Is Texting Clients HIPAA-Compliant?

The HHS Office for Civil Rights says the Privacy Rule allows health care providers to communicate electronically with patients, as long as they use reasonable safeguards. HHS does not ban unencrypted electronic messages for treatment communications. It does expect providers to limit the information in those messages and to take care that they reach the right person. If a patient finds a channel unacceptable, the provider should offer another one, such as phone or a more secure method. HHS FAQ 570

So texting itself is not the problem. The risk lives in how the texting is set up.

Personal phones. When a counselor texts clients from a personal cell, the messages sit on a device the program doesn’t control. Nothing records who saw what. If that counselor leaves, the conversations leave with them. The HIPAA Security Rule requires access controls, audit controls and transmission security for systems that hold electronic patient information. A personal phone usually provides none of these. 45 CFR 164.312

Vendors without a Business Associate Agreement. HHS treats services that only pass data along, with brief temporary storage, as "conduits." Those don’t need a BAA. Any service that keeps patient messages or data is a business associate, and the program needs a signed BAA with it. That holds even if the data is encrypted. HHS FAQ 2077 Most texting apps and messaging platforms store messages. Before using one, ask whether they will sign a BAA.

Social media. Meta does not sign Business Associate Agreements, and Facebook Messenger cannot be used to collect or share protected health information. HIPAA Journal An alumni Facebook group can still be a good community space. It just isn’t the right place for clinical check-ins or anything about a person’s treatment.

Records from federally assisted substance use treatment programs are also covered by 42 CFR Part 2. A final rule in 2024 brought Part 2 much closer to HIPAA. Compliance was required by February 16, 2026. Patients can now give a single consent for treatment, payment and health care operations. Breaches of Part 2 records now follow HIPAA’s breach notification rules, and penalties now match HIPAA’s. HIPAA Journal If you run a SUD program, make sure your consents and your Notice of Privacy Practices reflect these changes.

1. Text from a program-controlled number, never from personal phones.

2. Use a platform that signs a BAA with you, and make sure its own vendors are under BAAs too.

3. Keep a record of every message, every reply and everyone who accessed them.

4. Keep texts short and avoid detailed clinical information.

5. Get consent for text communication, and offer another channel to anyone who prefers one.

6. For SUD records, confirm your Part 2 consents are current.

This article is general information, not legal advice. Your compliance officer or attorney should review your specific setup.