Myelodysplastic Syndromes Center Texting Policy Checklist for Protecting PHI

What information counts as PHI in a myelodysplastic syndromes center?

Protected health information (PHI) is individually identifiable information about a person’s past, present, or future health, care, or payment for care when it is held or transmitted by a covered entity or its business associate. It can be written, spoken, or electronic; electronic protected health information (ePHI) is the subset maintained or transmitted electronically. See the HHS summary of the HIPAA Privacy Rule and the HHS summary of the HIPAA Security Rule.

For a myelodysplastic syndromes center, a text can contain PHI if it connects a patient’s identity or contact details to their diagnosis, appointment, care, or billing. Examples include a patient’s name paired with an appointment at the center, messages about test results, or a treatment-related question. A message does not need to include a full medical record to be sensitive.

• List the identifiers and clinical details that staff must treat as PHI, including names, phone numbers, appointment information, and health-related messages.
• Define which approved texting channels may handle PHI and which staff roles may use them.
• Apply the minimum necessary standard where it applies. It generally calls for reasonable efforts to limit PHI to what is needed for the purpose, but it does not apply to disclosures to or requests by a health care provider for treatment purposes. See HHS guidance on the minimum necessary requirement.

Which texting channels are permitted for clinical communications?

HIPAA does not categorically prohibit sending ePHI through an electronic messaging channel. But the HIPAA Security Rule requires safeguards that protect ePHI, including against unauthorized access during transmission. HHS explains that ePHI may be sent over an open network when it is adequately protected and the organization has assessed and documented its security approach. See HHS guidance on sending ePHI over email or the Internet.

Standard SMS can expose message content through notifications, shared devices, or delivery to a number that no longer belongs to the patient. A clinic policy should therefore favor an organization-approved messaging platform with appropriate access controls and security protections for clinical content. Standard SMS may be limited to brief, neutral communications, such as asking a patient to call the center, when the center’s risk assessment and policy permit it.

• Identify the approved platforms and prohibit staff from using personal messaging apps or unapproved accounts for PHI.
• Set permitted message types for each channel. Route detailed clinical discussions to an approved, access-controlled channel or another appropriate method.
• Assess and document the security risks of the chosen channels. Encryption is an addressable Security Rule specification—not a blanket requirement in every situation—and the organization must evaluate it and document its decision. See HHS guidance on Security Rule encryption.

How should staff verify recipients and obtain patient consent?

Before sending a message, staff should verify the intended recipient and the destination number using the center’s approved workflow. Confirm numbers at intake, check for updates when a patient reports a change, and use an independent verification step before sending sensitive content. Do not include PHI in a test message used to confirm a number.

Record the patient’s communication preferences, including any request to use another number or method, and provide a practical way to update those preferences or opt out of routine texts. The Privacy Rule requires covered providers to accommodate reasonable requests for confidential communications. See HHS guidance on confidential communications and patient messages.

Distinguish a patient’s communication preference or operational consent from a HIPAA patient authorization. Appointment reminders are part of treatment and may be made without an authorization under HIPAA. Other uses or disclosures may require a valid HIPAA authorization, depending on their purpose. See HHS guidance on appointment reminders and its overview of when an authorization is required.

• Explain what kinds of texts the center may send and what patients should avoid sharing by text.
• Confirm caregiver or representative authority before sending a patient’s information to someone else.
• Record communication preferences and any applicable authorization in the designated system; do not treat general consent as a substitute for a required HIPAA authorization.

What safeguards should a texting policy require?

The Security Rule calls for reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI. The particular measures depend on the center’s circumstances and risk analysis. HHS identifies access control, audit controls, authentication, and transmission security among the Security Rule’s technical safeguards. See the HHS Security Rule summary.

• Use individual staff accounts and role-based access rather than shared logins; remove access promptly when a staff member changes roles or leaves.
• Require device passcodes or other appropriate access protections, automatic locking, and a process for reporting a lost or stolen device.
• Limit message content to what is appropriate for the channel and purpose. Avoid placing sensitive details in message previews or group conversations.
• Use platform settings and procedures that support appropriate authentication, access review, and activity monitoring.
• Include texting systems and devices in the center’s Security Rule risk analysis and risk-management process. HHS explains that the risk analysis covers ePHI the organization creates, receives, maintains, or transmits. See HHS guidance on Security Rule risk analysis.
• Review vendors and subcontractors that may handle PHI. If a texting vendor is a business associate because it handles PHI on the center’s behalf, establish a written business associate agreement (BAA). A vendor that merely sells software without access to PHI may not be a business associate. See HHS business associate guidance and its software vendor FAQ.

How should staff handle misdirected texts and suspected breaches?

Tell staff to report a misdirected text, lost device, suspicious access, or other possible exposure promptly through the center’s incident-reporting process. They should notify the designated privacy or security contact, preserve relevant details, and avoid sending another message that reveals additional PHI. The response team—not an individual staff member acting alone—should coordinate containment and any appropriate follow-up with the unintended recipient.

The center should assess whether an impermissible use or disclosure is a breach under the Breach Notification Rule. An impermissible disclosure is generally presumed to be a breach unless an exception applies or a risk assessment demonstrates a low probability that PHI was compromised. That assessment considers the information involved, who received it, whether it was viewed or acquired, and how the risk was mitigated. See the HHS Breach Notification Rule guidance.

• Document what happened, when it was discovered, the information involved, who received it, containment steps, and the assessment outcome.
• Escalate promptly so the center can determine whether notification is required. If a breach of unsecured PHI requires individual notice, the covered entity must provide it without unreasonable delay and no later than 60 days after discovery; other reporting obligations may also apply.
• Include a process for notifying the center when a business associate discovers a breach involving the center’s PHI, consistent with the BAA and applicable requirements.

What documentation and staff training should the policy include?

Keep a written policy that names the approved channels, permitted message types, recipient-verification steps, patient-preference workflow, security safeguards, vendor review process, and incident escalation contacts. Document decisions from the risk analysis, relevant approvals, staff access reviews, incidents and their outcomes, and changes to the policy or technology.

The Privacy Rule requires training for workforce members as necessary and appropriate to their functions, while the Security Rule requires security awareness and training. Tailor training to the staff member’s duties: for example, distinguish clinical messaging from appointment reminders, show how to verify a recipient, and explain how to report an error. Retrain when relevant policy or workflow changes take effect. See HHS workforce training guidance and the Security Rule summary.

HIPAA documentation requirements generally call for required Security Rule documentation to be retained for six years from its creation or the date it was last in effect, whichever is later. This does not by itself set a universal six-year retention period for every patient text; define clinical-record handling and retention in accordance with applicable requirements and center policy. See HHS documentation guidance.

A practical policy protects PHI by defining approved channels, verifying recipients, limiting unnecessary message content, securing devices and accounts, and giving staff a clear path to report incidents. Review these procedures as the center’s technology, operations, or risks change.

FAQs

Can a myelodysplastic syndromes center text patients about appointments?

Yes. HHS says appointment reminders are considered part of treatment and may be sent without HIPAA authorization. Use a verified number, respect reasonable requests for confidential communications, and keep routine texts appropriately limited. See HHS appointment-reminder guidance.

Is standard SMS appropriate for sharing PHI?

HIPAA does not categorically prohibit electronic messages, but the center must protect ePHI and assess the channel’s risks. Standard SMS may expose message content or reach the wrong person, so the center should follow its documented risk-based policy and generally use an approved, protected channel for detailed clinical information.

What should staff do after sending PHI to the wrong number?

Report the incident promptly to the center’s designated privacy or security contact, preserve the relevant details, and follow the center’s containment instructions. The center should assess whether the disclosure is a breach and whether notification is required; staff should not decide on their own that notification is or is not necessary. See the HHS Breach Notification Rule guidance.

Does a texting vendor need a business associate agreement?

Generally, a vendor that creates, receives, maintains, or transmits PHI on the center’s behalf as a business associate needs a written BAA. A vendor that only sells software and has no access to the center’s PHI may not be a business associate. Confirm the vendor’s role and data access before using the service. See HHS business associate guidance.