The FTC's advice on text scams is blunt. Never respond to an unexpected text, it says, and if a message might be real, contact the company "using a phone number or website you know is real." Americans reported losing $470 million to text scams in 2024, about five times the 2020 total.
Now apply that advice to a text a nurse sends from her own cell. It comes from a number the patient has never seen. It's signed with a first name. And it asks the patient to act, sometimes by changing a medication.
By the FTC's standard, the patient should ignore it.
Staff who text from personal phones usually have good reasons. A phone queue sits 20 minutes deep, and a portal message won't get read until Thursday. A patient needs an answer today, and a text gets one in seconds.
We see this pattern in practices of every size, and it almost always starts with someone trying to help.
Our view: every text a patient receives should come from the clinic's own known number. It should sit on a system the whole care team can see and the practice can audit.
That's what secure patient texting without personal phones in athenahealth practices looks like from the patient's side of the screen. Most compliance talk about texting centers on the practice and its liability. This piece stays with the person holding the phone.
The example running through this piece is ordinary on purpose. A cardiology patient needs to hold a blood thinner before a procedure, and a nurse named Kate texts the instruction from her own cell. Her intent is good, and the patient still inherits a string of avoidable risks.
Nobody writes a policy that says "text patients from your cell." It happens in small steps. A patient can't get through on the main line, so a nurse gives out her number "just this once." The patient texts back a photo of a swollen ankle, and the nurse replies within a minute.
A few weeks later, that nurse has dozens of patients saved in her personal contacts.
The reasons are practical. Calls back up during lunch. Portal messages in athenaOne ask the patient to log in, and plenty of patients can't remember their password.
A text reaches them in seconds, and they answer in seconds. So the shortcut works, at least from the staff member's chair. Costs show up later, and almost all of them land on the patient.
Take a cardiology patient three days before a procedure. This text arrives from a 10-digit number with a local area code:
"Stop the blood thinner Wednesday. Kate from cardiology."
The patient has three things to go on: a first name, a department, and a number they don't recognize. There's no last name and no practice name. That number doesn't match the one on their appointment card or their reminder texts.
Most patients save it anyway, often under something like "clinic??" Meanwhile, the message names a drug class and a procedure date for a specific person. That's protected health information, sitting in a consumer messaging app on two personal phones.
Tuesday night, the patient remembers the daily aspirin they also take. They aren't sure if it should stop too.
So they text Kate's number at 9 PM. Kate is off shift with her phone on Do Not Disturb. She might see the message at 6:40 the next morning, or it might get buried under family texts. Nobody else on the care team knows the question exists.
That leaves the patient two options. They can guess, or they can call the main line in the morning and try to explain a conversation the front desk can't see. For a pre-procedure medication question, a wrong guess can mean a cancelled case or a bleeding risk. Either way, the answer now takes longer than a phone call would have.
Personal-cell texting teaches patients one of two habits.
Some patients learn caution. They've heard the warnings, so they ignore an unknown number text from clinic staff and miss a real instruction.
In its 2024 data, the FTC lists "wrong number" texts among the top five text scams. A friendly note signed with a first name, from a number you don't know, fits that shape closely.
Other patients learn trust. After a few helpful texts from staff cells, they start answering any number that claims to be their doctor's office.
That's the exact habit a scammer wants. When a fake "billing" text shows up asking for a card number, this patient is primed to reply.
Both outcomes are harm. One costs the patient a clinical instruction, and the other exposes them to fraud.
A patient privacy texting network needs three parts: a number the patient recognizes, an inbox the whole team can open, and a record that outlives any one employee.
Curogram supplies all three for athenahealth practices, and it keeps the part staff liked about their personal phones, which was speed.
With Curogram, each location texts from its own verified clinic number. It's the number patients already see on their appointment reminders.
When a text arrives from it, the patient can check the sender against a number they know is real, which is the FTC's own test.
A recognized sender changes how the patient treats the message. They read it, save the contact correctly, and reply without wondering if "Kate" is a scammer.
It also gives them a clean rule for everything else. Texts about their care come from one number, so a text claiming to be the clinic from any other number deserves suspicion.
That rule is the reason patients trust official clinic numbers.
Replies to the clinic number land in a shared location inbox. Any authorized staff member can read the history and answer.
That might be the nurse on shift, the front desk lead, or the care coordinator covering Kate's patients during her vacation.
A shared inbox removes the single point of failure. The 9 PM aspirin question waits in the inbox overnight. At 8 AM, the first nurse who logs in sees it with the whole thread above it, including Monday's hold instruction.
Nobody has to call Kate at home to ask what she told the patient. The answer is already on the screen.
Vacations show the difference best. When Kate takes a week off, her patients don't need a new number or a heads-up text.
Her coverage nurse works from the same inbox, and patients may never notice the handoff. With personal cells, a week off usually means either Kate answers from the beach or her patients wait.
Curogram works with athenahealth, so conversations tie to the patient record. When a nurse opens a thread, the patient's name and upcoming appointment are right there. When someone reviews the case later, they can find what the patient asked and who answered.
Care teams need that trail. A physician looking into a post-procedure bleed will want to know what the patient was told about blood thinners and when.
On a personal cell, that answer depends on one person's memory and one person's phone. On the clinic thread, it's written down with a timestamp.
Personal-cell texting produces a weaker record at best. Someone types a chart note hours later, from memory, like "pt texted, advised hold." It leaves out the exact wording the patient saw, and the patient's reply may never make it in.
Plain SMS has limits. Standard text messages aren't encrypted, so Curogram keeps plain SMS for general notices: appointment times, "your forms are ready," or a balance due. Anything clinical goes through encrypted secure messaging.
For Kate's instruction, the patient would get a text like this from the clinic number:
"You have a secure message from Riverside Cardiology. Tap the link to verify your identity and view it."
The medication detail sits behind the link. The patient still gets it within seconds of Kate hitting send. Their regular text history shows only that a secure message arrived.
Run the cardiology case again, this time on the clinic thread. The practice name, times, and staff names below are illustrative. The steps match how a governed channel handles a pre-procedure medication hold.
|
Time |
What happens |
Who can see it |
|
Mon 2:10 PM |
Kate sends a secure message from the clinic number: hold the blood thinner Wednesday, plus the on-call line |
Patient and the whole care team |
|
Mon 2:14 PM |
Patient opens the link; the number is already saved as "Riverside Cardiology" |
Patient and care team |
|
Tue 9:05 PM |
Patient texts the aspirin question to the same number |
Location inbox, queued overnight |
|
Wed 7:55 AM |
Coverage nurse Luis opens the thread and sees Monday's instruction |
Care team |
|
Wed 8:20 AM |
Luis confirms with the physician and replies from the clinic number |
Patient, care team, patient record |
|
Thu 6:00 AM |
Procedure-day reminder arrives from the same number |
Patient and care team |
Verified Location Numbers give each of your locations one clinic number for every patient text. Reminders, confirmations, questions, clinical follow-ups, and recall messages all come from it. Patients learn one sender per location, and your staff stop handing out their own.
A few details make it work day to day:
For a multi-location network, this solves a specific mess. A patient who sees a cardiologist at one site and a lab at another gets texts from two known numbers, each tied to a real place.
Speed is what sells it to staff. A nurse can answer from the shared inbox as fast as she answered from her own phone, and she can hand the thread off when her shift ends. Patients get the same quick reply they were used to, from a number they can check.
Staff started texting from their own phones because patients needed speed and the official channels were slow. That instinct deserves credit. The fix is to give both sides a channel that delivers the same speed without the risk.
athenaOne holds your protected record. Curogram holds the patient's protected conversation, on a number they know, in a thread your whole team can read. Those two jobs sit side by side, and patients need both done well.
Start with a blameless question for every team: how often do patients get texts from personal phones today?
The honest answer is usually "more than we thought." Treat that number as a baseline to measure against, and keep discipline out of it.
Then make the safe way the easy way. If the clinic number is slower than a nurse's cell, staff will keep using the cell. Secure patient texting without personal phones in athenahealth practices only sticks when the shared inbox is just as quick to answer from.
Request a demo with Curogram and see how fast the governed channel really is.