Pediatric Aerodigestive Center Texting Policy Checklist for Protecting PHI

A texting policy for a pediatric aerodigestive center should protect patient privacy without delaying care. Use this checklist to define approved messaging channels, limit what staff send, verify parents’ or guardians’ authority, and ensure clinically important communications reach the medical record.

HIPAA does not categorically prohibit texting patient information. The center must assess the risks and apply appropriate safeguards to protected health information (PHI), including electronic protected health information (ePHI). Treat the practices below as policy recommendations to review against applicable state law, clinical obligations, and organizational requirements.

Which secure messaging safeguards should the center require?

Set rules based on the center’s risk analysis, not a vendor’s claim that a product is “HIPAA compliant.” The Security Rule requires administrative, physical, and technical safeguards for ePHI, including access controls, audit controls, and transmission security. Encryption is an addressable implementation specification: the center should assess whether it is reasonable and appropriate for its risks and document its decisions. See the HIPAA Security Rule administrative safeguards and technical safeguards.

• Require an organization-approved messaging system for workforce communications containing PHI. Do not use ordinary SMS for clinical details unless the center’s risk assessment and safeguards support that use.
• Grant access according to job duties, use individual accounts, and promptly remove access when a staff member changes roles or leaves.
• Require strong authentication and device locks. Consider multifactor authentication where appropriate to the risk.
• Use a system that can record and review message activity, identify users, and support incident investigation.
• Establish procedures for lost devices, misdirected messages, unauthorized access, and other security incidents.

These controls implement the broader Security Rule requirement to assess risks to ePHI and reduce them to a reasonable and appropriate level. The rule is technology-neutral; it does not designate one specific texting application or require a particular product. For guidance on mobile access to ePHI, see HHS guidance on mobile devices and cloud services.

What information is appropriate to send by text?

Limit each message to the information needed for its purpose. Names, phone numbers, appointment details, diagnoses, treatment instructions, and identifiable images can be PHI when linked to care. A patient’s or family’s preferred communication channel does not remove the center’s responsibility to safeguard information it sends.

• Use the minimum detail needed for the message, such as a neutral appointment reminder when clinical specifics are unnecessary.
• Send detailed clinical information only through a channel approved for that purpose and limited to authorized recipients.
• Avoid placing sensitive diagnoses or treatment details in lock-screen previews, group chats, or messages to unverified numbers.
• Use a secure portal or another approved channel for lengthy care plans, records, or information that needs to be reviewed and tracked.
• Provide an appropriate alternative if a patient or personal representative requests confidential communications by another reasonable means or at another location.

HHS permits providers to communicate electronically with patients when they apply reasonable safeguards, such as checking addresses and limiting the information sent. Patients also have a right to request reasonable alternative means or locations for confidential communications. See HHS guidance on electronic communications with patients.

How should staff verify recipients and document consent?

Before sending PHI, verify the number, the intended recipient, and that the recipient is authorized to receive the information. A number listed in an old message thread or provided by another family member should not automatically be treated as current or correct.

• At enrollment or when contact details change, confirm the number and identify whether it belongs to the patient, a parent, a guardian, or another caregiver.
• Record the patient’s communication preferences, any limits on messages, the preferred contact person, and the date those details were confirmed.
• Use a brief identity check before disclosing clinical details in a new or uncertain conversation.
• Do not treat a relative’s possession of a phone as proof of authority to receive the child’s PHI.

HIPAA does not impose a universal requirement to obtain a separate texting-consent form before every message. The center should document preferences and any permission it obtains as part of its policy, while continuing to apply safeguards. For minors, a parent or guardian is often the child’s personal representative, but state law and exceptions—including certain care a minor may obtain confidentially—can affect who may receive information. Confirm authority for the specific communication rather than assuming that every parent can access all information. See HHS guidance on personal representatives and minors and HHS guidance on confidential communications.

How can devices and patient images be protected?

Allow workforce access to ePHI on mobile devices only under documented safeguards. Use managed devices or an approved bring-your-own-device program with clear security requirements, including screen locks, encryption where appropriate to the risk, software updates, and a way to remove organizational access if a device is lost or a worker leaves.

• Require staff to lock devices when unattended and prevent unauthorized household members from accessing work messages.
• Set rules for message previews, automatic backups, shared cloud accounts, and syncing to personal computers or tablets.
• Do not save patient images to a personal photo library or forward them through consumer messaging or social media applications.
• Receive, review, and transfer clinically relevant images through an approved workflow that connects them to the correct patient record.
• Remove temporary copies according to the center’s retention policy after confirming that required information is safely stored in the approved record system.

Patient images should be handled as PHI when they identify a patient or are connected to that patient’s care. If an image arrives through an unapproved channel, staff should follow the center’s intake, documentation, and secure-deletion procedures; they should not assume that deleting it from one device removes every copy. HHS explains that mobile access to ePHI requires appropriate safeguards on both the device and any cloud service involved. See HHS mobile-device guidance.

What vendor agreements and security controls are needed?

If a messaging vendor creates, receives, maintains, or transmits PHI on the center’s behalf, determine whether it is a business associate and, if so, execute a business associate agreement (BAA) before using the service for PHI. A BAA should define permitted uses and disclosures, require safeguards, address incident reporting, and cover subcontractors that handle PHI. See HHS business associate contract provisions.

Review the actual service and contract—not just marketing materials. Confirm how the service handles message access, audit records, encryption, storage, backups, support access, data export, and deletion. Identify how the vendor will notify the center of security incidents and help the center retrieve or dispose of PHI when the relationship ends. HHS states that covered entities using cloud services to maintain ePHI need a BAA with the cloud service provider and must otherwise comply with the HIPAA Rules. See HHS guidance on HIPAA and cloud computing.

How should clinically necessary messages and texted orders be documented?

Move clinically meaningful communications into the appropriate medical record when they affect assessment, treatment, follow-up, or care coordination. Record the relevant content, date and time, participants, clinical decisions, and any action taken. Apply the center’s medical record authentication procedures so the record shows who documented or confirmed the information.

Do not rely on a message thread as the only record of a clinical decision. Use the center’s approved order-entry process and follow its rules for verbal, written, or electronic orders. CMS guidance for hospitals and critical access hospitals (CAHs) states that texting patient orders is prohibited regardless of the platform, while allowing certain patient-information texts through a secure platform. The guidance is specific to hospitals and CAHs, so determine whether it applies to the center’s setting and follow any stricter organizational or applicable requirements. See CMS guidance on texting patient information and orders.

How should messages be retained or deleted?

Set a written retention schedule for messages, images, and related audit records. Preserve clinically relevant communications in the designated medical record when required by the center’s policy or applicable law, and retain other message data only as long as justified by its purpose, legal obligations, and operational needs. Apply secure deletion procedures to approved copies and temporary files, including copies held by vendors, while accounting for backups and legal holds.

Do not confuse the retention of clinical records with HIPAA’s retention requirements for compliance documentation. HIPAA does not set a general medical-record retention period; state law and other requirements may apply. Separately, the Security Rule requires covered entities and business associates to retain required Security Rule documentation for six years from creation or the date it was last in effect, whichever is later. The center must safeguard PHI for as long as it maintains it, including during disposal. See HHS guidance on medical-record retention and 45 CFR § 164.316.

A sound policy links every step: use an approved channel, disclose only what is needed, verify the recipient, protect devices and images, document clinical decisions, and retain or delete messages under defined rules.

FAQs.

Can staff send patient information by ordinary SMS?

HIPAA does not categorically ban ordinary SMS, but the center must apply reasonable safeguards to PHI and assess the risks of the channel. Because ordinary SMS may not provide the access controls, auditability, or other protections the center needs, its policy should generally require an approved secure messaging method for clinical information. See the HHS guidance on electronic patient communications and the HIPAA Security Rule technical safeguards.

What consent should be obtained before texting a parent or guardian?

Confirm and document the contact preference, the number, the recipient’s identity, and the recipient’s authority to receive information about the child. A separate texting-consent form is not a universal HIPAA requirement, but the center may use one to explain its communication practices and document preferences. A parent or guardian is often a minor’s personal representative, but state law and exceptions for certain minor-consented care can affect access. See HHS guidance on minors and personal representatives.

Do texted clinical orders need to be added to the medical record?

Follow the center’s approved order-entry and documentation procedures; clinically meaningful communications should be recorded in the appropriate medical record. CMS guidance prohibits texting patient orders in hospitals and CAHs regardless of platform, so those facilities should use the required order-entry process instead. The center should determine whether that specific guidance applies to its setting and comply with applicable organizational and legal requirements. See CMS texting guidance.

How should patient images received by text be stored or deleted?

Use the center’s approved secure intake process to verify the patient, transfer clinically relevant images into the designated record system, and document them as required by policy. Avoid saving images to personal photo libraries, shared consumer accounts, or unapproved backups. Delete temporary copies only under the center’s retention and secure-disposal procedures, after checking that required information has been preserved and no legal hold applies.