Secure SMS for healthcare — what can travel by text, what can't, and how to do the rest
Standard SMS is not encrypted, but patients still prefer it. The line between safe reminders and clinical content, the secure-link pattern that handles PHI, and the consent and audit trail your compliance team will ask about.
On this page
Patients want texts; HIPAA wants encryption
Texting is how patients actually want to hear from a health system: confirmations get answered, reminders get read, and phone tag disappears. The complication is that standard SMS is not an encrypted channel. Messages cross carrier networks in a form the carriers can read, sit unprotected on lock screens, and land on whatever phone currently holds that number.
That doesn't make healthcare texting impossible — it makes the content rules matter. The teams that get this right draw a hard line between what rides in the SMS body and what sits behind a secure link, and they build consent and audit into the program from the first message. This guide covers where that line goes.
What standard SMS can safely carry
The working rule: an SMS body should make sense and do no harm if the wrong person reads it. That allows more than most teams assume:
- Appointment logistics — date, time, location, provider name where your policy permits it, and parking or arrival instructions
- Confirmations and rescheduling prompts — "Reply C to confirm or R to reschedule"
- Generic action prompts — "You have a new message from your care team," "A form is ready to complete," "Your prescription is ready for pickup"
- Payment links — tokenized links to a secure payment page for copays and balances, with no balance details in the message itself
Note what these have in common: they reference that something exists without saying what it is. "Your results are ready — sign in to view" exposes almost nothing. "Your A1C came back at 9.2" exposes a diagnosis to anyone holding the phone.
What should never ride in an SMS body
The other side of the line, regardless of how convenient it would be:
- Diagnoses, conditions, symptoms, or anything that implies them — including a clinic name that gives the condition away (a reminder "from Oncology" says more than it should)
- Test and lab results, even normal ones
- Medication names and dosage changes
- Treatment details, clinical instructions, or care-plan content
- Insurance details, claim specifics, or account balances
When the workflow genuinely needs to deliver that content, it doesn't go in the text. It goes behind the link.
The secure-link pattern
The pattern that lets texting and PHI coexist: the SMS is the doorbell, not the package.
- The patient gets a generic SMS — "You have a new secure message from your care team. Tap to view."
- The link opens an encrypted session, delivered over TLS
- The patient authenticates — date of birth, a one-time code, or portal credentials, matched to the sensitivity of the content
- The clinical content is read inside the secure session, and never existed in the SMS at all
The same pattern covers secure form intake (the link opens a form, the data flows encrypted into the record, never through the carrier network) and payments (a tokenized pay link, so neither the agent nor the SMS channel ever touches card data). The whole exchange — reminder, secure thread, payment — should live on one platform so the conversation history stays in one auditable place. This is how SingleComm's secure patient SMS works: encrypted messaging, tokenized pay links, and every interaction logged.
Consent and opt-out are not paperwork
Texting patients requires their permission, and the permission has to be specific and revocable:
- Capture consent explicitly — at intake, on a call, or via an opt-in keyword — and record when, how, and for what (appointment reminders and billing texts are different consents than care-team messaging)
- Honor STOP instantly and automatically — an opt-out that depends on a human updating a spreadsheet is an opt-out that will eventually fail; revocation should propagate to every campaign at the platform level
- Re-confirm when numbers change — recycled phone numbers are the quiet failure mode of healthcare texting; a reminder sent to a number the patient gave up two years ago goes to a stranger
- Keep preference updates in the workflow — when a patient tells an agent "text me, don't call," that change should write back to the record on the same screen and govern the next message automatically
The audit trail your compliance team will ask for
When the texting program gets audited — and a healthcare texting program will get audited — the questions are predictable. The platform should answer all of them from its logs:
- Which messages were sent, to which number, when, and by which workflow or agent
- What consent was on file at the moment each message went out
- When opt-outs were received and how quickly they took effect
- Who accessed message threads, under what role
- What the retention policy is, and proof it's being enforced
This is why ad hoc texting — agents using personal phones or a standalone texting app — is the real compliance risk in most organizations. It's not that someone meant to text PHI; it's that nothing logged what was sent. A platform with a BAA in place, encrypted messaging, role-based access, and per-interaction audit logs turns those audit questions into queries instead of investigations.
The short version
Healthcare texting is safe when the SMS body carries logistics and prompts while everything clinical sits behind an authenticated secure link. Draw the content line explicitly, capture consent per use and honor STOP automatically, and run the whole program on a platform that signs a BAA and logs every message, consent, and access. Patients get the channel they prefer; compliance gets an audit trail instead of a blind spot.
Back to
Industries
Return to the main industries page to see the full product family.
Related guides
Guide
The year-end giving campaign playbook — planning the December surge without burning out your team
Compliant appeal outreach, SMS-first touchpoints, volunteer staffing with one-day onboarding, secure donation processing at volume, and the post-campaign follow-up that turns December givers into January donors.
Guide
The TAS migration checklist — moving off a legacy answering service platform without losing a client
Importing client scripts, rebuilding dispatch rules, preserving on-call contact trees, migrating reporting formats, parallel testing high-risk clients, and sequencing go-live so nothing breaks at 2 a.m.
Guide
The subscriber retention playbook — saves, win-backs, and the calls that keep circulation alive
Renewal reminders, price-increase notices, cancellation save offers, payment-failure outreach, and win-back campaigns — plus the two numbers that tell you whether any of it is working.