Travel Medical Insurance Carrier Texting PHI Policy Checklist

Use this checklist to set rules for sending protected health information (PHI) by text, verify who may receive it, and protect messages on staff devices and vendor platforms. First, confirm whether the specific travel medical insurance product and entity are subject to HIPAA: coverage and organizational structure matter, so do not assume every travel insurance product is a HIPAA-covered health plan. See HHS guidance on covered entities and health plans.

Which texting platforms and device controls protect PHI?

HIPAA does not endorse a particular texting app or require a product labeled “HIPAA-compliant.” Instead, covered entities and business associates must assess risks to electronic protected health information (ePHI) and implement reasonable and appropriate safeguards. A platform’s label alone does not establish that the carrier’s full process meets those requirements. Review HHS’s HIPAA Security Rule summary.

Include these checks in your platform and device review:

• Document how messages are sent, received, stored, backed up, and deleted, including what appears in lock-screen previews and notifications.
• Use unique user accounts, appropriate access permissions, strong authentication, and prompt access removal when a staff member changes roles or leaves.
• Assess encryption, audit logging, device security, remote lock or wipe capabilities, and protections for message attachments as part of your organization’s risk analysis.
• Set rules for personal devices, shared phones, screenshots, forwarding, and copying PHI into other apps.

The Security Rule requires access controls and audit controls for systems that maintain ePHI, as well as technical safeguards for ePHI transmitted over electronic networks. Encryption is an important risk-management safeguard, but it does not replace the broader risk analysis or other required protections. See the HHS Security Rule summary.

How should consent and communication preferences be documented?

Record the insured person’s preferred phone number, permitted communication channel, safe times to contact them, and any request for confidential communications. Confirm a number before sending PHI, and provide a way to update or stop text communications. These are prudent policy controls; HIPAA does not require a separate written authorization solely because you communicate with the individual about their own information.

Explain the privacy limits of the channel you offer and provide a reasonable alternative when appropriate. HIPAA gives individuals a right to request confidential communications by alternative means or at alternative locations. A health plan must accommodate a reasonable request when the individual clearly states that disclosure could endanger them. See HHS guidance on confidential communications.

Keep a record of the person’s preferences, the date they were confirmed or changed, and any opt-out or confidential-communication request. Do not treat a routine texting preference as permission to disclose PHI to another person.

When does a texting vendor need a business associate agreement?

Determine what each vendor does with PHI. A vendor that creates, receives, maintains, or transmits ePHI on the carrier’s behalf will generally be a business associate, and the parties generally need a HIPAA business associate agreement (BAA). This may include a messaging platform that stores messages, manages a messaging service, or provides access to message content. HHS explains that a cloud provider can be a business associate even if it stores only encrypted ePHI and cannot view it; see HHS guidance on HIPAA and cloud computing.

A narrow conduit exception may apply when a service provides only transmission, with no storage other than temporary storage incident to transmission. Do not assume every phone or messaging vendor qualifies: assess the actual service and whether it retains or accesses PHI beyond transient transmission. See HHS guidance on the conduit exception.

When a BAA is required, confirm that it limits permitted uses and disclosures, requires appropriate safeguards, addresses incident reporting and subcontractors, and sets out what happens to PHI when the service ends. HHS provides sample BAA provisions.

What information can staff send by text and how should recipients be verified?

Set message rules around the purpose of the communication and the minimum information needed. For routine exchanges, staff should avoid sending full clinical records, detailed diagnoses, claim documents, or unnecessary identifiers when a short notification or secure alternative will do. The minimum necessary standard generally applies to uses and disclosures, but it does not apply to disclosures to the individual or to disclosures made under a valid authorization. See HHS’s minimum necessary guidance.

Before sending PHI, verify the recipient and their authority when required. Use an established number or a verification process appropriate to the sensitivity of the information; do not rely on a name displayed in a messaging app or on an unconfirmed number. HHS’s HIPAA audit protocol describes verification requirements for a person requesting PHI when their identity or authority is not known.

• Use neutral wording in lock-screen notifications, such as asking the insured person to call a known number.
• Check the number and message recipient before sending, especially after a number change or when responding to an incoming message.
• Use a secure portal or another approved channel for lengthy records or sensitive attachments.
• Limit access to messages to staff whose job duties require it.

How should text messages be documented, retained, and disposed of?

Define which business communications must be entered into the claim or case record, who is responsible for doing so, and how to capture relevant context, timestamps, sender and recipient details, and any decisions or follow-up. Preserve messages that are needed to support claim handling, customer service, an investigation, or another applicable legal or contractual obligation.

Do not confuse a record-retention schedule with a requirement to keep every message forever. HIPAA’s Privacy Rule does not set a general medical-record retention period; state law and other applicable requirements may govern. HIPAA does require safeguards for PHI for as long as it is maintained, including during disposal. See HHS guidance on medical-record retention.

Set and document retention and deletion rules for message histories, exports, backups, and devices. Apply secure disposal procedures when PHI is no longer required, and preserve relevant messages when a legal hold or investigation applies. HIPAA-required documentation has its own retention rules; do not assume that those rules set the retention period for every medical record or text message.

What safeguards and training should apply to staff devices?

Write a device policy for both organization-owned and permitted personal devices. It should cover screen locks, device encryption where appropriate, operating-system updates, remote lock or wipe, lost-device reporting, secure storage, and restrictions on forwarding PHI to personal email or consumer apps. HHS allows mobile-device use when appropriate safeguards protect ePHI on the device and in the cloud; see HHS guidance on mobile devices and cloud ePHI.

Train staff on approved channels, recipient verification, minimum-necessary practices, confidential-communication requests, emergency escalation, and how to report a suspected disclosure or lost device. Training should reflect the carrier’s actual policies and procedures. Maintain the training and policy documentation required for your organization; do not treat a training certificate as proof that the organization itself is HIPAA-compliant.

Include a clear incident process: staff should promptly notify the designated privacy or security contact, preserve relevant information, and avoid trying to conceal or independently resolve a misdirected message. The covered entity or business associate must assess whether an impermissible use or disclosure of unsecured PHI is a reportable breach. HHS describes the required risk assessment and notification framework in its Breach Notification Rule guidance.

When is authorization required to disclose an insured person’s PHI to another person?

A text to the insured person and a text to someone else are different disclosures. Before sending PHI to a family member, travel companion, employer, or other third party, determine whether the disclosure is permitted under HIPAA or whether a valid HIPAA authorization is needed. A person’s relationship to the insured does not, by itself, establish authority to receive PHI.

HIPAA permits a health plan to share PHI directly relevant to a person’s involvement in the individual’s care or payment for care with a family member, close personal friend, or other person identified by the individual, subject to the rule’s conditions. If the individual is present, give them an opportunity to agree or object when practicable. In certain circumstances when the individual is unavailable, the covered entity may use professional judgment to determine whether a limited disclosure is in the individual’s best interest. See HHS guidance on disclosures to family and friends.

For a disclosure that is not otherwise permitted or required by the Privacy Rule, obtain a valid written HIPAA authorization before sending the information. It must identify the information, the person or class authorized to disclose it, the recipient, the purpose, and an expiration date or event, along with the required statements and signature. See HHS guidance on authorizations.

As a final policy check, confirm that your product’s HIPAA status has been assessed, vendor roles and agreements are documented, message content and recipients are limited, and staff know how to protect, record, retain, and report text communications. Keep the process under review as products, vendors, and communication practices change.

FAQs

Can a travel medical insurance carrier text PHI to an insured person?

It may be permissible when the carrier is subject to HIPAA and uses reasonable safeguards to communicate with the individual. HIPAA does not categorically prohibit electronic communication, but staff should verify the number, limit information when appropriate, follow the person’s communication preferences, and use an approved process for sensitive details. See HHS’s Privacy Rule guidance. Whether a particular travel medical insurance product is subject to HIPAA depends on its facts and classification.

When is a signed authorization needed to text an insured person’s PHI to someone else?

A signed authorization is generally needed when the disclosure to another person is not otherwise permitted or required by HIPAA. A limited disclosure to someone involved in the individual’s care or payment may be allowed under the conditions in 45 C.F.R. § 164.510(b), such as when the individual agrees or does not object when given an opportunity. See HHS’s guidance on disclosures to family and friends.

What should staff do if an unencrypted text containing PHI is sent by mistake?

Report it promptly through the organization’s incident process. Staff should not delete evidence or decide on their own whether the incident is a breach. The responsible privacy or security team should assess the facts, mitigate potential harm, document its analysis, and determine whether notification is required under the Breach Notification Rule. See HHS breach-notification guidance.

Should urgent or emergency information be sent by text?

Do not rely on text as the sole channel for a time-critical emergency. Follow the carrier’s emergency escalation procedure and use an appropriate direct channel, such as a phone call or emergency services, when immediate action is needed. If a text is used as a supplement, verify the recipient, keep the message focused, and document the follow-up. HIPAA’s emergency-related permissions concern whether certain disclosures are allowed; they do not make texting a reliable emergency-response channel.