Can you text patients? HIPAA-safe texting for a solo practice

Yes, a solo practice can text patients. Use a texting tool that signs a BAA, get the patient's consent to text, and keep messages to the minimum: times, links and short replies, not results or treatment details. Personal cell numbers and the free Google Voice app don't come with a BAA, so they shouldn't carry patient conversations.

Texting is one layer of a bigger stack. For the rest (EHR, forms, payments, email and automation), see the HIPAA-safe tool stack for a solo cash-pay telehealth practice.

Is it a HIPAA violation to text a patient?

No. HIPAA doesn't ban texting. It requires reasonable safeguards for patient information, and a BAA with any vendor that stores or sends it for you. A text sent from a tool that signs a BAA, with only the information the patient needs, is a normal part of running a practice.

The trouble starts with the tool and the content. A text from your personal cell sits on your phone, your carrier's servers and your phone's cloud backup, none of which has a BAA with you. A text that says "Your hormone panel shows low levels" puts results on a lock screen anyone nearby can read.

What consent do you need, and what can patients ask for?

Ask every patient, in writing, whether they agree to receive texts, and record the answer in your EHR. Add one line to your intake form that says what you'll text (appointment reminders, payment links, short replies) and that texts aren't for urgent or clinical questions.

Patients also have choices. Under HIPAA they can ask to be contacted a certain way, such as only by text or never at a work number, and you should honor reasonable requests. HHS guidance on email says a provider may use unencrypted messages when a patient prefers them after being told the risks. See the HHS FAQ on emailing patients.

Automated texts need their own opt-in. Carriers expect a clear "yes" to receiving texts, a way to stop them (reply STOP) and your practice name in the message. Most texting tools handle STOP replies for you.

What should you text, and what should you leave out?

Text the logistics and keep the care in the EHR. A good test: if a stranger read the text over the patient's shoulder, would they learn anything about the patient's health? If yes, rewrite it or send a link to the patient portal instead.

Safe to text:

• appointment times, confirmations and reschedule links
• payment links labeled "Consult" or "Lab fee"
• "Your intake form is ready" with a link
• "You have a new message in the patient portal"
• short replies to scheduling or billing questions

Keep out of texts:

• lab results and values
• diagnoses, symptoms and treatment details
• program names that reveal a condition, like "your weight-loss program check-in"
• medication names, refill details and doses
• photos of forms, labs or IDs

Here is a reminder that passes the over-the-shoulder test:

For more wording by stage, use our follow-up template generator or the 14 follow-up templates.

Which texting options sign a BAA?

As of October 2026, Spruce signs a BAA on all plans, Quo on its Business and Scale plans, Google Voice only as a licensed add-on to a paid Google Workspace account, and Twilio only on its Security or Enterprise Edition. Many EHRs also send texts under their own BAA.

For most solo owners the choice comes down to two paths. If your EHR sends reminders you're happy with, use it for automated texts and add Spruce or Quo for two-way conversations. If it doesn't, Spruce covers both on one number. The full BAA table lists 31 tools with sources.

Is Google Voice HIPAA compliant, and what about your personal cell?

Google Voice is covered by Google's BAA only for managed users, which means a Voice license added to a paid Google Workspace account with the Workspace BAA accepted. The free Google Voice app, and standalone Voice plans that run on a personal Gmail account, aren't covered.

Google's list of covered services says "Google Voice (managed users only)". Google's Voice plan comparison shows that Starter and Standard can also run standalone on a personal Gmail account. Those standalone accounts aren't managed users, so they don't get the BAA.

A personal cell is the most common setup in a new practice and the hardest to undo later. Patients save the number and keep texting it. Move to a practice number early, set an auto-reply on your personal line that points to it, and stop replying from your own phone.

Do you need to register for business texting (10DLC)?

Yes, if you send texts from a regular 10-digit business number through an app. US carriers require A2P 10DLC registration, which verifies your business and describes the texts you send. Twilio's 10DLC guide says unregistered traffic gets extra carrier fees. Most texting tools walk you through registration when you set up a number. Expect a short wait for approval, and write your sample messages without health details.

Which texts should be automated, and which should be manual?

Automate the texts that are the same for every patient and depend on a date or a step. Write the ones that need judgment by hand. Automated reminders also go out on time on a busy clinic day.

• Automate: appointment reminders (24 hours and 2 hours before), intake form nudges, lab-fee link reminders, "time to book your follow-up" messages and no-show reschedule links.
• Manual: replies to questions, anything about results, changes to a plan, and messages to patients who seem upset.

Set one rule for clinical questions that arrive by text: reply with a short message that moves the conversation to the portal or a visit. For example: "Thanks, Dana. We've had your question. We'll answer in your patient portal today." Our guide to reducing no-shows covers reminder timing in more detail.

Not sure where texts fit in your patient flow? Request a free patient journey map. Don't include any patient information in the form.

This is general information, not legal advice. Confirm BAA terms with each vendor.