Business Associate Agreement Requirements for Patient Engagement Texting Platforms

When does a texting platform qualify as a business associate?

A patient engagement texting platform generally qualifies as a HIPAA business associate when it creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity, such as a healthcare provider. That can include handling patient names and phone numbers alongside appointment details, care instructions, or other health information. The platform’s role and relationship with the provider matter—not whether the vendor can read every message.

A vendor used directly by patients, without providing a service on behalf of a covered entity or another business associate, may not have the same business associate relationship. But when a provider uses a messaging service to communicate with patients as part of its operations, it should assess whether the vendor handles PHI on its behalf and, if so, obtain the required written assurances. See HHS guidance on business associates and HHS guidance on cloud service providers.

What must a BAA cover for patient engagement texting?

A BAA should describe what the texting platform is engaged to do and define its permitted and required uses and disclosures of PHI. It must restrict the vendor from using or disclosing PHI beyond what the agreement permits or the law requires, and require appropriate safeguards, including applicable Security Rule protections for electronic PHI.

The agreement should also require the vendor to report impermissible uses or disclosures and security incidents; help the provider respond to patient requests for access, amendments, and accounting of disclosures when applicable; make relevant records available to HHS; and return or destroy PHI at termination when feasible. It must authorize the provider to terminate the agreement for a material breach. These requirements are summarized in HHS’s sample business associate agreement provisions.

For a texting service, spell out practical details too: which message types the platform may send, which staff can use it, how patient communication preferences are handled, how long message records are retained, and what the vendor must do when an account or phone number is changed. These operational terms help implement the BAA; they do not replace the required HIPAA provisions.

How should permitted uses and disclosures of PHI be defined?

Define the platform’s purpose narrowly—for example, appointment reminders, care coordination, or other provider-approved patient communications. Specify what information the platform may use, who may receive it, and whether the vendor may store message content, use it for support, or disclose it to another service provider. The BAA cannot authorize a use or disclosure that would violate the HIPAA Privacy Rule if the covered entity made it.

Apply the minimum necessary standard where it governs the use or disclosure, and avoid placing more information in a text than the communication requires. HIPAA’s minimum necessary rule has exceptions, including certain disclosures to or requests by a healthcare provider for treatment; that does not remove the separate duty to use reasonable safeguards. See HHS’s summary of the HIPAA Privacy Rule and its guidance on electronic patient communications.

What safeguards should the platform implement for text messages?

The Security Rule requires appropriate administrative, physical, and technical safeguards to protect electronic PHI’s confidentiality, integrity, and availability. The BAA should require the platform to maintain safeguards appropriate to the PHI and the services it provides. The particular measures should follow a documented risk analysis rather than assume that one technical configuration fits every organization.

Depending on that analysis, useful protections may include unique user accounts, role-based access, authentication, audit logs, staff training, secure data storage, and protections for data in transit. A provider may also choose to send a brief notification that directs the patient to a secure portal instead of putting sensitive details in an ordinary text. HHS explains the Security Rule requirements in its Summary of the HIPAA Security Rule; its electronic communication guidance also recommends reasonable safeguards such as limiting the information sent and checking recipient details.

Do not treat a vendor’s marketing language or a signed BAA as proof that the platform is secure or that the provider is compliant. Evaluate the service’s actual capabilities, settings, contracts, and risks, and make sure the provider’s own workforce practices support secure use.

How must subcontractors and downstream vendors be covered?

If the texting platform uses a subcontractor that creates, receives, maintains, or transmits PHI on the platform’s behalf, the platform must obtain written assurances that the subcontractor will follow the same applicable restrictions and safeguards. This may include infrastructure, hosting, analytics, customer support, or messaging delivery vendors, depending on what information they handle and the services they perform.

The provider’s BAA should require the platform to identify and manage relevant subcontractors, flow down the required protections, and remain responsible for its contractual obligations. The HIPAA Security Rule specifically requires business associates to ensure that agents, including subcontractors, implement appropriate safeguards. See HHS’s BAA provisions and the HHS Security Rule summary.

What are the breach reporting and incident response requirements?

The BAA should require the platform to report security incidents and impermissible uses or disclosures, and to cooperate with the provider’s investigation and response. Define how the platform will preserve relevant records, share incident details, support mitigation, and help identify affected patients. The agreement can set an operational reporting deadline shorter than the outside limit in the Breach Notification Rule, giving the provider time to assess and meet its own duties.

For a breach of unsecured PHI at or by a business associate, HIPAA requires the business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is an outside limit, not a recommended response target. The covered entity is generally responsible for required notices to affected individuals, HHS, and, when applicable, the media, though it may delegate notice tasks by agreement. See HHS’s Breach Notification Rule guidance.

Set clear procedures for triage, escalation, investigation, and documentation. The BAA should distinguish a reportable breach from other security incidents while ensuring the vendor promptly shares information the provider needs to assess whether notification is required.

What limitations apply to patient texting and consent?

A BAA governs the provider–vendor relationship; it does not by itself establish that every text is appropriate, satisfy other legal requirements, or override a patient’s communication preferences. HIPAA permits providers to communicate electronically with patients when they use reasonable safeguards, but providers must accommodate a patient’s reasonable request to receive communications by alternative means or at an alternative location. See HHS guidance on electronic communications and confidential communication requests.

Maintain accurate patient communication preferences, including the approved number and any request not to use text messaging. Limit message content when a notification could appear on a shared device or lock screen, and offer another reasonable communication method when required. Consider consent, opt-out, and content rules that may apply under other federal or state laws, based on the message, technology, and circumstances; do not assume that HIPAA alone resolves those questions.

In short, an effective BAA defines the texting vendor’s role, limits its handling of PHI, requires appropriate safeguards and subcontractor protections, and sets workable incident-response terms. Providers should pair that agreement with risk-based platform controls and processes that respect each patient’s communication preferences.

FAQs.

Does a patient engagement texting platform need a BAA?

Generally, yes, when the platform creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. The parties should assess the vendor’s actual role and services rather than rely only on the product label.

What provisions are required in a HIPAA-compliant BAA?

A BAA must define permitted and required PHI uses and disclosures; restrict other uses and disclosures; require appropriate safeguards; address incident and breach reporting; support applicable patient rights; provide for HHS access to relevant records; cover return or destruction of PHI when feasible; require protections to flow down to subcontractors; and authorize termination for a material breach. See HHS’s summary of required BAA provisions.

Must a texting platform’s subcontractors sign BAAs?

A subcontractor that handles PHI on behalf of the texting platform must agree in writing to the applicable restrictions and safeguards. The platform should ensure those protections flow down through its subcontracting arrangements.

Does a BAA replace patient consent for text messaging?

No. A BAA is an agreement between the provider and the vendor; it does not automatically supply patient consent or settle requirements under other laws. Providers should follow applicable rules, use reasonable safeguards, and honor reasonable requests for alternative communication methods.