5 Critical Rules to Remember When Texting Patients

One text can save a missed appointment. One careless text can cost you $73,011.

That's the current maximum HIPAA fine for a single violation, and it isn't the only risk your practice faces. Under the Telephone Consumer Protection Act, each unwanted text can cost $500, or up to $1,500 if a court decides the violation was willful. Multiply that by a few hundred patients, and a small slip becomes a serious problem.

None of this means you should stop texting. A Kentico survey found that almost 70% of respondents value receiving texts from their healthcare providers. Text messages are quick, personal, and usually read within minutes. That leads to fewer no-shows, faster replies, and less pressure on your front desk phones.

The trouble usually starts with how texting gets introduced. A receptionist begins sending reminders from a work phone, while a medical assistant sends lab updates from a personal cell. Nobody records which patients agreed to receive texts, what was sent, or who can still read those messages.

It works fine. Until it doesn't.

Many practices run without a written texting policy, which leaves staff guessing about what is allowed. That uncertainty creates inconsistent messages for patients and legal exposure for your organization. A single text sent to the wrong number, or one that shares too many details, can expose protected health information (PHI).

Safe texting doesn't require a complex compliance program. It depends on a handful of clear rules that every team member understands and follows. Once those rules are in place, texting patients becomes one of the simplest ways to improve communication and save staff time.

The five rules below belong in every texting policy. Each one protects your patients, your team, and your bottom line, and together they form a framework you can start using this week.

1. Get Clear Consent Before You Send a Single Text

Before you text a patient, confirm that they've agreed to receive messages from your practice. The Telephone Consumer Protection Act (TCPA) governs this area, and violations can lead to expensive lawsuits and regulatory fines.

The type of consent you need depends on the purpose of the message.

Here's a simple breakdown:

For your team, the safest habit is to collect written consent from every patient, regardless of the type of text you plan to send. Add a texting consent statement to your intake paperwork, and store each approval in the patient's record so you can easily prove it later.

Written documentation protects your practice if a patient ever claims they never agreed. A casual "sure, text me" at the front desk is difficult to verify months later, while a signed or digital consent form is not.

2. Make It Easy for Patients to Opt Out

Patients who once welcomed your texts may eventually change their minds. When that happens, federal rules require you to honor their decision promptly.

Since April 2025, FCC regulations allow patients to revoke consent through any reasonable method. That includes replying "STOP," "Quit," or "Unsubscribe," or simply telling a staff member in person. Your practice can't require patients to use one specific method, and you have no more than 10 business days to stop texting after a patient opts out.

Here's how to build opt-outs into your daily workflow:

1. Add a short instruction to your messages, such as "Reply STOP to unsubscribe."
2. Configure your system to process opt-out keywords automatically.
3. Train staff to record verbal or email opt-out requests immediately.
4. Send one brief confirmation text, if you choose, without any promotional content.
5. Review opt-out records regularly to make sure no request slips through.

In practice, an easy opt-out process keeps patients from feeling overwhelmed by unwanted messages. It also protects your practice from TCPA claims, which can accumulate quickly at $500 or more per message.

3. Follow HIPAA Rules for Every Patient Message

HIPAA doesn't ban texting. It sets rules for how you protect PHI when you send it. The HIPAA Privacy and Security Rules cover all electronic protected health information (ePHI), including texts, emails, and social media messages.

A message like;

"Hi Maria, see you Tuesday at 2:00 PM" carries little risk

. A message that names a diagnosis, test result, or medication is a different story. The more health details a text includes, the more protection it needs.

The safest approach is to share only the minimum information needed for the task. HHS calls the process of removing all 18 personal identifiers from health data "de-identification." You won't de-identify every patient text, but knowing these identifiers helps your team spot when a message shares too much. When a text must include PHI, send it through a secure, HIPAA compliant texting platform instead of a standard phone.

Getting this wrong is expensive. As of January 2026, HIPAA civil penalties look like this:

This means even an honest mistake can cost you money. And penalties climb quickly when a problem is ignored or left unfixed.

Quick Tip: Run a 10-Text Spot Check Each Month

Once a month, pull 10 random patient texts sent by your team and review each one against three questions. Did the patient give documented consent? Did the message include an opt-out option? Did it share only the information necessary for its purpose?

If even one text fails, you've uncovered a gap in training or workflow before it turns into a penalty. The review takes about 15 minutes and gives you a reliable monthly snapshot of how well your texting policy performs in everyday practice.

4. Track Every Message With Audit and Reporting Controls

HIPAA requires practices that text PHI to maintain audit controls. These are systems that record and review activity involving patient data. They help you spot risks early and show regulators that you take privacy seriously.

Strong audit controls should let you see:

• Who sent or opened each message
• When each message was sent, read, or modified
• Which patient records were accessed
• Any unusual activity, such as logins at odd hours

These controls apply to any secure text messaging platform that sends or stores PHI, whether on mobile devices or desktop computers. Standard phone texting can't give you this view. Once a message leaves an employee's personal phone, your practice has no record of it and no way to review it.

5.  Establish Policies and Procedures to Manage Authorized Access

HIPAA requires that healthcare organizations, medical practices, and their business associates safely manage who is authorized or has the right to change, distribute, or access sensitive health data. Providers should limit access to PHI to only the information necessary to perform a task.

It is up to the healthcare providers and other medical practices to determine what kind of software, systems, and access controls they use to manage authorized access to PHI related to text messaging software. However, the HIPAA Security Rule requires the following protections to ensure HIPAA compliance:

Unique User ID

An individual must access protected health information with a unique user identification number or username that is easy to track. That allows covered entities to hold authorized users accountable for their activity while logged into a system containing PHI. Secure text messaging programs require authorized users to use a unique ID to send, receive, and access any HIPAA-compliant text message.

Emergency Access Procedures

Covered entities must have operational workflows to access protected health information in an emergency. These should consider what type of emergencies may require urgent access and who should be granted rights to access PHI in emergencies.

How the Right Texting Platform Brings These Rules Together

Five rules might sound like a lot to manage, but they all point toward the same goal: texting patients in a way that's fast, convenient, and secure. When your policy is clear and your technology supports it, your staff can text with confidence instead of worrying about every message they send.

Start by writing a texting policy that your entire team understands. Spell out how you collect consent, handle opt-outs, limit PHI, review activity, and manage access. Share a patient-friendly version so patients know what to expect. A clear policy cuts down on confusion and makes training new staff much easier.

Next, choose a texting platform built for healthcare. Personal phones and standard messaging apps can't give you audit trails, unique user IDs, or automatic opt-out handling. A HIPAA compliant texting platform handles much of that work in the background, so compliance becomes part of the daily routine, not an extra task.

That's where Curogram fits in. Curogram is an easy-to-use, HIPAA-compliant platform that offers secure two-way texting, automated appointment reminders, and electronic patient forms. Your team can follow up with patients, schedule future visits, and send secure photo links without sharing private details over unsafe channels.

Curogram also keeps your staff's personal phone numbers private, since every message comes from your practice. Patients no longer have to dig through emails or voicemails to find what they need. With a 98% SMS open rate, your messages reach patients where they already are. Practices using Curogram have also cut phone call volume by 50%.

The result is simple. Patients get the quick, convenient updates they want, your team gets safer workflows, and your practice gets real peace of mind.

Ready to make patient texting safer and simpler? See how Curogram's secure two-way texting works and book a demo with our team.

Frequently Asked Questions