Every Patient Text From a Verified Clinic Number

The FTC's advice on text scams is blunt. Never respond to an unexpected text, it says, and if a message might be real, contact the company "using a phone number or website you know is real." Americans reported losing $470 million to text scams in 2024, about five times the 2020 total.

Now apply that advice to a text a nurse sends from her own cell. It comes from a number the patient has never seen. It's signed with a first name. And it asks the patient to act, sometimes by changing a medication.

By the FTC's standard, the patient should ignore it.

Staff who text from personal phones usually have good reasons. A phone queue sits 20 minutes deep, and a portal message won't get read until Thursday. A patient needs an answer today, and a text gets one in seconds.

We see this pattern in practices of every size, and it almost always starts with someone trying to help.

Our view: every text a patient receives should come from the clinic's own known number. It should sit on a system the whole care team can see and the practice can audit.

That's what secure patient texting without personal phones in athenahealth practices looks like from the patient's side of the screen. Most compliance talk about texting centers on the practice and its liability. This piece stays with the person holding the phone.

The example running through this piece is ordinary on purpose. A cardiology patient needs to hold a blood thinner before a procedure, and a nurse named Kate texts the instruction from her own cell. Her intent is good, and the patient still inherits a string of avoidable risks.

The Mystery Number

Nobody writes a policy that says "text patients from your cell." It happens in small steps. A patient can't get through on the main line, so a nurse gives out her number "just this once." The patient texts back a photo of a swollen ankle, and the nurse replies within a minute.

A few weeks later, that nurse has dozens of patients saved in her personal contacts.

The reasons are practical. Calls back up during lunch. Portal messages in athenaOne ask the patient to log in, and plenty of patients can't remember their password.

A text reaches them in seconds, and they answer in seconds. So the shortcut works, at least from the staff member's chair. Costs show up later, and almost all of them land on the patient.

What the Patient Actually Receives

Take a cardiology patient three days before a procedure. This text arrives from a 10-digit number with a local area code:

"Stop the blood thinner Wednesday. Kate from cardiology."

The patient has three things to go on: a first name, a department, and a number they don't recognize. There's no last name and no practice name. That number doesn't match the one on their appointment card or their reminder texts.

Most patients save it anyway, often under something like "clinic??" Meanwhile, the message names a drug class and a procedure date for a specific person. That's protected health information, sitting in a consumer messaging app on two personal phones.

The 9 PM Question With No One on the Other End

Tuesday night, the patient remembers the daily aspirin they also take. They aren't sure if it should stop too.

So they text Kate's number at 9 PM. Kate is off shift with her phone on Do Not Disturb. She might see the message at 6:40 the next morning, or it might get buried under family texts. Nobody else on the care team knows the question exists.

That leaves the patient two options. They can guess, or they can call the main line in the morning and try to explain a conversation the front desk can't see. For a pre-procedure medication question, a wrong guess can mean a cancelled case or a bleeding risk. Either way, the answer now takes longer than a phone call would have.

Two Bad Lessons Patients Learn

Personal-cell texting teaches patients one of two habits.

Some patients learn caution. They've heard the warnings, so they ignore an unknown number text from clinic staff and miss a real instruction.

In its 2024 data, the FTC lists "wrong number" texts among the top five text scams. A friendly note signed with a first name, from a number you don't know, fits that shape closely.

Other patients learn trust. After a few helpful texts from staff cells, they start answering any number that claims to be their doctor's office.

That's the exact habit a scammer wants. When a fake "billing" text shows up asking for a card number, this patient is primed to reply.

Both outcomes are harm. One costs the patient a clinical instruction, and the other exposes them to fraud.

The Compliance Backbone

A patient privacy texting network needs three parts: a number the patient recognizes, an inbox the whole team can open, and a record that outlives any one employee.

Curogram supplies all three for athenahealth practices, and it keeps the part staff liked about their personal phones, which was speed.

One Number the Patient Already Knows

With Curogram, each location texts from its own verified clinic number. It's the number patients already see on their appointment reminders.

When a text arrives from it, the patient can check the sender against a number they know is real, which is the FTC's own test.

A recognized sender changes how the patient treats the message. They read it, save the contact correctly, and reply without wondering if "Kate" is a scammer.

It also gives them a clean rule for everything else. Texts about their care come from one number, so a text claiming to be the clinic from any other number deserves suspicion.

That rule is the reason patients trust official clinic numbers.

Any Team Member Can Pick Up the Thread

Replies to the clinic number land in a shared location inbox. Any authorized staff member can read the history and answer.

That might be the nurse on shift, the front desk lead, or the care coordinator covering Kate's patients during her vacation.

A shared inbox removes the single point of failure. The 9 PM aspirin question waits in the inbox overnight. At 8 AM, the first nurse who logs in sees it with the whole thread above it, including Monday's hold instruction.

Nobody has to call Kate at home to ask what she told the patient. The answer is already on the screen.

Vacations show the difference best. When Kate takes a week off, her patients don't need a new number or a heads-up text.

Her coverage nurse works from the same inbox, and patients may never notice the handoff. With personal cells, a week off usually means either Kate answers from the beach or her patients wait.

The Record Sees What the Phone Used to Hide

Curogram works with athenahealth, so conversations tie to the patient record. When a nurse opens a thread, the patient's name and upcoming appointment are right there. When someone reviews the case later, they can find what the patient asked and who answered.

Care teams need that trail. A physician looking into a post-procedure bleed will want to know what the patient was told about blood thinners and when.

On a personal cell, that answer depends on one person's memory and one person's phone. On the clinic thread, it's written down with a timestamp.

Personal-cell texting produces a weaker record at best. Someone types a chart note hours later, from memory, like "pt texted, advised hold." It leaves out the exact wording the patient saw, and the patient's reply may never make it in.

Sensitive Details Travel by Secure Link

Plain SMS has limits. Standard text messages aren't encrypted, so Curogram keeps plain SMS for general notices: appointment times, "your forms are ready," or a balance due. Anything clinical goes through encrypted secure messaging.

For Kate's instruction, the patient would get a text like this from the clinic number:

"You have a secure message from Riverside Cardiology. Tap the link to verify your identity and view it."

The medication detail sits behind the link. The patient still gets it within seconds of Kate hitting send. Their regular text history shows only that a secure message arrived.

Curogram Highlight: Verified Location Numbers

Verified Location Numbers give each of your locations one clinic number for every patient text. Reminders, confirmations, questions, clinical follow-ups, and recall messages all come from it. Patients learn one sender per location, and your staff stop handing out their own.

A few details make it work day to day:

• Replies from patients land in a shared location inbox that any authorized team member can open.
• Threads tie to the patient record through Curogram's athenahealth integration, so the history is searchable by patient.
• Clinical details go out as encrypted secure messages behind a verify-your-identity link.
• Opt-out requests are logged on the number, so a patient who texts STOP stays opted out across the team.
• Threads belong to the location, so staff turnover doesn't break a patient's conversation.

For a multi-location network, this solves a specific mess. A patient who sees a cardiologist at one site and a lab at another gets texts from two known numbers, each tied to a real place.

Speed is what sells it to staff. A nurse can answer from the shared inbox as fast as she answered from her own phone, and she can hand the thread off when her shift ends. Patients get the same quick reply they were used to, from a number they can check.

Conclusion: Protect the Helpers and the Helped

Staff started texting from their own phones because patients needed speed and the official channels were slow. That instinct deserves credit. The fix is to give both sides a channel that delivers the same speed without the risk.

athenaOne holds your protected record. Curogram holds the patient's protected conversation, on a number they know, in a thread your whole team can read. Those two jobs sit side by side, and patients need both done well.

Start with a blameless question for every team: how often do patients get texts from personal phones today?

The honest answer is usually "more than we thought." Treat that number as a baseline to measure against, and keep discipline out of it.

Then make the safe way the easy way. If the clinic number is slower than a nurse's cell, staff will keep using the cell. Secure patient texting without personal phones in athenahealth practices only sticks when the shared inbox is just as quick to answer from.

Request a demo with Curogram and see how fast the governed channel really is.

Frequently Asked Questions