.jpeg)
Your front desk sends an appointment reminder, and the patient replies asking for a different time. Now you need rules for the reply, not just the first text.
Hello Patient builds AI agents for healthcare. Its agents can book and reschedule appointments by text. Questions your practice routes to staff arrive as a message or ticket with the conversation attached, so your team starts from what the patient wrote.
Patient texting can be part of a HIPAA-compliant workflow when your practice reviews the risks, protects patient information, and has the right vendor agreements in place. Permission to send the text needs its own review. HHS Security Rule summary; FCC healthcare exemption
This page covers what can count as PHI in a text, what to review before sending, how replies and STOP requests should work, and what to test with a vendor.
This page is general information, not legal advice.
Which patient texts count as protected health information?
An appointment reminder can count as protected health information. PHI includes identifiable information about a person's care and payment for care. The text does not need to name a diagnosis. HHS privacy summary
Read the sender and the message together. The practice name, the patient's details, and the appointment itself may reveal information. Your reviewers should also look at what someone can see on the phone before the patient opens the conversation.
What can the front desk put in the first text, and what waits for the patient's reply?
Keep the first text to what your reviewers approve for that message, then decide what can be shared after the patient replies. For a booking invitation, one option is a first text that lets the patient pick a time and does not name the procedure or the reason for the visit. That is a recommendation for your reviewers, not an approved template.
A reply does not prove who has the phone. It also does not mean you can stop protecting patient information. Your practice still needs to decide how the recipient is checked and when staff should move the conversation to another channel.
HHS permits patient email with reasonable safeguards, such as checking addresses and honoring communication preferences. This guidance is for email, not approval of SMS. When your practice gives information to the patient themselves, HIPAA's minimum-necessary rule does not apply. Your practice can still leave details out of the first text to protect patient information. HHS email guidance; HHS minimum-necessary guidance
What consent and STOP handling must be in place before the first patient text?
Your reviewers need to confirm what allows your practice to send that message to that patient. HIPAA permits using and sharing information for treatment and payment within applicable limits, but that does not settle whether you have permission to send the text. HHS treatment and payment guidance
The FCC healthcare exemption has narrow conditions. It excludes billing and promotions, and it requires immediate STOP processing. Your reviewers should confirm the federal, state, and carrier rules that apply to each type of message you plan to send. FCC order, paragraphs 141 and 146–148
Your practice decides which patients can get texts and which kinds of messages they can get. Ask the vendor to show those rules in the product. Then send STOP yourself. Hello Patient's agents text within those consent and campaign limits and honor STOP immediately.
Why does the vendor that sends and reads patient texts need its own BAA?
A vendor that handles patient information for your practice generally needs a business associate agreement, or BAA. The agreement sets out the vendor's responsibilities for that information and needs to cover the work the vendor does, including reading patient replies. Signing a BAA does not prove every responsibility has been met. HHS business associates guidance
Hello Patient is HIPAA-compliant, is SOC 2 Type 2 certified, and provides a BAA on every account. For the broader service review, see HIPAA and AI receptionists.
You can hear Hello Patient's voice demo and ask for a free demo agent. For texting, ask separately to see the written conversation and replies.
What happens when a patient texts back a question about their care?
The question goes to your staff as a message or ticket with the conversation attached, so they start from what the patient wrote. Your practice decides which team receives it before patients start replying.
During the vendor demo, read exactly what staff receive. Check whether they get the patient's question with the earlier messages attached, and confirm which team is expected to answer.
Are iMessage and a staff member's personal phone HIPAA compliant for texting patients?
The app name or the fact that a staff member owns the phone does not answer the question. HHS calls for a risk assessment and appropriate protections for mobile access, with applicable BAAs. It does not endorse or require a particular technology. HHS mobile guidance
Review the actual app and device setup. Check who can see patient information, how the phone will be used, and what protects the information. Do that before approving a personal phone for patient conversations.
What should a practice ask a vendor before turning on two-way patient texting?
Ask the vendor to run one complete text conversation with a fictional patient. Have the patient request a different appointment time, send a question your practice routes to staff, and type STOP. Check the booking change, the message or ticket staff receive, and what happens to future texts.
Review the BAA, sending permissions, and first message at the same time.
At Carbon Health, 40% of after-hours patients who received a texted booking link booked an appointment. Carbon Health case study
Hello Patient integrates with the EHR, practice management, and CRM systems healthcare already runs on.
Find out whether Hello Patient fits your practice. Book a call and bring one patient-texting workflow. Ask to see the replies, and request a free demo agent.
Frequently asked questions
Can a medical practice text a patient about a balance or a bill under HIPAA?
A billing text sent through Hello Patient's AI agents needs its own sending review. HIPAA allows patient information to be used and shared for payment within applicable limits, but that alone does not authorize a billing text. HHS payment guidance The FCC healthcare exemption excludes billing messages, so your reviewers need another basis for sending them. FCC order, paragraphs 146–148 Show reviewers the message, recipients, and opt-out process. They can also decide whether the first text needs the balance or can point the patient to an approved payment process. Payment-link mechanics need their own review.
Is regular SMS, not an app, HIPAA compliant for texting patients from a medical practice?
Regular SMS can be part of a HIPAA-compliant workflow when your practice reviews the message, recipient, vendor arrangements, and protections for patient information. Hello Patient's AI agents text patients for your practice, and every account comes with a BAA. HHS requires risk assessment and appropriate protections for electronic patient information, but it does not approve a technology by name. HHS Security Rule summary Its patient-email guidance applies to email, not SMS. HHS email guidance Review the first text and expected replies, then confirm sending permission separately, including whether an FCC healthcare exemption applies. FCC healthcare exemption
What has to happen when a patient replies STOP to a medical practice's text?
Hello Patient's AI agents honor STOP immediately. For messages sent under the FCC healthcare exemption, immediate STOP processing is required, but the exemption does not cover every kind of practice text. FCC order, paragraphs 146–148 The opt-out also needs to reach the system that controls future sending. Test this before launch. Send a message to a fictional patient, reply STOP, and check whether more messages can be sent. Your reviewers should confirm the opt-out rules for each message type, and the vendor should show how those rules work with the consent and campaign limits your practice has chosen.
Can an AI agent text patients on behalf of a medical practice under HIPAA?
With Hello Patient, AI agents book and reschedule appointments by text, right in your practice's schedule. Questions your practice routes to staff arrive as a message or ticket with the conversation attached, so your team starts from what the patient wrote. AI does not create blanket permission to text patients. HIPAA allows treatment and payment uses within limits, while vendors handling patient information generally need a BAA and appropriate protections. HHS treatment/payment; HHS BAAs; HHS Security Rule summary Sending permission needs separate review. FCC healthcare exemption Consumer-health workflows have a separate GLP-1 patient texting guide.
Is there a HIPAA compliant texting app for medical practices, and does a practice need one to text patients?
Hello Patient's AI agents can handle patient texting, but HIPAA does not require your practice to use a particular app. HHS calls for reviewing the risks, putting appropriate protections in place, and having applicable vendor agreements for mobile access. HHS mobile guidance Review the product based on how your practice will actually use it, including who can read patient messages. Ask the vendor to show what a patient does to receive and answer a text. Your reviewers should also confirm that the vendor agreement covers its work with patient information. A BAA is part of that review, not proof of compliance. HHS business associates guidance
How is HIPAA compliant patient texting different from a secure messaging app for staff?
Patient texting is between your practice and the patient, and Hello Patient's AI agents handle it for you. A secure messaging app for staff is for your team's internal messages, so approval for one setup should not be assumed to cover the other. HHS requires a risk assessment and appropriate protections for electronic patient information. HHS Security Rule summary Your reviewers should look at who takes part, what information is shared, and who can see it in each setup. The vendor agreement should match the work that vendor performs. If it handles patient conversations, its BAA needs to cover that work. HHS business associates guidance
Can a multi-location medical group set the same patient texting rules across every office?
A group using Hello Patient's AI agents can set shared texting rules, and your reviewers confirm how those rules apply at each office. HHS requires appropriate protections for electronic patient information, and the FCC healthcare exemption has specific conditions that do not cover every message type. HHS Security Rule summary; FCC healthcare exemption Your reviewers should also confirm the federal, state, and carrier rules that apply. Have the vendor run the same fictional patient exchange at two locations. Check which messages can be sent, what happens after STOP, and where the questions your practice routes to staff arrive as a message or ticket at each location.
.svg)
