Most pediatric therapy groups already have a texting policy. It lives in the employee handbook, it tells staff not to text families from personal phones, and very few people follow it.
The cause is plain. A speech therapist running 12 minutes behind needs to reach a parent who is waiting in the car. Her phone is in her pocket and the mom’s number is already saved.
The clinic’s official options are slower. A portal message might not be read until tonight. A call to the front desk rings while they check in three other kids. So she texts from her cell, and it works.
Now repeat that at every site. A group with five clinics and 40 therapists can build up thousands of child-related threads on phones it doesn’t own, can’t search, and can’t wipe.
Those threads hold a child’s first name, a parent’s cell, session times, and often a clue about why the child is in therapy. None of it shows up in Fusion. When a therapist leaves and trades in her phone, that history leaves too.
HIPAA-compliant texting governance for Ensora Fusion group practices works only when the approved channel beats the personal phone on speed. Staff use whatever gets the parent the message fastest. If the group’s own tool is quicker, the habit moves on its own, and every message lands in a log you control.
That channel needs a few parts to hold up. It needs a clinic number parents recognize and a shared thread the front desk can answer. It needs access scoped by clinic and role, a full audit trail, and message content built for talking about minors.
Pediatric therapy runs on parent logistics. A parent drives the child in, waits in the lobby or the car, and often has a sibling in tow. Plans change by the hour.
Look at a normal Tuesday at one clinic. An OT moves a co-treat from 3:00 to 3:30, and a PT needs a family to bring the child’s AFOs.
Over at the next mat, the speech therapist wants to send home this week’s practice words. Then a mom texts that her son has a fever and won’t make it.
Each of those messages is small. Each one also has to arrive within minutes to be useful.
Calling isn’t a real option mid-session. A therapist on the floor with a three-year-old can’t step out to dial. So the message goes by text, every time, and the only open question is which device sends it.
A text from a personal phone lands in that therapist’s iMessage or Android inbox. From there it often backs up to her own iCloud or Google account. Your group has no BAA with either of those accounts.
The HIPAA Security Rule asks covered entities to track activity in systems holding electronic PHI. That’s the audit controls standard at 45 CFR 164.312(b). It also asks for rules on devices that carry PHI in and out of your control, under 164.310(d). A personal phone sits outside both.
Three things follow:
That last one is the most common. Therapy staff turn over, and each departure walks out with months of family texts.
The volume is what turns a small habit into a real exposure. The numbers below are illustrative, for a mid-sized group.
|
Illustrative five-clinic group |
Count |
|
Therapists who text families |
40 |
|
Family texts per therapist, per week |
10 |
|
Ungoverned texts per week |
400 |
|
Ungoverned texts per quarter (13 weeks) |
5,200 |
Most days, nobody sees shadow texting. It surfaces when someone asks for a full record.
Custody disputes are the case pediatric groups meet most. Under HIPAA, a parent usually acts as the child’s personal representative, though state law and court orders can change that, per 45 CFR 164.502(g).
Say one parent’s access to schedule details is limited by a court order. If a therapist texted that parent the new session time from her cell, you may not learn about it until an attorney does.
An OCR complaint plays out in a similar way. The complaint names a disclosure, and you’re asked to show your policies and what actually happened. If the evidence sits on five personal phones, two of them belonging to former staff, you can’t answer with confidence.
Owners usually respond with a policy update. It gets read at a staff meeting, people sign the form, and on Monday the same therapist texts the same mom from the same phone.
The approved option still takes longer, and the parent is still waiting in the car.
Policing it across five clinics is close to impossible. You can’t see inside personal phones, and asking staff to hand them over for review would cost you good therapists. A clinic director in one building has no view into what happens at the other four.
Some groups try a middle step, like a shared clinic cell kept in a desk drawer. It helps a little, since the number belongs to the group.
But anyone who picks it up can read every thread, nobody logs in, and the log can’t show which staff member sent what. When the battery dies on a busy Thursday, therapists go back to their own phones by lunch.
The text comes from the clinic’s number, so parents save one contact for the whole team. A mom whose child sees an OT and an SLP at the same site stops juggling two cell numbers.
Replies go to a shared thread. If the therapist is mid-session when the parent writes back “Can we do 4:15 instead?”, the front desk can see the reply and answer it. The therapist doesn’t have to check her phone between kids.
Speed for the whole clinic comes from that handoff. Whoever is free picks up the reply, so the parent hears back in minutes even when the therapist is busy for the next hour.
Scope is the second part. Each user sees the threads that fit their clinic and their job.
A therapist at the Eastside clinic sees Eastside families. Billing staff see billing messages. Your regional director can see across all five sites.
This lines up with HIPAA’s minimum necessary standard, which asks you to limit access to what each role needs. Curogram’s compliance page lists role-based permissions, multi-factor login, and access controls that let only authorized users view patient data.
Offboarding gets simpler, too. When a therapist leaves, you turn off her login. Her threads stay with the group, and the next therapist on that caseload can read the history.
Every message is logged with the sender, the time, the number it went to, and the clinic it came from. Curogram keeps permanent audit trails on messages, forms, and documents, so nothing ages out of the record.
The patient list syncs with Fusion, so threads attach to the right child. That matters in a household with two or three siblings in care. It also means the session-day details that used to vanish on personal phones now sit next to the child’s profile.
With an audit trail family communication becomes something you can produce on request. A late arrival, a moved session, or a canceled visit each leaves a dated entry.
Minors’ PHI texting compliance depends on what goes in the text as much as where it’s sent. Curogram’s client HIPAA agreement draws a clear line. Standard SMS carries logistics. Clinical details go through an encrypted secure link.
Two versions of the same message show the difference:
|
Message |
What it shares |
|
“Please bring Leo’s AFOs and splints for today’s session.” |
Child’s name plus equipment tied to a diagnosis |
|
“Please bring Leo’s gear for today’s 3:30 session.” |
Child’s name and a time |
|
“Leo’s home program is ready: [secure link]” |
Nothing clinical until the parent opens the link |
Default templates are built without PHI. Home programs, progress notes, and anything about a diagnosis go behind the link.
Texting a family starts at intake. Capture the parent or guardian’s cell number and their consent to receive texts on the same form. With a minor, the child’s own phone number rarely belongs in the record at all.
Consent rules come from the TCPA as well as HIPAA. Informational texts, like reminders and delay notices, need prior express consent.
Marketing texts need prior express written consent, which is a higher bar. Curogram’s digital intake forms can capture that consent before the first text goes out, and the signed form stays on file.
Curogram earned SOC 2 Type II certification through an independent audit by Thoropass, announced in April 2025.
The audit covered the AICPA Trust Services Criteria for security and availability. Data is encrypted with AES-256 at rest and TLS 1.2 or higher in transit. We sign a BAA with every client.
Any BAA texting vendor therapy groups consider should hand over this kind of proof during evaluation. Ask for the report type, the audit date, and the criteria it covers.
That gives you SOC 2 patient messaging therapy teams can inspect, without a security hire. Good pediatric practice privacy governance usually stalls on staffing, so starting from an audited vendor removes the biggest gap.
Take an illustrative five-clinic group. Maya, age 6, sees an OT at the Eastside clinic and a speech therapist at Westside. Her parents are separated, and a court order limits her father’s access to scheduling details.
In April, her mother’s attorney asks for every text between your staff and the family from January 1 through March 31.
Role-Based Access & Audit Trails is the part of Curogram that turns family texting into a governed record. Each user is scoped to a clinic and a duty, and every message is logged from the moment it’s sent.
Setup for a Fusion group follows the org chart you already have. You map users to the clinics they work in and the roles they hold, such as therapist, front desk, billing, or director.
A therapist at one site sees that site’s families, while a regional director sees all of them. Multi-factor login protects each account.
The log covers messages, forms, and documents. Each entry shows who sent it, when, to which number, and from which clinic.
When a staff member leaves, you turn off the login and keep the history. The next person on that caseload picks up the thread with full context.
Patient data syncs with Fusion, so messages attach to the right child, even in households with several siblings in care. Front desk staff can answer a parent’s reply while the therapist stays with the patient in front of her.
Message content follows the same rules. Default templates leave out clinical details, and anything sensitive goes through an encrypted secure link.
During evaluation, your team can review the SOC 2 Type II report and our BAA terms. Both are ready before you sign, so an owner without an IT or compliance department can still check the vendor properly.
Your therapists will text parents this week. The schedule demands it, and the parents expect it. The only choice left to the group is which system carries those messages.
A ban pushes the habit onto devices you can’t see. Once the clinic number, the shared thread, and the templates beat the personal phone, staff move over without being chased. Each message then lands in a log that’s scoped, searchable, and kept after people leave.
Fusion protects your clinical record. Family coordination happens in a different place, in quick texts about pickups, delays, and gear. Those texts deserve the same standard of care, with the same kind of audit trail behind them.
Try one test with your leadership team. Ask, “Could we produce every family communication from last quarter?” If anyone pauses before saying yes, act on that pause now. A custody case or an OCR letter will ask the same thing, with a deadline attached.
Book a demo to see how role-based access and audit trails work for a multi-clinic Fusion group.