A chiropractic office sends dozens of tiny messages a day between the adjusting rooms and the front desk, and most of them point to a patient. That makes them protected health information. The fix is not slower messaging. It is the same quick messages inside a tool that signs a Business Associate Agreement, with a few channels and a thumbs-up that means 'handled'.
The speed problem in a chiropractic office
A busy chiropractic office can see sixty patients in a day with a team of five or six: the chiropractor (DC), two chiropractic assistants (CAs) who run the front desk and the therapy room, a massage therapist, and a biller or office manager who may be the doctor's spouse. Visits are short. The doctor moves room to room, and the front desk has twenty seconds to book the next visit before the patient reaches the counter.
Nothing about that rhythm fits email. It fits a text that says 'Re-exam next week for room 2' and a thumbs-up. The only problem is where that text lives.
Messages that fly between the rooms and the front desk
- 'Room 1 needs a re-exam next Tuesday, add the outcome questionnaire.' Doctor to front desk, five times a day.
- 'Walk-in with acute low back, can you take him between the 3:15 and the 3:30?' Front desk to doctor.
- 'Roller table in therapy room 2 stopped, use room 3 for the next three.' CA to everyone.
- 'Mrs. R is asking what her x-ray showed. Do you want to talk to her, or should I book a report of findings?' CA to doctor.
- 'Care plan balance question for the 4 o'clock, he wants to pay in two parts.' Biller to front desk.
Every one of these except the roller table is about a specific patient. A time slot, a room number and a complaint identify a person as surely as a name does when the schedule is right there.
What counts as PHI here
Protected health information, PHI, is any detail that identifies a patient and relates to their health, their care or their bill. Your office is a covered entity under HIPAA if it bills insurance electronically, which almost every chiropractic office does for at least some patients, so the Privacy Rule and the Security Rule apply to you directly, not only to the software companies you use.
Any company that stores PHI for you is a business associate and has to sign a Business Associate Agreement (BAA) first. The BAA is the contract that binds the vendor to HIPAA's rules. WhatsApp, iMessage, carrier SMS and Facebook Messenger do not sign one, which is the whole problem with the habits below.
The habits that get small chiropractic offices in trouble
- One WhatsApp group with the doctor, the CAs and the massage therapist, full of 'can you squeeze in the 2:30 shoulder' and the occasional photo of an intake form. WhatsApp signs no BAA, and the massage therapist who left last spring still has every message.
- Personal SMS from the front desk to the doctor's cell with patient names, because the doctor is in a room with the door closed.
- Facebook Messenger between the CAs for shift swaps, which turns into patient chatter by the second week.
The underlying need is real: short messages, instant, acknowledged with an emoji. A proper tool has to be as quick as those three, or the staff will quietly keep both.
A channel map for a 5 to 10 person office
| Channel | Who is in it | What goes there |
|---|---|---|
| #floor | Doctor, CAs, massage therapist | Room-to-front-desk requests, re-exams, squeeze-ins, 'handled' reactions |
| #front-desk | CAs, office manager | Arrivals, cancellations, reminder calls, forms to collect |
| #schedule-today | Everyone | Who is in, lunch, late starts, holiday hours |
| #supplies-and-equipment | Everyone | Table and e-stim repairs, pillows, tape, supplement stock, no patient details |
| #billing (private) | Biller, doctor, office manager | Care plan balances, claim denials, payer questions |
| #owners-private | Doctor, office manager | Hiring, rent, marketing, vendor contracts |
Reactions do a lot of work in this setting. A thumbs-up on a #floor message means it is handled, and the doctor never has to type a reply between patients.
How to set it up before Monday
- The office manager creates the workspace, invites each person by work email, and stays the only one who sends invitations.
- Create the six channels. #billing and #owners-private are private; the rest are open to the team.
- Make the doctor and office manager managers of #floor and everyone else members. If the massage therapist only needs to read the schedule, use the viewer role in #schedule-today.
- Turn on passkeys so the front desk iPad and the doctor's phone sign in with Face ID or Touch ID instead of a typed password in front of patients.
- Pin the house rules in the #floor topic: time and room instead of names when the schedule makes it obvious; a reaction means handled.
- Set a date, post it in the WhatsApp group, and delete the group that day.
Yodl's Team plan covers this at $10 a month for the location, with five users, 20 GB of files and a signed BAA. A sixth and seventh person are $2 each, so a seven-person office pays $14, month to month. A second office is another $10 with five more users.
What the tool should give the doctor
As the owner you want more than a nicer group chat: invite-only membership so nobody is in the room by accident, private channels for billing, an audit log in case a patient complaint or a board inquiry ever asks who saw what, a 15-minute inactivity lock for the iPad at the front desk, and push notifications that never show the message itself on a lock screen. Yodl has each of those. Like Slack and Microsoft Teams, it is encrypted in transit and at rest rather than end-to-end, so that search, retention and the audit log can work.
Ready to replace the group text? Yodl is $10 a month for five people, with the signed BAA included.
A chiropractic office does not need slower messages. It needs the same twenty-second messages inside a tool with a BAA, a few channels, and a thumbs-up habit that keeps the doctor moving.
Frequently asked questions
Is a small chiropractic office really covered by HIPAA?
If you bill any insurance electronically, including Medicare, you are a covered entity and the rules apply to you directly. Cash-only offices should confirm with a compliance advisor, and state privacy laws apply either way.
Our massage therapist is a contractor. Can she be in the chat?
Yes. Invite her like any staff member, limit her to the channels she needs, and remove the account the day the contract ends. Keep the paperwork for contractors current with your compliance advisor.
Can the doctor check messages in the adjusting room?
That is the point: a glance at #floor between patients. Use passkeys and the inactivity lock, and make sure lock-screen previews never show message content.
Is a time and room number PHI?
On its own, no. Combined with the day's schedule it points to one person, so treat it as PHI and keep it inside the covered tool, where that costs nothing.