HIPAA does not ban texting. It requires that any message containing protected health information (PHI) travels through a channel your practice controls, with a vendor that has signed a Business Associate Agreement (BAA), and that staff share only what the other person needs. Regular SMS and consumer messaging apps fail the first test, so they are out for anything about a patient.
What HIPAA says about texting, and what it does not say
Search the HIPAA rules for the word texting and you will not find it. The Privacy Rule and the Security Rule were written to be technology neutral. They apply to covered entities (practices, clinics, pharmacies and other providers) and to their business associates (vendors that handle patient information for them). They set standards for how protected health information, or PHI, any information that identifies a patient and relates to their health or care, must be protected. A text message is simply one more place PHI can show up.
So the question is never whether texting is allowed. It is whether this specific text, on this specific app, meets the standards.
Rule 1: PHI only travels through a BAA-covered tool
A Business Associate Agreement (BAA) is the contract in which a vendor agrees to protect PHI the way HIPAA requires. The rules require it before a vendor handles PHI (45 CFR 164.502(e) and 164.308(b)). Your phone carrier will not sign one for SMS. WhatsApp, iMessage and Facebook Messenger will not sign one either. That single fact settles most texting questions: if the app has no BAA with your practice, no patient information goes through it.
A chat tool built for small practices solves this at the root. Yodl, for example, signs a BAA with every customer on every plan, so staff can message about patients inside it without a second thought about the vendor side.
Rule 2: minimum necessary applies to texts too
The Privacy Rule's minimum necessary standard means you share only as much PHI as the task needs. Inside a compliant tool this is about habit, not legality. The chart holds the detail; the message points to it.
| Instead of this | Write this |
|---|---|
| Full name, date of birth, diagnosis and medication list in a channel | Patient in room 3 (chart 4471) has a question about today's prescription, can you call? |
| A photo of the whole intake form | Intake for the 2:30 is done, two allergies flagged in the chart |
| Forwarding a lab PDF to the front desk group | Lab result for chart 4471 is in, Dr. K needs to see it before the callback |
| Discussing a patient's history in the all-staff channel | A direct message to the one person who needs it |
Rule 3: patient consent does not make SMS compliant for staff
This is the most common myth. Patients can choose how they want to hear from you, and many ask for text reminders. That is the patient's choice about messages sent to the patient. It says nothing about two staff members discussing that patient over SMS. Staff-to-staff texting is the practice's own system, and the practice has to secure it. A patient's consent form cannot do that for you.
Rule 4: the phone has rules too
The Security Rule expects reasonable device safeguards. For a small practice on personal phones, that means a passcode on every phone, an app that locks itself, notifications that do not show message content, and a plan for lost phones. It also means no PHI in screenshots, camera rolls or personal notes apps.
- Passcode or Face ID on every phone that opens work chat.
- Automatic lock: Yodl locks after 15 minutes of inactivity and supports passkeys (Face ID or Touch ID).
- Lock-screen notifications that say there is a new message and nothing else.
- Report a lost phone within the hour; an admin removes the user the same hour.
What a compliant staff channel looks like
Put the four rules together and the picture is clear. A compliant channel has a signed BAA, encryption in transit and at rest, invite-only membership, roles so that not everyone sees everything, an audit log, retention settings and an inactivity lock. Messages inside it keep patient detail to the minimum and point to the chart for the rest. Staff know the rules because they signed a one-page policy and spent twenty minutes in training.
What it does not need is end-to-end encryption. That is a personal messaging feature, and it prevents the search, retention and audit controls HIPAA expects. Slack, Microsoft Teams and most healthcare chat tools are encrypted in transit and at rest but not end-to-end, and that is fine.
A texting policy you can post in the break room
- Patient information goes only in [approved app]. Never in SMS, WhatsApp, iMessage, email or personal apps.
- Say only what the other person needs. Use chart numbers and room numbers; the chart has the rest.
- No screenshots, photos or forwards of patient information outside the approved app.
- Every phone with the app has a passcode, and the app's auto-lock stays on.
- Lost or stolen phone: tell [manager] within one hour, any time of day.
- Not sure whether something counts as PHI? Ask before you send.
Six lines, signed and dated, cover almost every texting situation a small practice runs into. If you still need the approved app, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
Staff texting is fine when it happens inside a tool that signed a BAA, sticks to the minimum necessary, and lives on locked phones. SMS and consumer apps fail the first test no matter how short the message.
Frequently asked questions
Can staff text a patient's first name only?
Treat it as PHI. In a small town a first name plus any context identifies a person. Use a chart or room number inside the approved app instead.
Is texting allowed in an emergency?
HIPAA allows sharing PHI for treatment, but the rules still expect reasonable safeguards. Use the approved app, which is just as fast on any phone. If only SMS worked, keep it to the minimum and document what happened.
Do we need patient permission to discuss them in team chat?
No. Staff discussing a patient for treatment, payment or running the practice is permitted. The requirement is that the channel is secured and the content is the minimum needed.
Are voice notes treated the same as text?
Yes. A voice note describing a patient is PHI. Keep it inside the BAA-covered app and apply the same minimum necessary rule.
What about texting a colleague's personal number after hours?
Same rule. If the message is about a patient, it goes in the approved app, which works in any phone's browser. If it is about swapping a shift, SMS is fine.