Can you legally text patients and clients?
Yes, with the right consent and the right channel for what you send. Plain SMS isn't built for health details. A reminder with no clinical detail is a different case.
Want to see it first? Book a demo
The short answer
- Texting patients and clients is generally legal with proper consent. What the message says decides which channel fits. Plain SMS isn't built to protect health details. A simple appointment reminder with no clinical detail carries less risk.
- Protected health information sent by text needs a secure, encrypted channel and a signed Business Associate Agreement (BAA). Plain SMS and other consumer texting lack the safeguards HIPAA is generally read to require.
- TCPA consent rules apply on top of HIPAA. Marketing or automated texts to any client, medical or not, generally need prior express consent under the TCPA, whatever the HIPAA answer is.
- For anything past a basic reminder, the safer default has 3 parts. Get recorded consent, tell people plain text isn't fully secure, and use a secure channel built for health details.
Why the content of the message decides the standard, not only the fact of texting
It's tempting to treat "can I text patients" as one yes-or-no question. The honest answer depends on what the text says. A reminder that only confirms a time, with no reason for the visit and no health detail, carries much less risk than one that names a diagnosis, a drug or a treatment. Clinics commonly send the first kind over plain SMS with patient consent. The second kind generally needs a secure channel fit for HIPAA, with a BAA covering the vendor.
Plain SMS lacks the encryption, access controls and audit trail HIPAA is generally read to require. That doesn't put all texts to patients off-limits. It means a message with health details needs a different tool than a plain text. Purely practical content, like times and directions, is treated more leniently in common practice.
What kind of text needs what kind of channel
| Message content | Typical channel | Why |
|---|---|---|
| Appointment time confirmation, no clinical detail | Standard SMS, with consent | Lower risk, commonly accepted practice |
| Message referencing diagnosis, treatment, or medication | Secure, HIPAA-appropriate channel with a BAA | Contains protected health information |
| General marketing or promotional text | Standard SMS, with TCPA-compliant consent | Not health information, but still needs consent |
This is not legal advice. Confirm your specific obligations with counsel, especially for any message referencing health details.
What to check before texting patients or clients
Sort your messages by what they say. Which ones are purely about logistics, and which could reveal health details? Check that you have recorded consent to text at all. For anything that touches health details, check that your channel has a signed BAA and the safeguards that come with it.
Disclosure: SalesCrew is our product. SalesCrew makes no HIPAA claim; it holds enquiry and scheduling data, and clinical records stay in your practice system. Its two-way SMS keeps a consent record and handles STOP replies. The distinction between logistical and clinical content applies whichever system sends the message.
Standard SMS is not built for health information
Questions
- Is standard SMS ever acceptable for patient communication?
- Yes, for content with no clinical detail, like an appointment reminder that names no health details. A text that reveals protected health information generally needs a secure, encrypted channel with a signed BAA in place, not plain SMS.
- Does patient consent to texting need to be in writing?
- Written or otherwise recorded consent is the usual advice, plus a note that plain text isn't fully secure. Check the current standard for your own case. Don't assume spoken consent alone is enough.
- Does this apply to non-medical client texting too?
- Partly. The HIPAA rules apply only to protected health information. The TCPA consent rules for marketing or automated texts apply to any business that texts clients, medical or not.