HIPAA-safe patient messaging

HIPAA permits appointment reminders and routine follow-up by text, email, phone, and voicemail, as long as you limit what you say to what the message needs and respect how each patient asks to be contacted. In practice that means messages that name the practice, the time, and how to reach you, and nothing about diagnoses, procedures, test results, or conditions. Patients can request confidential communication channels, and you must accommodate reasonable requests.

The rules below come from official guidance published by the US Department of Health and Human Services (HHS). We link to each source so you can read it yourself.

What HHS guidance says

Appointment reminders are treatment. HHS states in its FAQ on appointment reminders that reminders are part of a patient’s treatment and can be made without the patient’s authorization.

Messages and voicemails are allowed, with care. HHS guidance on leaving messages for patients says the Privacy Rule does not prohibit leaving messages on answering machines or with a family member who answers the phone. It also says to limit what is disclosed. HHS suggests leaving only the practice’s name and number and the information needed to confirm an appointment, or asking the patient to call back.

Email is allowed with safeguards. HHS’s FAQ on using email with patients says providers may communicate by email if they apply reasonable safeguards. If a provider thinks a patient may not understand the risks of unencrypted email, it can explain them and let the patient decide.

Patients can choose unencrypted email for their records, after a warning. HHS guidance on the right to receive information in the manner requested says a provider should briefly warn the patient about the risk of unencrypted email and confirm they still want it. A provider cannot force a patient to accept an insecure method.

Minimum necessary applies. HHS’s minimum necessary guidance asks covered entities to take reasonable steps to limit uses and disclosures of protected health information to what is needed for the purpose. HHS notes that disclosures to the patient themselves are not subject to the standard, but your message may be seen by someone else first, which is why neutral wording matters.

Texting. We did not find an HHS FAQ that addresses text messages specifically. Apply the same principles, include texting in your security risk analysis, and confirm your setup with counsel.

What can and can’t go in a message

Generally safe in texts, emails, and voicemails:

• Practice name and phone number
• Patient’s first name
• Date and time of the appointment
• Provider name, when the practice name already reveals the specialty
• A link to a secure portal, scheduling page, or forms system
• A request to call back

Keep out of texts, emails, and voicemails:

• Diagnoses, conditions, and symptoms
• Procedures, treatments, devices, and medications
• Test results, including “normal” results
• Balances combined with clinical details
• Anything about a family member’s care

Our playbook templates are written to these rules. Where a template differs by specialty, it stays neutral about the reason for the visit.

Honor communication preferences

Ask every patient at intake how they want to be contacted, and record it where every staff member will see it:

• Preferred phone number, and whether texts and voicemails are okay
• Preferred email address, and whether email is okay
• Anyone else who may receive messages, such as a parent or caregiver
• Any alternative address or number the patient asks you to use

HHS guidance says you must accommodate reasonable requests for confidential communications by alternative means or at alternative locations. A patient who asks for calls only on their mobile phone should never get a voicemail on a home line. Text consent also has its own rules under telephone law; see our SMS consent and TCPA basics.

Business associates

If a texting platform, email service, or reminder vendor handles patient information on your behalf, it is likely a business associate under HIPAA, and you will generally need a business associate agreement with it. Ask every messaging vendor whether it will sign one before you send patient data through its system, and confirm the arrangement with counsel.

Reviews and social media

Replies to online reviews are a common and avoidable privacy mistake. In 2023, HHS announced an agreement with a provider that disclosed patient information in responses to negative online reviews. Never confirm that a reviewer is a patient. Our review request playbook includes privacy-safe reply templates.

Rollout timeline

Templates

Hi [First name], this is [Practice name] reminding you of your appointment on [Day] at [Time]. Reply C to confirm or call [Phone] to reschedule.

“Hi, this message is for [First name]. This is [Your name] calling from [Practice name]. Please give us a call back at [Phone] when you have a moment. Thank you.”

Subject: A message from [Practice name]

Hi [First name],

You have a new message from [Practice name]. Please log in to your secure patient portal to read it: [Portal link]

If you have trouble logging in, call us at [Phone].

[Practice name]

“You’ve asked us to send this by regular email. I want to let you know that regular email isn’t encrypted, so there’s some risk someone else could see it while it’s being sent. Would you still like us to send it by email, or would you prefer the patient portal?”

Document the patient’s choice in the record.

What to measure

• Template audit: share of active templates and automated messages that contain no clinical details. Aim for all of them.
• Preference capture: new patients with contact preferences recorded at intake.
• Preference errors: messages sent to a channel the patient declined, tracked as incidents.
• Training completion: staff who completed messaging training this year.

For choosing the right channel for each situation, see text vs. email vs. phone follow-up. For wording you can use today, start with our missed-appointment templates.