Jo Galvez
Curogram supplies that channel. It's SOC 2 Type II certified, covered by a signed BAA, and scoped by location and department, and every thread syncs to the eCW chart.
In 2025, 710 healthcare data breaches reached the HHS Office for Civil Rights. Unauthorized access and disclosure incidents rose 17.4% over the prior year. Memos don't move that number. A faster sanctioned channel does, because staff stop reaching for the workaround.
Ask your compliance officer how many patient texts left the network last month. Most can't answer. The gap isn't sloppiness — it's structural.
A nurse at your Northside clinic texts a patient "take the second one with food" from her own cell. The approved path takes four steps, and the patient is standing in a pharmacy aisle.
She helped. She also put protected health information on a device your IT team has never seen. That device backs up to a personal iCloud account, and it walks out the door the day she resigns.
We'll make one claim and spend the rest of this article proving it: governance holds only when the compliant channel is also the fastest channel.
Write the strictest eCW patient texting compliance policy you like. Staff will still pick whatever gets the patient answered before the phone rings again.
Enforcement won't close that gap. Removing the four-step delay will.
For a single-site practice, texts from a nurse's personal phone stay a manageable annoyance. Across twelve locations and four hundred staff, they become a number nobody can produce — and an OCR inquiry asks for exactly that number. eCW secures the chart very well. It was never built to govern the thousand small conversations that happen around the chart.
So what does the ungoverned channel cost a 12-site group? What does a governed one need to clear a security review? And how does the chart stay complete either way?
The Villain: Shadow Texting
It's Already Happening at Every Site
Patient texting isn't a decision your network gets to make. It's a behavior already running at every location. The only open question is whether it runs on managed infrastructure or on staff-owned phones.
Shadow texting is shadow IT with PHI attached — a healthcare communication risk living on hardware nobody provisioned, patched, or can wipe. Ask a site manager how her team handles a late lab result at 4:45 pm. You'll hear about a personal phone within two sentences.
The Auditor's Question You Can't Answer
Breach notification rules give a covered entity 60 days from discovery to report (45 CFR §164.404). That clock assumes you know what happened.
When a complaint, subpoena, or OCR inquiry asks for every communication with one patient over one quarter, a network running on personal phones can't produce it.
Worse, it can't prove what it can't produce. Email accounts alone accounted for 24.9% of 2025 healthcare breach locations, according to OCR breach portal data — and email is a channel IT at least controls.
Why the Policy Loses
|
The approved path |
What staff actually do |
|---|---|
|
Log into portal, compose, wait for patient login |
Text from the phone in their pocket |
|
Patient reads it in 2 days, or never |
Patient replies in 4 minutes |
|
Message sits in a portal queue |
Message never reaches the chart |
Compliance writes the policy. Physics writes the behavior. Every quarter you leave that gap open, the volume of undocumented patient communication grows, and none of it is retrievable.
The Guide: The Compliance Backbone
One Channel That Wins on Speed
Curogram works as the compliance backbone for eCW networks — a single sanctioned channel staff adopt because it's faster than the alternative they invented. Templated replies, routed queues, and chart context beat thumbing a message into a personal phone. Adoption stops being a training problem.
Curogram Highlight: Role-Based Access & Audit Trails
Role-Based Access & Audit Trails is the part your security reviewer cares about. Every user is scoped to their own locations and departments. Role-based access for clinic messaging means a Northside scheduler sees Northside scheduling threads, and nothing from behavioral health at Westgate. Each message, view, and permission change gets logged.
That gives you one audit trail for patient texts across a multi-location group, exportable in minutes. It maps directly onto the Security Rule's Access Control and Audit Controls standards (45 CFR §164.312(a)(1) and §164.312(b)) and the minimum necessary requirement at §164.502(b). Deeper detail lives in our guide to role-based access for patient messaging.
Conversations sync to the eCW chart, so the compliant record is also the clinically complete one.
Clearing the Security Review
SOC 2 Type II certification and a signed BAA are the first gate for an enterprise texting vendor, not the last. Bring the questionnaire — a SOC 2 patient messaging platform should hand over documentation during evaluation, not after signature.
Central policy templates then enforce consent language and opt-out handling identically at all twelve sites, instead of twelve local interpretations.
The Success: Compliant Because Convenient
The Number You Can Finally State
100% of patient text communication on governed, auditable infrastructure. That's a sentence a compliance officer can say in a board meeting without a caveat attached to it.
What Changes in the Building
The workaround dies because the sanctioned tool is better, not because someone got a warning. Staff keep the speed they invented shadow texting to get.
Coverage improves too, since a thread belongs to the location rather than to whoever started it — the same principle behind running one shared inbox across every site.
The Next Audit Request
An access review becomes an export. Legal asks for a patient's full communication history, and a supervisor pulls it before the meeting ends. No archaeology, no interviewing four former employees about which phone they used.
Conclusion: Govern the Channel Staff Already Want
You can't ban convenient communication. You can make the compliant version the most convenient thing in the building, and let adoption do the enforcement.
eCW protects your clinical record. Curogram protects their everyday conversations, held to the same standard, and puts the transcript back on the chart where it belongs.
Ask your compliance officer one question this week: could we produce every patient communication from last quarter? Act on the pause before you act on the answer.
Book a demo and bring your security questionnaire. SOC 2 Type II documentation and BAA terms are ready for review, and we'll walk your rollout plan for multi-site change management in the same call.
Frequently Asked Questions