HIPAA-Compliant Texting Checklist for Small Clinics (2026)

Ask five practice managers what makes texting HIPAA compliant and you'll hear five answers. The vendor handles it. We only send reminders, so it doesn't apply. We signed a contract, so we're fine. Each answer holds a piece of the truth, which is why the topic stays muddy.

Compliance sits with your clinic. Your vendor carries part of the load. The audit letter still arrives at your address.

And the load is smaller than most owners fear. Eight items, checked once and reviewed each year, cover what a clinic needs to text patients legally. No compliance officer required.

Timing matters this year. HHS put out a proposed Security Rule update on January 6, 2025. It would make encryption and multi-factor login mandatory rather than optional.

As of July 2026, OCR hasn't issued a final rule, and the federal agenda now points toward July 2027. So the current Security Rule stays in force. The checklist below reflects the rules you answer to today, and we flag what shifts if the proposal lands.

We wrote this as an operations document. Each item covers three things: what it is, why HIPAA asks for it, and the question that gets a straight answer out of a vendor. Work through it with your texting platform open in another tab.

Bring the front desk lead, since they'll know which rules already get bent on a busy Monday. Most clinics find two or three gaps. Most of those close with a settings change and one staff huddle.

1. Get the BAA Signed Before a Single Message Goes Out

A business associate agreement (BAA) is a contract between your clinic and any company that handles patient data for you. Your texting vendor qualifies. So does the cloud host storing those threads, which is why the agreement has to reach subcontractors too.

What the BAA Actually Promises

The BAA binds your vendor to the same safeguards you follow. It names what data they may use and what they may never do with it. Breach notice timing goes in there too, along with the deadline for telling you.

A good agreement also states what happens to your data when the contract ends. Most run a few pages and read plainly.

Read the termination clause first. Your message history should come back to you in a usable format. The vendor should destroy their copy on a stated schedule. Clinics discover this clause is missing at the worst possible moment, three days into switching platforms.

Check whether the vendor names its own subcontractors. Text delivery usually runs through a carrier aggregator. HIPAA requires that chain to be covered. A vendor who can't explain their chain hasn't thought about it.

Why HIPAA Won't Let You Skip It

Under the Privacy Rule, you may share protected health information with a business associate only after getting written assurances. Those assurances say the data stays protected. Without a BAA, the vendor has no lawful basis to hold your data at all.

OCR treats the missing paperwork as its own violation, separate from any breach. A clinic can have tight security and never lose a record. It can still be cited because a signed agreement wasn't on file. That's an unforced error, and it's the cheapest item on this list to fix.

Note the direction of liability. A BAA adds a second party who shares responsibility with you. Your own duty stays exactly where it was.

BAA Texting Vendor Requirements: 4 Questions to Ask

Most BAA texting vendor requirements collapse into four questions. A sales rep should answer all four without checking with legal:

1. Will you sign a BAA before onboarding, at no extra charge? A paywalled BAA is a red flag. So is a vendor who signs one only for enterprise tiers.
2. Which subcontractors handle our messages? Ask for company names. Categories tell you nothing.
3. What's your breach notice window to us? HIPAA gives you 60 days to notify patients. A vendor who takes 45 of those days leaves you almost no room to work.
4. What do we get back if we leave? Format, timeline, and cost.

Where Small Clinics Get Tripped Up

Two patterns show up again and again:

1. A practice signs with a texting tool during a busy quarter. The BAA gets emailed over and nobody countersigns it. That file then sits in a shared drive, unsigned, for two years. Every message sent in the meantime moved PHI without a lawful basis.

2. Scope drift is the second pattern. Say you signed a BAA covering appointment reminders. Later the same vendor adds intake forms and payment links. Now they're holding a different category of data. Ask whether your existing agreement covers the new module before you switch it on.

Curogram's client agreement spells out the split directly. The platform provides the secure tools. The clinic agrees to limit access to approved staff and keep PHI out of unsecured channels.

That kind of written division of duties is what you want from any vendor. It tells you which half of the job stays yours.

One more habit worth building. Store every signed BAA in a single folder, with the vendor name and signature date in the filename. During an audit you'll be asked for them together, on short notice.

Count the vendors while you're in there. A five-provider clinic often has six or seven business associates: the EHR, the texting platform, the billing service, the answering service, the shredding company, and the IT contractor with remote access.

Each one needs an agreement. Missing BAAs cluster around the small vendors nobody thinks of as software.

2. Encrypt the Message Path and Know Where Plain SMS Stops

3. Record Consent With a Date, a Source, and a Number

Consent is where texting patients HIPAA rules meet a second law entirely. HIPAA covers the privacy of what you send. The TCPA, enforced by the FCC, covers whether you were allowed to send an automated text to that number at all. You need both, and they get documented differently.

What Counts as Consent for Patient Texts

For appointment reminders and other treatment messages, the bar is prior express consent.

The patient gave you the mobile number and understood you'd use it to reach them. A patient writing their cell number on an intake form, under a line about text reminders, clears that bar.

Billing reminders and payment links sit in the same treatment-and-payment lane. Marketing is stricter and needs written consent that says so in plain words.

Keep the two lists apart inside your platform. A recall message and a review request belong in different categories.

Verbal consent counts if you record it. A chart note reading "pt verbally OK'd text reminders, 3/14/26, LM at front desk" is a real record.

A 5-Step Walkthrough for the Front Desk

The capture works like this when it's built into the workflow instead of bolted on:

1. Intake asks once. One line on the digital intake form: mobile number, plus a checkbox with the actual sentence patients agree to. Keep it above the signature line where people read.
2. The checkbox writes a timestamp. Consent without a date is an assertion. Your form tool should stamp date, time, and form version on its own.
3. The number gets tied to the consent. Patients change numbers. Consent attaches to the number given, so a new number restarts the record.
4. First message states the exit. The opening text names your clinic and how to stop. "Reply STOP to opt out" satisfies the disclosure and starts the trail clean.
5. A staff member can pull it in 30 seconds. If proving consent takes a support ticket, you don't functionally have the record.

Step five is the one clinics skip. During an OCR inquiry or a TCPA demand letter, you'll be asked to produce the record within days. Existence and retrievability get treated as the same thing.

What the Record Needs to Show

Four fields need to travel together:

• Phone number the consent covers
• Date and time it was captured
• Method: intake form, portal, chart note, or keyword reply
• Exact wording shown to the patient, including the version

Store the wording, rather than a bare yes. Two years from now, "the patient agreed" carries far less weight than the sentence they actually read.

Clean consent records pay for themselves in throughput. Based on our internal data in the Curogram Case Studies, clients average above a 75% appointment confirmation rate. Atlas Medical Center cut no-shows from 14.20% to 4.91% within three months of turning on automated reminders.

4. Honor Opt-Outs Fast and Keep the Log

An opt-out is a compliance event with a clock on it. Treat it as a system function rather than a favor the front desk does when someone complains twice.

The Words You Have to Treat as a Stop

The FCC's 2024 consent order named replies that count as a valid opt-out. Stop, quit, end, cancel, unsubscribe, revoke, and opt out all qualify. Any reasonable phrasing that clearly asks you to stop also counts, including a sentence that never uses one of those words.

That's broader than most platforms handle by default. A reply reading "please stop texting me, I've asked twice already" won't match a keyword filter. Someone has to read it and act on it.

The 10-Business-Day Clock

Once a valid opt-out arrives, automated calls and texts to that number must stop within 10 business days. Your confirmation text may confirm the opt-out. It may not try to talk the patient out of leaving.

One nuance worth knowing this year. The FCC's broadest provision would make a single opt-out apply to every unrelated message type from the same sender. That piece has been pushed back twice.

A January 6, 2026 order moved the effective date to January 31, 2027 while the agency reviews comments on whether to change the rule. Healthcare messages that don't require prior consent sit in a narrower carve-out. None of that changes your duty to honor a clear stop request today.

Three settings do most of the work:

• Auto-suppress on keyword match, across every message type, not just the campaign the patient replied to.
• Route non-keyword stops to a human queue with a same-day response target. This is where the "please stop texting me" replies get caught.
• Write the opt-out back to the chart so a staffer scheduling by phone can see it before dialing.

Add a fourth if your platform supports it. Flag opted-out numbers inside the EHR view your front desk actually uses, rather than only inside the texting tool. Staff work where the schedule lives.

How to Check a Vendor's Answer

Ask the rep to opt out a test number in front of you. Then send a message from a different module. Reminders, recalls, and payment requests often run on separate rails inside the same product. A suppression that covers one rail is a gap you'll find the hard way.

Then ask where the opt-out log lives and whether you can export it. A patient complaint six months from now gets answered by a timestamp, not by anyone's memory of the call.

5. Give Every Staff Member Their Own Login

Shared logins are the most common gap we hear about from small clinics, and the easiest to close. A password taped under the front desk monitor is a HIPAA finding waiting for a reason to surface.

Unique Identity by Rule

The Security Rule requires a unique user ID for anyone reaching systems that hold patient data. One shared front-desk account breaks that rule outright. The log can no longer say who did anything.

Role-based access follows from there. A biller needs payment threads. A part-time medical assistant probably doesn't need the full message archive for every patient in the practice.

Most platforms ship with two or three roles. Use them, and review the assignments when someone changes jobs internally.

Turn Off Access the Day Someone Leaves

Termination procedures are a written requirement, and they're where small practices drift. A per-diem MA leaves in March. Their login still works in September because nobody owned the offboarding step.

Put it on the same checklist as the badge and the key. One line: disable platform login, same day. Then verify monthly by exporting the active user list and reading the names out loud in a staff meeting. It takes four minutes.

Contractors deserve a second look. Billing services, answering services, and locum providers all get accounts and rarely get removed.

Multi-Factor Login and the Automatic Logoff

Multi-factor login is addressable under the current rule and required under the January 2025 proposal. Turn it on regardless. A texting inbox holding two years of patient threads deserves the same protection as your email.

Automatic logoff matters more in a clinic than in a back office. Front desk screens face the waiting room. Set the session timeout short enough that a walk-away doesn't expose a thread.

Keep it long enough that staff don't start propping sessions open with a mouse jiggler. Fifteen minutes is a common landing spot.

How to Check a Vendor's Answer

Ask for a look at the user management screen during the demo. You want individual accounts, assignable roles, an active/inactive toggle, an MFA setting, and a session timeout field. If roles cost extra, price that now, because you'll need them by your second hire.

6. Keep Audit Logs You Can Actually Pull

An audit log records who did what inside the system, and when. HIPAA calls for the capability and for reviewing it. Both halves matter, and clinics usually have the first without the second.

At minimum, the log should hold messages sent and received, the staff account that sent each one, the patient record it attached to, and timestamps.

Add logins and failed login attempts. Add any change to consent or opt-out status. Exports should open in a spreadsheet without special software.

Volume is why usability isn't a luxury here. Covina Arthritic Clinic confirms more than 1,100 appointments a month through automated texting, based on our internal data in the Curogram Case Studies.

A log covering that volume only helps if you can filter it by user, by patient, and by date range in a few clicks.

What to Look at Each Quarter

Four things, and the whole pass takes about 20 minutes:

• Logins outside business hours, especially on weekends
• Accounts still active for people who left
• Failed login spikes on any single account
• Messages sent to numbers with no consent record

How to Check a Vendor's Answer

Ask for a sample export before you sign. You want an anonymized CSV pulled from a demo account. A feature description won't tell you whether the export works. Two things commonly go wrong.

The log exists but can't be exported without a support request. Or the log records sends without recording who opened a thread.

Ask how long logs are kept, too. Six years is the HIPAA documentation standard. A vendor keeping 90 days has made a decision on your behalf that you're the one who answers for.

7. Write the Policy Staff Will Actually Follow

A written policy is a Security Rule requirement and a practical one. Staff make judgment calls at speed. A two-page document beats a hallway rule that changes depending on who's asking.

Keep the HIPAA text messaging policy clinic staff receive short enough that a new hire reads it on day one. Name the approved platform.

Draw the line between plain SMS and a secure link. Say who may text patients, how consent gets captured, how opt-outs are handled, and who to tell when something goes sideways.

Add one section people will actually reach for: sample wording. Three approved reminder templates, one payment message, one secure-link message. Templates prevent improvisation, and improvisation is where PHI ends up in plain text.

The Personal Phone Question

Say it plainly in writing. Patient texting happens on the approved platform, from clinic accounts. No personal phones, and no exception for the on-call rotation.

On-call is where policies bend. A physician texts a patient from a personal cell at 8 PM because it's faster than logging in. That thread now sits outside your audit log, outside your BAA, and inside a device nobody controls. Give on-call staff platform access on their phones so the fast option is also the compliant one.

The same rule covers photos. A wound picture saved to a personal camera roll is PHI on an unmanaged device.

Training That Leaves a Record

Train at hire and once a year. Keep the sign-in sheet or the completion export, because unrecorded training gets treated as training that didn't happen.

Fifteen minutes covers it for most staff. Walk through the plain-SMS line, the consent step, the opt-out step, and who to call. Run a short refresher after any real incident, including a near miss.

Who Owns the Document

Name one person. A practice manager or office lead works fine, and the name belongs on the policy itself. Set a review date each year, note the version, and keep old versions. If a question comes up about a message sent in 2024, you'll want the policy that was in force then.

What to Review at the Yearly Check

Read the policy against what staff actually do, rather than against the last version. Four questions do the job:

• Has anyone joined who never got trained?
• Has the platform added a feature the policy doesn't mention?
• Have we changed EHRs or added a location?
• Did a near miss happen that the policy failed to cover?

Rewrite the sections that fail. Leave the rest alone, since a policy that changes every year stops being memorable, and memorable is the whole point of keeping it to two pages.

8. Settle Retention, Ownership, and the Breach Plan

The last item is the one nobody thinks about until they need it. Three decisions, made once, written down where a new manager can find them.

How Long You Keep Messages

Patient texts belong to the record when they carry clinical content. Retention follows your state's medical record law, which commonly runs six to ten years for adults and longer for minors.

HIPAA separately requires six years of retention for compliance records, including policies, training logs, and BAAs.

Set the platform retention window to match your state rule. Then confirm that "deleted" means deleted on the vendor's side. Some platforms hide messages from your view while keeping them in a backup for years.

Watch the other direction too. A platform that purges at 12 months by default will delete threads your state requires you to keep, without warning anyone. Check that default setting before your first year is up.

Who Owns the Thread History

Your clinic does, and the contract should say so. Ask for the export format, the delivery timeline, and whether there's a fee. CSV or JSON with timestamps and patient identifiers is the answer you want.

Clinics that skip this question lose years of documented consent when they switch vendors. You won't notice the loss until a TCPA letter arrives asking about a message sent two years ago.

The 60-day Clock

Under the Breach Notification Rule, you notify affected patients without unreasonable delay, and no later than 60 days after discovery.

Breaches affecting 500 or more people also require notice to HHS and to prominent media in the state, inside that same window. Smaller breaches get logged and reported to HHS once a year.

Write the plan on one page before you need it:

• Who declares an incident, and who backs them up
• Who calls the vendor and the malpractice carrier
• Who drafts the patient notice
• Where the notice templates and the HHS portal link live

During a real incident, staff follow the page in front of them. Nobody reads a manual at 4 PM on the day a laptop goes missing.

Put all three in a single document with an owner and a review date:

Keep it with the BAAs. During an audit, a reviewer asks for all of it in the same conversation.

Assign the review to a real date, not a season. "First Monday in March" survives staff turnover. "Annually" does not, and a decision nobody revisits turns into a setting nobody remembers choosing.

The Violations We See Most and the Fix for Each

Every item above maps to a failure we've watched play out in small practices. These five account for most of them, and none of the fixes takes more than a week.

Conclusion: Working the Checklist This Quarter

Small clinics get held to the same texting rules as health systems with a full compliance department. That's the unfair part. It's also why an eight-item list beats a 40-page manual nobody opens.

Start with the two items carrying the most risk for the least effort. Confirm the BAA is countersigned and on file. Then find out whether anyone on staff has texted a patient from a personal phone this month.

Those two conversations surface most of what's wrong. Work the rest over a few weeks. Consent capture and opt-out handling usually need a settings change.

Logins and audit review need a habit. The policy needs one afternoon and a template.

None of this is meant to slow down texting. Practices with the foundation in place end up texting more, because staff stop hesitating over what's allowed. Confirmation rates climb and the schedule holds.

If you'd like to see the eight items inside a working platform, book a demo with our team. We'll pull up the audit log, the consent record, and the secure-link flow on a live account.

Frequently Asked Questions