A physical therapy clinic needs staff chat that signs a Business Associate Agreement, keeps patient questions inside private channels, and gives therapists, aides and the front desk a clear rule about what goes where. For a 5 to 12 person clinic, setup takes about an afternoon.
Who is messaging whom in a PT clinic
An outpatient physical therapy clinic runs on a small crew: one or two physical therapists (PTs), a physical therapist assistant (PTA), a rehab aide who sets up equipment and walks patients through their exercise lists, a front desk person who also owns the schedule, and someone who chases authorizations and billing. Often the owner is also the lead therapist.
Nobody sits at a desk waiting for email, so PT clinics drift toward group texts: fast, and already on every phone. The trouble is that most of what the team needs to say involves a patient, and a group text has no agreement behind it, no way to remove someone who leaves, and no record to show an auditor.
Five messages your team sends every day
- Plan-of-care question. A PTA notices new pain during a session, or wants to add an exercise that is not on the plan, and needs the supervising PT's answer before the next visit.
- Schedule change. A patient cancels at 8:05 for an 8:30 slot. The front desk wants to pull someone from the waitlist and needs to know whether the therapist can take an eval instead.
- Recertification due. The authorization coordinator sees a patient's approved visits run out next week and the plan of care needs the referring physician's signature.
- Equipment and rooms. The traction table in room 2 is making noise, the ultrasound gel is almost gone, or the private treatment room is double-booked.
- Progress note reminder. The director reminds a therapist that the progress note Medicare expects every ten visits is due before the next claim.
What in those messages is PHI, and what is not
PHI means protected health information: any detail that identifies a patient and relates to their health, their treatment or how it is paid for. A name next to a diagnosis is PHI. So is a name next to an appointment time, or a photo of a progress note. A PT clinic that bills insurance electronically is a covered entity under HIPAA, so the Privacy Rule and the Security Rule apply to the clinic directly, not only to its vendors.
Not everything is PHI. 'Room 2 table is down' is maintenance. 'Open eval slot at 2' is scheduling. 'Recert needed for the 10:30 knee' sits on the line: no name, but a time and a condition narrow it down fast. The practical rule is to assume clinical messages contain PHI and keep all of them inside a tool covered by a BAA.
A BAA is a Business Associate Agreement, the written contract in which a vendor that stores or transmits PHI for you agrees to protect it under HIPAA. The rules require one before a vendor handles PHI (45 CFR 164.502(e)). If a chat app will not sign one, it is not a place for the messages above, however well it encrypts.
A channel map for a 5 to 12 person clinic
| Channel | Who is in it | What goes there |
|---|---|---|
| #front-desk | Front desk, director, therapists | Arrivals, cancellations, waitlist moves, room assignments |
| #clinical | PTs, PTAs, aides (private) | Plan-of-care questions, exercise changes, patient handoffs |
| #authorizations | Authorization coordinator, PTs, director (private) | Recerts due, visit counts, payer questions, denied claims |
| #equipment | Everyone | Broken tables, supply orders, cleaning schedule, no patient details |
| #schedule-today | Everyone | Who is in, who is out, lunch coverage, late starts |
| #owners-private | Owner, director, billing (private) | Payroll, hiring, payer contracts, vendor issues |
Direct messages cover the rest, and a thread keeps one patient's back-and-forth in one place.
The mistakes PT clinics usually make
Three habits show up in almost every clinic that has not set up a proper tool:
- One WhatsApp group for the whole clinic, with patient names and schedule screenshots. WhatsApp does not sign a BAA, former employees keep the history on their phones, and no admin can remove a message or export a record.
- Personal SMS between a PTA and the supervising PT. Carrier texts are not encrypted and get backed up wherever each phone backs up. The clinic controls none of it.
- A Facebook Messenger chat for the aides. It starts for shift swaps and fills up with 'the 3 o'clock lumbar patient' within a week.
None of this comes from bad intent. It comes from speed, so the replacement has to be just as fast. Our WhatsApp comparison has more on that side.
How to set it up in an afternoon
- Pick one owner. The clinic director or office manager becomes the workspace admin and the only person who sends invitations.
- Create the six channels above. Make #clinical, #authorizations and #owners-private invite-only private channels.
- Invite by work email, one person at a time, so nobody joins without an invitation to their exact address.
- Set roles. Therapists manage #clinical, aides are members, and a part-time biller who only reads #authorizations can be a viewer.
- Turn on passkeys so sign-in is Face ID or Touch ID and nobody types a password on the clinic floor.
- Move the pinned things: Wi-Fi password, cleaning checklist and payer phone list go into channel topics or the files library.
- Announce the date the WhatsApp group retires, and leave it on that date as the owner.
On cost, Yodl's Team plan is $10 a month per location and includes five users, 20 GB of file storage and a signed BAA. Each person beyond five is $2 a month, so a clinic of ten pays $20 a month.
One thing to know about encryption
Most team chat built for HIPAA, Yodl included, is encrypted in transit and at rest but is not end-to-end encrypted. That is deliberate. End-to-end encryption would make search, retention, the audit log and admin removal impossible, and those are the safeguards HIPAA actually asks for. Slack and Microsoft Teams work the same way.
When you are ready to move the clinic off group texts, Yodl is $10 a month for five people, with a signed BAA on every plan.
Your therapists will message each other either way. Give them private channels covered by a BAA, with roles and an audit log, and the quick questions that keep a PT clinic moving stop being a liability.
Frequently asked questions
Is a physical therapy clinic a covered entity under HIPAA?
If the clinic bills insurance electronically, which almost every outpatient PT clinic does, it is a covered entity and must follow the HIPAA Privacy and Security Rules. Cash-only clinics should ask a compliance advisor.
Can a PTA text the supervising PT a plan-of-care question?
Yes, inside a tool that has signed a BAA with the clinic and lets the clinic control who is in the conversation. Not over personal SMS or a consumer app, which have no BAA.
What about aides who are part-time students?
Invite them like anyone else, with the member role in the channels they need. When the semester ends, remove the account the same day.
Does chat replace documentation in our EMR?
No. Any clinical decision discussed in chat still has to be documented in the patient's record. Chat is where the question gets asked quickly; the EMR is where the decision lives.