HIPAA Compliant Messaging Apps: Which Chats Need One

"Your order shipped."

"Your refill is ready."

"Your dose goes up on Monday."

These messages do not carry the same privacy risk. The first may be a routine shipping update, while the others can reveal that someone receives medical treatment. Whether a telehealth business needs a HIPAA-compliant messaging app depends on who is communicating, what information the message contains, and how the communication system protects it.

In practice, any channel that carries identifiable information about a patient's care needs safeguards that meet the HIPAA Security Rule and, generally, a business associate agreement when an outside vendor stores or processes those messages. That includes clinician and patient chats, support threads that mention a treatment, refill or dose notices, and consultations between clinicians. A shipping update that names no medication or condition carries far less risk.

Clinician and Patient

A conversation between a clinician and a patient can contain some of the most sensitive information a telehealth business handles.

Patients may send photographs of symptoms, discuss medication side effects, describe changes in their condition, or ask whether to adjust a prescribed dose. Clinicians may respond with treatment instructions, clinical questions, or recommendations for additional evaluation.

When these communications identify a patient and relate to their care, they generally involve PHI. Electronic systems that maintain or transmit that information are subject to applicable HIPAA Security Rule requirements.

A channel used for clinical messaging therefore needs safeguards that address several risks: unauthorized people reading messages, staff accessing conversations outside their responsibilities, and sensitive content being exposed during transmission.

Why the Channel Matters

Consider a patient who sends a photograph of a skin concern.

The clinician needs to receive the image, connect it to the correct patient, and evaluate it in the context of the medical record. If the photograph arrives through an employee's personal messaging account, the organization may have limited control over where it is stored, which devices can access it, or whether the communication becomes part of the appropriate clinical record.

A managed clinical messaging environment can support a more controlled workflow. Authorized users can access the conversation through the healthcare system, while the organization can apply its access, documentation, and security policies.

The same principle applies to medication discussions. A message asking about side effects should reach the appropriate clinical team rather than an unrelated support queue.

For the healthcare operator, the priority is choosing a communication environment that fits the clinical workflow and supports the safeguards required for the information involved.

Support Team and Patient

Not every message to a patient comes from a clinician.

Customer support teams may answer questions about account access, shipping, payments, appointments, or subscription changes. These conversations can appear administrative, but the information they contain may still reveal something about a patient's healthcare.

A shipping question is a useful example. A message stating that an order has shipped may disclose relatively little on its own. Adding the medication name, treatment category, or reason for the prescription can reveal substantially more.

Billing communications create similar concerns. An employee might unintentionally include a diagnosis, treatment plan, or prescription detail while explaining a charge.

Keeping Support Conversations Within Scope

Support teams should receive enough information to resolve legitimate administrative questions without routinely accessing unnecessary clinical details.

For example, a support representative may need an order number, transaction status, or delivery update. They do not necessarily need the patient's diagnosis or the contents of a clinician's treatment note.

An effective patient communication software workflow separates routine service questions from conversations requiring clinical judgment.

When patients ask whether a medication is causing symptoms, whether they should change a dose, or whether a treatment is appropriate, direct those questions to a qualified clinician.

The messaging environment also needs to reflect staff permissions. A support employee's access should match their responsibilities rather than automatically extend to every patient conversation.

For brands using external customer support services, the vendor's role also matters. If that service creates, receives, maintains, or transmits PHI on the organization's behalf, business associate requirements may apply.

Automated Notices

Automated messages help telehealth teams manage appointments, refill workflows, account activity, and order fulfillment without manually contacting every patient.

However, automation can distribute sensitive information at scale if templates contain unnecessary clinical details.

Compare these two refill notifications:

"Your testosterone prescription is ready."

"An update is available in your patient portal."

The second version gives the patient a reason to check their account without putting the medication name directly into a notification that may appear on a locked phone screen or another shared device.

The same approach can apply to appointment notifications and shipping updates.

How Much Should a Reminder Reveal?

A reminder should include enough information to serve its purpose without revealing unnecessary treatment details.

For example, appointment reminders may communicate the date, time, and appropriate access instructions without identifying a sensitive condition.

This does not mean every appointment reminder must use identical wording. The appropriate content depends on the service, communication channel, recipient preferences, and applicable privacy safeguards.

For automated messaging, organizations should also review what appears in delivery previews, notification history, and any connected services handling the message.

A carefully written template can reduce unnecessary disclosure, but neutral wording alone does not make an otherwise unsuitable messaging system HIPAA-compliant.

Clinician and Clinician

Telehealth care often involves communication among multiple healthcare professionals.

A clinician may consult a specialist, coordinate with another prescriber, request a second opinion, or communicate relevant findings to a provider involved in the patient's treatment.

These communications can include diagnoses, laboratory results, treatment plans, prescriptions, and other PHI.

HIPAA generally permits covered healthcare providers to disclose PHI to another healthcare provider for treatment purposes without obtaining a business associate agreement with that treating provider.

The distinction is important: the receiving clinician is not automatically a business associate simply because patient information is shared for treatment.

However, permission to disclose information for treatment does not eliminate the need for appropriate privacy and security safeguards.

A Clinical Purpose Does Not Secure the Message

Imagine a clinician sending a consultation note through the default messaging app on a personal phone.

The recipient may be an appropriately licensed physician participating in the patient's care, and the disclosure itself may have a permitted treatment purpose. But the organization still needs to assess device security, message transmission, account access, and whether it handles the communication consistently with its policies.

Personal messaging systems create uncertainty when employees change devices, lose phones, keep patient messages after leaving an organization, or mix private conversations with clinical information.

A managed communication system can make access permissions and organizational oversight easier to administer.

For multi-provider telehealth organizations, clinical messaging policies should also define when information belongs in a patient's medical record, how urgent messages are escalated, and who reviews messages that require action.

The goal is to let clinicians exchange necessary information without losing organizational control over protected patient communications.

What a HIPAA-Compliant Messaging App Needs

Don't evaluate a messaging app solely by whether its marketing materials describe it as secure or healthcare-friendly.

Start by assessing the vendor's relationship to the healthcare organization and the safeguards the system provides.

A Business Associate Agreement

Under HHS business associate guidance, a service provider that creates, receives, maintains, or transmits PHI on behalf of a covered entity may qualify as a business associate.

When the messaging provider acts in that capacity, an appropriate business associate agreement (BAA) is generally required.

The BAA should address permitted uses and disclosures, safeguards, reporting responsibilities, and other contractual obligations established under HIPAA.

There is a narrow exception for entities acting only as conduits that transmit information, such as the Postal Service, certain private couriers, and their electronic equivalents. HHS describes a conduit as a service that transports information but does not access it other than on a random or infrequent basis. A service that regularly accesses or maintains PHI to perform functions on behalf of a healthcare organization generally cannot rely on that exception simply because it also transports messages.

A BAA is necessary when the business associate rules apply, but signing one does not automatically establish that every use of the app is appropriate.

Access Controls

The system should allow only authorized people to access ePHI.

For a telehealth business, that means evaluating staff roles, account authentication, the access-granting process, and how quickly you can remove access when someone changes roles or leaves.

On mobile devices, two settings deserve a direct check: automatic logoff, which the Security Rule lists as an access control specification, and the ability to lock or wipe a lost or stolen phone remotely.

A messaging platform that allows unrestricted access across clinical and support teams may introduce unnecessary privacy risks even if its messages are encrypted.

Audit Controls

HIPAA's technical safeguards require mechanisms to record and examine activity in information systems containing ePHI.

Operators should evaluate whether they can establish who accessed information, investigate unusual activity, and review relevant system events.

The exact configuration depends on the system and the organization's risk assessment. Audit capabilities are part of a broader security program rather than a substitute for training or appropriate access policies.

Integrity

The Security Rule also requires policies and procedures that protect ePHI from being improperly altered or destroyed. For a messaging app, that means checking whether sent messages can be edited or deleted, how long conversations are retained, and whether clinically relevant messages reach the patient's record intact.

Transmission Security

The system must also protect ePHI from unauthorized access as it moves across electronic networks.

Encryption may play an important role, but operators should examine the entire transmission workflow, including integrations, notifications, connected devices, and any external services involved in delivering communications.

Under the current Security Rule, encryption is an addressable implementation specification. An organization assesses whether encryption is reasonable and appropriate for its systems and documents that decision, including any equivalent measure it uses instead.

HHS has proposed removing that flexibility. Its proposed Security Rule update, announced on December 27, 2024, would require encryption of ePHI at rest and in transit, along with multi-factor authentication, with limited exceptions. The rule has not been finalized, and the federal regulatory agenda now lists July 2027 as the target date. Choosing a messaging platform that already meets both proposed requirements avoids a second migration if the rule is finalized in that form.

These considerations extend beyond chat. Similar questions apply when choosing HIPAA-compliant email or video platforms like Zoom for telehealth.

A messaging app is appropriate only when the organization's actual use, vendor arrangement, and implemented safeguards meet applicable requirements. Product features should be verified rather than assumed from a compliance label.

When the Patient Asks for Plain Texts

Patients do not always want to install another application or log into a portal for every message. Some prefer familiar communication methods, including ordinary email or text messages.

HIPAA does not categorically prohibit electronic patient communications, but providers must apply appropriate safeguards and meet relevant Security Rule requirements.

The closest specific HHS guidance addresses email rather than establishing a universal rule for SMS texting.

In its guidance on treatment-related email, HHS explains that covered providers may communicate electronically with patients when they use reasonable safeguards.

Under 45 CFR 164.522(b), patients can request communication by alternative means or at alternative locations when the request is reasonable.

HHS also explains that when a patient initiates an email conversation, the provider may generally assume email is acceptable unless the patient indicates otherwise. If the provider believes the patient may not understand the risks of unencrypted email, it can explain those risks and let the patient decide whether to continue by email.

Those statements should not be interpreted as a blanket exception allowing a telehealth business to send PHI through any texting application without considering the channel, vendor relationship, or applicable security requirements.

For a patient requesting ordinary texts, the organization should evaluate what information would be sent, whether it can reasonably accommodate the request, and how to document the patient's communication preferences.

The patient's choice matters, but it should be a choice made with a clear understanding of the privacy risks.

FAQs

Is Regular SMS Texting HIPAA Compliant?

HIPAA does not impose a blanket ban on texting. However, messages containing PHI require appropriate privacy safeguards, and systems handling ePHI must meet applicable Security Rule requirements.

When an outside messaging provider creates, receives, maintains, or transmits PHI on behalf of a covered healthcare organization as a business associate, an appropriate BAA is generally necessary.

The message's sensitivity, communication method, and organizational controls all affect whether the arrangement is suitable.

Does HIPAA Require Encrypted Messaging?

Not in every case under the current rule. Encryption is an addressable safeguard, so an organization decides through its risk analysis whether encryption is reasonable and appropriate and documents that decision.

HHS's proposed Security Rule update would make encryption of ePHI at rest and in transit a requirement, with limited exceptions. Until a final rule is published, encryption remains the safer default for any channel that carries PHI.

Is a Portal Message the Same as a Text?

No. A portal message is accessed through the healthcare organization's designated patient system, typically after authentication.

An SMS message is delivered through a phone messaging channel and may appear in notification previews or on devices accessible to other people.

Both can involve PHI, but their access, storage, transmission, and privacy risks differ. The organization should evaluate each channel according to the information it carries and the safeguards it provides.

References

1. U.S. Department of Health and Human Services. (n.d.). Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients? https://www.hhs.gov/hipaa/for-professionals/faq/does-hipaa-permit-health-care-providers-to-use-email-to-discuss-health-issues-with-patients/index.html
2. U.S. Department of Health and Human Services. (n.d.). Business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
3. U.S. Department of Health and Human Services. (n.d.). Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html