HIPAA Compliance Checklist for Choosing a Secure Clinician Texting Company

Choosing a clinician texting company means evaluating more than its messaging features. You need to understand how the vendor handles electronic protected health information (ePHI), supports your organization’s HIPAA Security Rule safeguards, and fits your clinical workflows.

Use this checklist to assess the vendor’s contracts, security controls, policies, and hospital participation requirements. HIPAA compliance depends on your organization’s decisions and safeguards as well as the vendor’s; a vendor’s claim of being “HIPAA compliant” does not replace your own evaluation.

Verify Business Associate Agreement Requirements

Determine whether the texting company creates, receives, maintains, or transmits ePHI on your organization’s behalf. If it does, it will generally be a business associate, and your organization will need a written business associate agreement (BAA) with it. A vendor may still qualify as a business associate when it stores encrypted ePHI but cannot decrypt or view it.

Before signing, confirm that the BAA clearly describes permitted uses and disclosures of protected health information, requires appropriate safeguards, and addresses reporting security incidents and impermissible disclosures. Review provisions covering subcontractors, access to information needed for patient rights, and return or destruction of ePHI when the relationship ends.

• Ask whether the BAA covers every service and feature your organization plans to use.
• Clarify which safeguards are the vendor’s responsibility and which your organization must configure.
• Review how the vendor handles subcontractors that may access or maintain ePHI.
• Check the BAA’s incident notification process and data return or destruction terms.

Assess Authentication and Access Controls

Review how the platform verifies user identity and limits access to patient information. HIPAA Security Rule safeguards include access controls and authentication; your organization should understand how the vendor’s controls work alongside its own user management and security procedures.

Look for unique user accounts, role-based permissions, and a process for promptly removing access when a staff member changes roles or leaves. Ask whether administrators can manage devices and sessions, revoke access to a lost or stolen device, and review audit logs showing who accessed or sent information.

Ask the vendor how it supports stronger authentication, such as multifactor authentication when appropriate to your risk analysis. Also clarify whether messages or patient details appear in phone notifications or remain accessible through the device’s standard messaging app.

Review Encryption and Transmission Security

Ask how the platform protects ePHI while it is transmitted and while it is stored. Transmission security is a HIPAA Security Rule safeguard, and encryption is an important protection to evaluate. The Security Rule’s implementation specifications can require a risk-based assessment of whether a safeguard is reasonable and appropriate for your organization; ask the vendor to explain its approach rather than relying on a broad compliance claim.

Find out whether messages remain within the secure application or can spill into standard SMS, email, device backups, or lock-screen previews. Ask how the company prevents unauthorized forwarding or copying where supported, handles message retention and deletion, and protects information stored on mobile devices.

Request clear documentation of the protections in place and the responsibilities assigned to your organization. The vendor’s answers should help you evaluate risks across the full message lifecycle—from composition and delivery through storage, access, and deletion.

Evaluate Risk Analysis and Messaging Policies

HIPAA risk analysis is not a one-time review of a vendor’s marketing materials. Your organization should assess risks and vulnerabilities involving ePHI it creates, receives, maintains, or transmits, then use that risk analysis to guide risk management and safeguards. Consider how clinician texting fits into your environment, workflows, devices, and existing policies.

Review the vendor’s documentation on security incidents, outages, backups, recovery, message retention, and data access. Ask how the company tests and updates its security measures, and what information it will provide to help your organization assess the platform. Define internal rules for acceptable message content, patient identification, urgent communications, and documenting clinically relevant exchanges.

Make responsibilities explicit: staff need to know which information may be sent, which app to use, and what to do if a message goes to the wrong recipient or a device is lost. Reassess the platform and your policies when workflows, technology, or identified risks change.

Protect Patient Communications

Providers can communicate electronically with patients about health issues and treatment when they apply reasonable safeguards to protect privacy. Before choosing a platform, confirm how it verifies the intended recipient, limits unintended disclosure, and supports patients’ communication preferences. HHS guidance also advises providers to accommodate reasonable requests for confidential communications by alternative means or at alternative locations.

Consider whether messages could appear on a shared or unattended device, be seen on a lock screen, or reach an outdated phone number. Establish procedures for confirming contact details, limiting sensitive details in notifications, and giving patients a suitable alternative when they do not want to use a particular channel.

Decide how the platform will distinguish patient communications from messages among clinicians. Train staff to use approved channels and avoid sending more information than necessary for the purpose of the communication.

Confirm Support for Hospital Clinical Orders

Hospitals and critical access hospitals may text patient information and orders among the care team when they use a HIPAA-compliant secure texting platform and comply with applicable Conditions of Participation. Computerized provider order entry (CPOE) remains CMS’s preferred method of order entry.

If your hospital may send orders through secure text messaging, confirm that the platform supports your medical-record workflows and hospital policies. CMS expects systems used for this purpose to be secure and encrypted, protect the integrity of author identification, and be assessed routinely for security and integrity. Texted orders must be dated, timed, authenticated, and promptly placed in the medical record.

Ask the vendor how messages and orders are accurately captured, retained, and made accessible in the electronic health record. Verify that your organization can define authorized users, preserve an auditable record, and train staff on when to use secure texting versus CPOE.

Overall, choose a company whose contract, safeguards, and clinical workflows you can verify—and document how your organization will use and oversee the platform.

FAQs

When does a clinician texting vendor need a business associate agreement?

A vendor generally needs a BAA when it creates, receives, maintains, or transmits protected health information on behalf of a covered entity or business associate. This can include storing encrypted ePHI even if the vendor cannot decrypt it. Assess the vendor’s actual services and data handling, and confirm the arrangement in a written agreement when required.

What security safeguards should a HIPAA-compliant texting platform support?

Evaluate safeguards such as user authentication, access controls, audit logging, and transmission security, along with protections for stored messages and mobile devices. The specific safeguards should be assessed in light of your organization’s risk analysis and responsibilities under the HIPAA Security Rule.

Can providers text patients about health issues and treatment?

Yes. HIPAA permits providers to communicate electronically with patients about health issues and treatment when they use reasonable safeguards to protect privacy. Providers should take care to contact the correct person, limit unintended disclosures, and consider reasonable requests for confidential communications through alternative means or locations.

Can hospitals send clinical orders through secure text messaging?

Yes, hospitals and critical access hospitals may text patient orders among members of the care team through a HIPAA-compliant secure texting platform and in compliance with applicable Conditions of Participation. CPOE remains the preferred method. Texted orders must be dated, timed, authenticated, and promptly placed in the medical record.