAA requires, and the rules require it before PHI is handled (45 CFR 164.502(e) and 164.308(b)).
So texting about patients is allowed on a channel that has a BAA and reasonable safeguards. It is not allowed on a channel that has neither, which describes every consumer messaging app and your phone carrier.
What counts as PHI in a text message
People underestimate this. PHI is not only a diagnosis. It is any identifier joined to anything about health or care. Some examples:
| Message | PHI? | Why |
|---|---|---|
| "Did Mrs. Alvarez call back about her results?" | Yes | Name plus the fact that results exist |
| "Room 3 is ready" | No | No patient identifier, no health information |
| "Chart 4471 needs a callback about today's prescription" | Yes | A medical record number is an identifier |
| Photo of today's schedule | Yes | Names, times and appointment types |
| "The 2:30 cancelled" | Usually no | A time alone rarely identifies a person, but context can |
| "J.M. in room 2 is asking about her biopsy" | Yes | Initials plus a detail identify a person in a small town |
| "Who is covering Saturday?" | No | About staff, not patients |
When in doubt, treat it as PHI and send it through the approved tool. The cost of being careful is nothing; the cost of being wrong is a breach investigation.
Why SMS and consumer apps fail even when the message is short
A short message is still PHI. The problem is not length, it is the channel. Standard SMS is not encrypted on the carrier side, and no carrier signs a BAA with a dental office. WhatsApp and iMessage encrypt messages, but neither Meta nor Apple signs a BAA with practices, there is no admin who can remove a former employee, and the history stays on every phone forever. Standard SMS and consumer apps whose vendors will not sign a BAA are not appropriate for PHI, full stop.
Encryption and a BAA are different things. Encryption protects the message in transit. The BAA makes the vendor accountable to you, and it is the one HIPAA requires.
What makes a text channel acceptable
- A signed BAA on the plan you are using.
- Encryption in transit and at rest.
- Invite-only membership, so only current staff are in it.
- Roles and private channels, so not everyone sees everything.
- An audit log and a retention setting you control.
- An inactivity lock and passkeys on phones.
- Notifications that never show message content.
Any tool that checks those boxes turns the answer from no to yes. Yodl checks all of them on its $10 plan: a BAA with every customer, invite-only workspaces, channel roles, an audit viewer, retention controls and a 15-minute inactivity lock.
The gray areas people ask about
Initials. Treat them as PHI. In a practice with a few hundred active patients, initials plus any detail identify a person.
Room and chart numbers. A room number alone is not PHI. A chart number is an identifier, so a message using it is PHI, but it is the right way to point to a patient inside the approved tool, because it adds nothing a stranger could use.
Photos. A clinical photo is PHI and belongs in the record. A photo of a supply shelf is not. A photo of the schedule is.
Voice notes. Same as text. A voice note about a patient is PHI; keep it inside the approved tool.
Personal phones. Allowed with safeguards: passcode, app lock, no screenshots, and a lost-phone plan.
A two-minute rule for staff
- Is this message about a patient in any way? If no, send it anywhere you like.
- If yes, is the approved app open? If no, open it. It is in your phone's browser.
- Say what the other person needs to act. Use the chart number, not the name.
- If the detail belongs in the chart, put it in the chart and say so in the message.
- Never screenshot, forward or copy the message anywhere else.
What to tell staff who say texting is faster
They are right that texting is fast. The answer is to make the approved tool just as fast: it should open from the phone's home screen, show unread badges, and feel like the chat they already use. If the tool is slower than SMS, people will drift back. Pick one that lives in the browser on any phone, with channels, threads and direct messages, and the speed argument disappears.
If you want that tool with the BAA already included, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
Staff can text about patients inside a BAA-covered tool with minimum necessary detail. They cannot do it on SMS or consumer apps, no matter how short the message. The channel decides, not the length.
Frequently asked questions
Can a doctor text a nurse a patient's name on iMessage if both have iPhones?
No. iMessage is encrypted, but Apple does not sign a BAA with practices and the practice has no control over the messages. The name plus any care context is PHI.
Is it PHI if we only use a first name?
Yes, treat it as PHI. A first name with any context about care identifies a patient in a small practice.
What if the patient told us it is fine to text about them?
Patient consent covers messages to the patient. It does not cover staff-to-staff messages about the patient, which are the practice's responsibility to secure.
Can we text about patients in an emergency?
Use the approved tool; it is as fast as SMS on any phone. HIPAA allows sharing PHI for treatment, but the safeguards still apply. If SMS was the only option, keep it minimal and document it.
Does a BAA cover the staff's personal phones?
No. The BAA covers the vendor. Phones are covered by your own device rules: passcode, app lock, no screenshots and a lost-phone procedure.