Related Terms
PHI
HIPAA-compliant texting
Business associate agreement (BAA)
See Also
Texting is one of the most common places HIPAA questions come up. See how compliant patient texting works
2-way HIPAA Texting
For the law itself, see HHS.gov.
ABOUT THIS ENTRY
Category Core: Compliance
Reading time: 1 min
Updated: Nov 2026
HIPAA
Definition
HIPAA (the Health Insurance Portability and Accountability Act of 1996) is a U.S. federal law that sets national rules for protecting patients' health information and giving them access to it.
Why the distinction matters
HIPAA applies to covered entities, like providers, health plans, and clearinghouses, and to the business associates that handle health data for them.
Its main rules are the Privacy Rule, which limits how PHI is used and shared; the Security Rule, which sets safeguards for electronic PHI; and the Breach Notification Rule, which says who must be told when data is exposed.
The HHS Office for Civil Rights (OCR) enforces it, and HHS.gov holds the full text and guidance. For a practice, HIPAA shows up in daily choices: what goes in a text, which vendors get a BAA, and who can open which records.
Example
A practice wants to text patients. Before turning it on, it checks that the vendor will sign a BAA, that messages carry no PHI over standard SMS, and that staff logins are separate. Curogram, for example, is HIPAA-compliant and SOC 2 Type II certified.
Frequently Asked
-
Who has to follow HIPAA?
Healthcare providers that bill electronically, health plans, clearinghouses, and the business associates that handle PHI for them.
-
Can a practice text patients under HIPAA?
Yes. Keep standard texts free of PHI or use an encrypted platform, and have a BAA with the vendor.
-
Who enforces HIPAA?
The HHS Office for Civil Rights investigates complaints and can issue fines. State attorneys general can also bring HIPAA cases.