Your practice already runs a patient texting program. Nobody approved it, nobody trained anyone on it, and nobody can pull a single report from it.
It lives on your staff's personal phones.
In a DrChrono group, that feels normal. Providers chart on iPads, and medical assistants move between exam rooms with a phone in their pocket. The whole practice was built to be mobile, so when a patient needs a quick answer, a text from a personal phone is the obvious move.
It sounds harmless. It isn't.
Each message can contain protected health information. Once it leaves the building on an unmanaged device, the practice loses control of it. You can't monitor it, search it, or export it, and if a patient files a complaint or a regulator requests records, you can't produce records you never kept.
Here's the uncomfortable part.
Most owners already suspect this. They've sent the memo and repeated the policy at staff meetings, but a written rule rarely beats a daily habit, especially when the habit is faster.
That's why HIPAA-compliant texting governance for DrChrono group practices can't just be another rule. It has to be a better tool. If the approved channel is slower than a personal phone, your team will keep using the phone, but if it's faster and equally mobile, the problem starts to fix itself.
Here's how that works.
You'll learn why "Shadow Texting" spreads so easily in mobile-first practices and why the liability lands on the owner instead of a compliance team. You'll also see what a governed channel looks like day to day, how it connects with DrChrono, and what changes when every patient conversation lives in one place.
The goal isn't to take phones from your team. It's to make sure the app they open is the right one.
Patient texting is already happening at every one of your locations. The only real question is whether you can see it.
In a practice that charts on iPads, a personal phone doesn't look like a workaround. It looks like part of the job, since staff already use their own devices for schedules, team chats, and quick lookups all day.
So when a medical assistant texts a patient from that same phone, nothing feels off.
That's the BYOD patient texting risk in a nutshell: the behavior blends in so well that nobody sees it as a problem.
Think about a normal Tuesday.
An MA sends a patient a prep reminder between rooms because it's truly the fastest way.
The patient shows up ready, and the visit stays on schedule.
That message helped. It also placed PHI on a device the practice doesn't manage, can't wipe, and can't audit.
Now multiply it. In this illustrative example, a group with three locations and six texting staff members per site sends one patient text per person each workday.
That adds up to 18 messages a day and roughly 400 a month, none of them logged and all of them stored on phones that go home with their owners every night.
This is the personal phone PHI mobile practice owners rarely notice until something goes wrong.
Sooner or later, someone will ask for every message your practice sent to one patient. It might come from a patient complaint, a legal subpoena, or an inquiry from the HHS Office for Civil Rights.
A large health system has a compliance team to handle that. A lean DrChrono group usually doesn't, so the request lands directly on the owner's desk, and the owner has to explain that the records are scattered across a dozen personal phones.
That's the owner liability HIPAA communication gaps create. The staff member had good intentions, but the practice, and often the owner personally, carries the exposure.
You can announce a new policy at a staff meeting. But culture decides what people actually do on a busy afternoon.
Staff will always pick the channel that matches how they already work. Right now, that channel has no rules, no records, and no oversight, and until the approved option is easier, the unapproved one will keep winning.
Curogram doesn't ask your team to slow down or stay behind a desk. Instead, it gives them one approved channel that beats the personal phone on speed and matches it on mobility.
That's what makes it a compliance backbone rather than another rule. When the sanctioned tool is truly the better tool, people switch on their own, and you don't have to police them.
Here's what that looks like in daily practice:
The BAA point matters more than most owners think. Ask for the BAA. Texting vendor promises mean very little if the company won't sign one, because without it, your practice carries the risk alone.
Curogram conversations sync to the patient's DrChrono chart. As a result, the compliant record also becomes the clinically complete record.
Your providers see the full picture without switching apps or asking staff what was discussed. Nothing gets lost between a text thread and the patient's documentation.
Your practice runs on mobility, and Curogram keeps it that way. The governed inbox runs on the same phones and tablets your staff already carry from room to room and site to site.
For your team, governance arrives as an upgrade to their mobile workflow rather than a retreat from it. They keep the speed they rely on, and you gain the visibility you've been missing.
The biggest shift is simple. You can finally say, out loud and with documentation, that 100% of patient text communication runs on governed, auditable infrastructure.
For many owners, that sentence has been out of reach for years.
Here's how daily operations change once the workaround disappears:
| Area | With Shadow Texting | With Curogram |
|---|---|---|
| Where texts live | Scattered across personal phones | One governed, logged inbox |
| Who can see them | Only the sender | Role-based access by location and duty |
| Audit or records request | Weeks of digging, with gaps | Export in minutes |
| DrChrono chart | Missing the conversation | Synced to the patient record |
| Staff mobility | Mobile but ungoverned | Just as mobile, fully governed |
| Owner exposure | Hidden until a complaint | Visible, documented, and managed |
The comparison tells a clear story. Almost nothing about how your team works has to change, except where the messages are stored and who can see them.
Most compliance programs pit the rules against the way people like to work. That's a battle the rules usually lose, no matter how many reminders go out.
With a better tool, the fight goes away. The workaround fades because the approved channel beats it at its own game, offering templated replies, routed queues, and chart context that a personal phone simply can't provide.
Governance isn't the only benefit. Across Curogram case studies, practices have reduced phone call volume by 50% and increased front desk productivity by 30% or more.
For your team, that means fewer callbacks and more time for patients in the room. For you, it means compliance that also makes the day run smoother.
When the next records request arrives, you won't need to dig through personal phones. You'll simply run an export.
Your staff keeps the mobility they were never going to give up. You keep a full record you can stand behind.
You can't turn a mobile-first team into a desk-bound one, and you shouldn't try. The way your practice moves is part of what makes it work.
What you can do is make the compliant channel the most mobile one.
That's the real lesson behind Shadow Texting. Your staff aren't ignoring policy to create problems; they're picking the fastest tool they have. Give them a faster option that's also governed, and the risky behavior fades on its own.
Think of it this way.
DrChrono secures your clinical records, while Curogram secures the everyday conversations your team has with patients. Both meet the same standard and run on the devices your staff already carry.
The pieces work together. Every message is logged, every user has the right access, and every conversation syncs to the chart, so when someone requests proof, you can deliver it in minutes.
Now ask yourself one question: "Could we produce every patient communication from last quarter?"
If you paused before answering, pay attention to that pause. It tells you something your policy binder can't, because the gap between what your policy says and what your team actually does is exactly where the risk lives.
Closing that gap doesn't require a new compliance department or a long IT project. It requires one channel your team chooses because it's genuinely better, not because a memo told them to use it.
Curogram makes that switch simple. Our SOC 2 Type II documentation and BAA terms are ready for your review, and you don't need a security team to evaluate them.
We'll show you how the platform connects with DrChrono, how access is assigned by location, and how quickly an audit export runs.
Schedule a Demo to see governed texting in action and discover how quickly your group can close the gap.