Not when the text contains patient information. Standard SMS travels unencrypted through the carrier, is stored on both phones and on carrier systems, and no carrier signs a Business Associate Agreement (BAA) for message content. HIPAA does not ban texting; it requires safeguards and a BAA wherever protected health information (PHI) goes, and SMS has neither. Staff can still text about non-patient matters, and they can message about patients inside a tool that signed a BAA.
What HIPAA actually says about texting
HIPAA never mentions texting. It sets rules for protected health information (PHI), any detail that identifies a patient and relates to their health, care or payment, and it applies those rules to covered entities (practices, clinics, agencies) and to the business associates that handle PHI for them. The Privacy Rule governs who may see PHI and why. The Security Rule requires safeguards for electronic PHI: access controls, audit, transmission security and more.
Two parts matter for texting. First, a vendor may only handle PHI for you under a signed Business Associate Agreement (BAA), the contract in which the vendor accepts HIPAA obligations (45 CFR 164.502(e) and 164.308(b)). Second, encryption is an "addressable" safeguard: not optional, but something you must assess and either implement or justify not implementing. Plain SMS fails both parts at once. The HHS Office for Civil Rights (OCR) is the agency that enforces these rules.
Why carrier SMS fails the test
| Safeguard | Standard SMS |
|---|---|
| Encryption in transit | No. Messages cross the carrier network in a form the carrier can read. |
| Encryption at rest | Not under your control. Copies sit on both phones, in backups, and on carrier systems. |
| A BAA covering message content | No. Carriers do not sign one with your practice. |
| Access control | None. Whoever holds the phone reads the thread, including on the lock screen. |
| Audit trail | None. You cannot see who read what or when. |
| Removing a former employee | Impossible. The thread stays on their phone. |
| Retention and legal hold | None. Messages are deleted or kept at each person's whim. |
Notice that encryption is only the first row. Even if a carrier encrypted everything tomorrow, the other six rows would still be empty. That is why the answer does not change when someone points out that iMessage or WhatsApp encrypt end to end: Apple publishes no BAA for iMessage, and Meta's own terms say it is not a business associate. Encryption is one safeguard; HIPAA wants the set.
The "conduit" idea, and what it does not cover
You may hear that phone carriers are "conduits" and therefore exempt. That is true, and it is also beside the point. HHS treats a carrier like the postal service: it transports the message, does not keep it for its own purposes, and is not a business associate. The conduit idea explains why your carrier owes you no BAA.
It says nothing about your practice. Your staff are not conduits; they are your workforce, and a text they send about a patient is your practice disclosing PHI over an unprotected channel. The carrier is excused. You are not.
What texting is still fine for
Staff can text each other all day as long as the content is not PHI. The line is identifiability plus health or care.
| Text | OK over SMS? | Why |
|---|---|---|
| "Running 10 minutes late, can you open?" | Yes | About staff, not patients |
| "Who is covering Saturday?" | Yes | Scheduling among staff |
| "Mrs. Patel is asking about her biopsy result" | No | Name plus health information |
| "The 3:15 cancelled, can we move the crown patient up?" | No | Appointment plus treatment identifies a person in a small practice |
| Photo of today's schedule | No | Names, times and visit types |
| "Call the office when you can" | Yes | No patient detail at all |
When in doubt, send it in the approved tool. The cost of caution is zero.
What to use instead
The fix is a staff chat tool that signs a BAA and provides the safeguards SMS lacks: invite-only membership, roles, an audit log, retention and legal hold, encryption in transit and at rest, an inactivity lock, and notifications that keep message text off the lock screen. The familiar channel layout matters too, because a tool staff dislike becomes a tool staff route around.
Yodl is one option built for exactly this: $10 a month per location for 5 users with a signed BAA on every plan. It is staff-to-staff only. Texting patients is a separate problem with its own tools, such as patient-communication platforms, or PhiClaw and Talkya from the same company; do not solve it by adding patients to your staff chat.
Then write the rule down. A three-line policy is enough: patient information goes only in the approved tool; SMS and personal apps are for non-patient matters; report a wrong-channel message or lost phone within the hour. Add it to onboarding and to the annual training you already do.
A simple policy you can adopt today
- Name the one approved tool for staff messages about patients, and confirm it has signed a BAA with the practice.
- State plainly that SMS, iMessage, WhatsApp, Signal and personal email are not approved for PHI, even between coworkers.
- Define PHI with three examples from your own office, like the table above.
- Require a passcode and auto-lock on any phone with the approved app, and a same-day report if a phone is lost.
- Remove departing staff from the tool on their last day, and keep the message history.
- Review the policy once a year and whenever the tool changes.
If you need the approved tool, Yodl is $10 a month for 5 people with a signed BAA; details are on the pricing page.
Texting is fine for non-patient matters and not fine for PHI. SMS is unencrypted, carriers sign no BAA for message content, and the conduit exception protects the carrier, not your practice. Use a BAA-covered chat tool for anything about a patient.
Frequently asked questions
Is texting between two coworkers about a patient a HIPAA violation?
Over regular SMS, iMessage or WhatsApp, it is a disclosure of PHI through a channel with no BAA and no safeguards, which is the kind of thing OCR looks into. Inside a tool that signed a BAA, the same message is fine when it shares only what the other person needs.
Does patient consent make SMS okay for staff texting?
No. A patient's consent to receive texts is about communication with that patient. It does not change how your staff must protect PHI among themselves.
What about a texting app with encryption, like iMessage?
Encryption covers one safeguard and leaves the rest missing: no BAA, no admin removal of former staff, no audit trail, no retention. Apple publishes no BAA for iMessage, so it is not an appropriate place for PHI.
Can staff text patients?
That is patient-facing communication, a different question with different tools. Yodl is staff-only; patient texting belongs in a platform built for it that signs a BAA, such as PhiClaw or Talkya.
Is a group text with the whole team ever acceptable?
For non-patient topics, yes. For anything that identifies a patient, no. Most practices find it simpler to move all work chat into the approved tool so nobody has to judge each message.