Most articles on this subject open the same way. Texting is not HIPAA compliant by default, so buy a platform.
That skips the part a practice actually has to deal with.
Encryption sits in the Security Rule as addressable rather than required. The word does not mean optional. Somebody has to make that call and write down why. If the answer is no, an equal measure goes in its place.
Skipping that step is what regulators are fining people for. Through 2026, OCR has been running an enforcement initiative built around the missing analysis.
Four ransomware settlements reported last June came to $1,165,000 between them. Each one named the same failure. A proposed overhaul would take the choice away entirely. It has slipped twice and now sits at July 2027.
Below: what addressable obliges you to do, and what OCR actually penalizes. Then where the real risk sits, and what to check before buying anything.
Patients answer texts. They do not answer unknown numbers, and practice email goes unread.
Ordinary SMS carries protected health information unencrypted, then lands on a lock screen anyone nearby can read. That is the whole problem in one sentence.
Carriers store and route those messages on equipment nobody at the practice controls. No agreement covers any of it. Staff work around it rather than stopping. Personal phones come out when the official tool is slow, and that is where the exposure starts.
Nobody plans this. It builds up on a busy Thursday, one quick message at a time. The number on the patient's screen then belongs to a person rather than the practice. When that person leaves, the thread leaves with them.
Most articles get this part wrong. The Security Rule marks encryption as addressable, and addressable is not the same as optional.
The transmission security standard says it plainly. Section 164.312(e)(2)(ii) asks a practice to encrypt protected health information whenever it deems that appropriate.
Section 164.306(d)(3) asks a practice to judge whether the safeguard is reasonable and appropriate in its own setting. If it is, implement it. If it is not, the rule asks for two things: write down why, and put an equal alternative in place.
Most practices do neither. They skip the assessment, which means there is no record of a decision anyone could defend later. Plain SMS for lab results is a hard case to make. For a one-line appointment nudge, the case gets much easier.
Enforcement has not centered on encryption. It has centered on the analysis a practice is supposed to run first.
Risk analysis sits at 164.308(a)(1)(ii)(A) and carries no addressable option at all. It is required, flat out.
By March 2026, OCR had announced twelve actions under its risk analysis initiative. Each cited a failure to conduct an accurate and thorough one.
Four ransomware settlements reported in June 2026 show the pattern and the price.
|
Entity |
Settlement |
Core OCR finding |
|---|---|---|
|
Assured Imaging |
$375,000 |
Risk analysis not accurate or thorough |
|
Regional Women's Health Group |
$320,000 |
Risk analysis not accurate or thorough |
|
Star Group Health Benefits Plan |
$245,000 |
Risk analysis not accurate or thorough |
|
Consociate |
$225,000 |
Risk analysis not accurate or thorough |
|
Four settlements |
$1,165,000 |
One shared deficiency |
Two of the four also drew impermissible disclosure findings and one drew a late breach notice. The shared thread is the missing analysis.
A patient who cannot make Tuesday says so on Tuesday morning, and the slot gets filled. A voicemail ends the exchange instead.
Booking that writes back to the schedule is the test. A request that lands in a staff inbox has moved the work rather than removed it.
Watch where the reply lands. A confirmation that updates the appointment status saves a step. One that emails the front desk moves the work to a different screen.
Waitlist backfill is the same mechanic pointed the other way. A canceled 2 p.m. goes out to six people at once, and the first reply takes it.
Calling costs staff time at a fixed rate. Two minutes a name, eighty names, and five o'clock arrives first. Put a number on it before you shop. Count the outbound calls your front desk makes in one week, then multiply by two minutes.
Eighty reminder calls runs to about two and a half hours. Eighty confirmations, eighty reschedules and eighty recall attempts is most of a week.
Smaller practices feel it hardest. Our writeup of two-way texting in rural clinics on Azalea Health covers that end of it.
Recall is where texting earns its place. Overdue patients come back when somebody asks, and almost nobody asks. Recall lists go stale because no one has a spare hour to work through them. A text costs seconds and goes out in a batch.
Set the window by the gap that matters. Six months for hygiene, a year for annuals, two weeks for a post-op check. Long treatment plans need the same thing on a longer clock. Orthodontic practices run it over years rather than months.
We covered patient communication for orthodontic practices in Dolphin, where every appointment depends on the one before it.
Reminders work, and the effect is modest. Pooled research puts the lift in attendance at around 11%, not the figures vendors tend to quote. The earlier version of this page claimed up to 75% fewer no-shows. No study supports that, so it is gone.
Timing does more than wording. A reminder the day before gives a patient room to cancel, which is the whole point of sending it. One sent an hour ahead only tells you sooner that the slot is gone.
Measure your own rate for a month before changing anything. That number beats any vendor average, ours included.
A thread in a separate app is not in the record. Somebody retypes it, or it is lost to whoever needs it next.
Count the places one patient exchange can live. The texting app, the EHR note, a sticky note, and somebody's memory. Each copy is one more thing to find when an auditor asks, and one more thing to miss.
Writing back is the half most tools skip. Our piece on two-way texting inside the CharmHealth workflow covers what the return path looks like.
An audit asks what you decided and when. A platform with audit logs answers that; a personal phone does not.
Section 164.316(b)(2)(i) sets the retention period at six years. That clock runs from the date the document was created or last in effect, whichever is later.
The same section asks for periodic review and updates as conditions change. A new EHR or a second location is a condition changing. The documentation duty is ongoing rather than one-off. Filing it once and forgetting it fails the rule as surely as never writing it.
Wrong number is the usual one. A digit mistyped at intake sends a result to a stranger, and nothing about that is recoverable.
Intake is where the bad digit gets in. Reading the number back at check-in costs ten seconds and catches most of them. Sending a link rather than the content itself limits what a wrong number receives. That is a design choice, not a setting.
On penalties, the live version of this page quoted $100 to $50,000 with a $1.5 million annual cap. Those are the base figures in section 160.404. That same section says the amounts are adjusted each year, then published separately.
So the numbers on the old page understated the current position. Check the adjusted table rather than quoting the base.
Messages sit beside the patient record rather than in a separate contact list. Staff work from one inbox for scheduling and replies alike. A patient reply lands in the same thread the reminder went out on, so nobody rebuilds the context from scratch.
A business associate agreement comes as standard rather than as an upgrade.
Role-based access decides who sees a waiting patient. Front desk updates the status and the clinician joins when ready. Patients open a link rather than install an app. Fewer calls about downloads is most of the benefit.
Reminders read the schedule, so they know the visit type and the time. One built from a spreadsheet does not. Visit type should change the message. A cleaning and a post-op check do not need the same wording.
Internal messages stay inside the same system as patient threads, which keeps the audit trail in one place. A covering clinician reads the thread without a forward, and the log shows who opened it and when.
Forms sent by text get completed more often than emailed ones. The link opens where the patient already is. Forms that come back before the visit shorten the wait at the desk. Transcribing a clipboard at 8 a.m. is the step that goes.
Curogram HighlightCurogram's HIPAA-Compliant Texting sends a secure link rather than putting patient detail in the message body. Threads attach to the record, and the audit log is part of the product rather than a separate exercise. The assessment still belongs to the practice. A platform supplies safeguards and an agreement, and the written decision is yours. |
Curogram connects to app-based, cloud-based, server-based and browser-based systems.
Ask what the connection reads and writes, not if your system appears on a list. Reading the schedule and writing back to the chart are the two that decide whether it saves work.
Three questions settle it. Can it read the schedule, can it write back to the chart, and does the patient identifier carry across?
A connection that reads but cannot write leaves the retyping exactly where it was. Demos tend to move past that part quickly. Server-based and browser-based systems behave differently here, so ask about yours by name.
Start with the assessment, because it is free and it is the thing an audit asks for.
Write down whether encryption is reasonable and appropriate for your practice. If you decide against it, record why and name the alternative. Keep that decision somewhere a stranger could find in ten minutes. Six years is a long time to rely on one person's folder.
Then diary the proposed rule. HHS has pushed the Security Rule overhaul to July 2027, after an earlier target of May 2026 passed without action.
If it lands as proposed, the choice disappears and encryption becomes required. Practices that already made the decision will have less to do. After that, look at what your staff actually use today. The gap between the official tool and the personal phone is the real finding.
Last, check who owns this at your practice. If the answer is nobody, that is the finding rather than the software. None of this is a legal opinion, and your own compliance lead should see whatever you decide.
Book a Curogram demo to see the secure link, the audit log and the record write-back in one pass.