HIPAA Compliant Texting: What It Requires and How It Works
Understand what HIPAA requires from a texting app, which features matter day to day, and how patients can text you without downloading anything.
Get started for freeSchedule a demo →
HIPAA compliant texting protects patient information with a signed Business Associate Agreement (BAA), encryption in transit and at rest, access controls, and audit logs. Ordinary SMS and consumer apps like WhatsApp and iMessage don't meet these requirements. BloomText meets them on every plan, including the free plan. Patients receive secure links over normal SMS and reply from any phone, with no app download. Your team messages from a shared clinic number and sees who has viewed each secure message.
What makes ordinary texting non-compliant?
Carriers and Consumer Apps Won't Sign a BAA
HIPAA requires a signed Business Associate Agreement with any vendor that handles PHI for you. Phone carriers and consumer apps like WhatsApp and iMessage won't sign one. Every patient text sent through them is unprotected, no matter how careful your staff are.
No Encryption and No Way to Revoke Access
Standard SMS travels unencrypted and lives on personal phones. If a phone is lost or a staff member leaves, patient conversations go with it. HIPAA requires encryption and control over who can see PHI.
No Audit Trail
Texts on personal phones cannot be retained, exported, or reviewed. When an auditor or a patient asks what was communicated, there is nothing to show. HIPAA requires a record of who accessed PHI.
What to look for in a HIPAA compliant texting app
A Signed BAA on Every Plan
The BAA is the first thing to check. Without one, no amount of encryption makes a texting app compliant. BloomText signs a Business Associate Agreement at no extra cost on every plan, including the free plan.
Texting That Works Over Normal SMS
Patients should not need to download an app to reach you. With BloomText, patients receive secure links over standard SMS and reply from any phone. Staff send from a dedicated clinic number, so personal numbers stay private.
Read Receipts on Secure Messages
Know whether a message was seen. Read receipts on secure messages show who is up to date, so important updates do not slip through and supervisors can confirm a time-sensitive question was picked up.
Broadcast Messaging With Private Replies
Send appointment reminders, closures, and updates to a group of patients in one send. Each recipient gets their own private conversation, so replies come back to your team one-to-one. No patient ever sees another patient's reply.
Shared Team Visibility
Patient conversations belong in a shared inbox, not on one person's phone. The right coworker can step in and respond, and supervisors keep visibility into the conversations they are responsible for.
Audit Logs and Message Retention
Every message is retained on your organization's account and exportable for audit. Admins control who has access and can revoke it the same day someone leaves.
Frequently Asked Questions
- No. Standard SMS is not encrypted, carriers won't sign a BAA, and there is no audit log. BloomText sends patients secure links over normal SMS, so texting still feels familiar while the message stays encrypted and logged.
- Yes, when messages contain PHI. HIPAA requires a signed Business Associate Agreement with any vendor that stores or transmits PHI on your behalf. BloomText includes a signed BAA on every plan, including the free plan.
- Yes, for secure messages. When a coworker or patient views a secure message, their icon appears below it, so you can see who is up to date. Plain SMS has no read signal from carriers, so read receipts apply to secure messages only.
- Yes. A broadcast sends one message to a group of patients, and each reply comes back to your team as a private one-to-one conversation. No patient sees anyone else on the recipient list.
- BloomText has a free plan with a signed BAA that covers secure team messaging. Based on current published pricing, SMS patient texting starts at $129/month and team chat is $14.50/user/month. There are no setup fees and no annual contract.
