Virtual Reality Therapy Vendor Texting PHI Policy Checklist

Virtual reality therapy can involve clinical notes, patient identifiers, voice recordings, headset telemetry, and other sensitive data. A sound texting policy should address both the messages clinicians send and the data the VR platform creates, stores, or transmits.

Use this checklist to evaluate a vendor’s role, contract terms, texting safeguards, and XR data practices. HIPAA obligations depend on the parties’ roles and the information involved; this article is a practical guide, not legal advice.

When Is a VR Therapy Vendor a Business Associate?

A VR therapy vendor is generally a business associate when it performs a service for a HIPAA-covered entity—or for another business associate—and creates, receives, maintains, or transmits PHI in doing so. For example, a vendor that hosts identifiable therapy sessions, stores session records, or sends PHI-containing messages on a provider’s behalf may meet that definition. HHS’s Business Associate guidance explains the role-based test.

Selling software alone does not automatically make a vendor a business associate if the vendor does not access PHI. But access is not limited to staff reading information: a cloud service provider that maintains ePHI for a covered entity can be a business associate even when it stores only encrypted data and cannot decrypt it. HHS’s Business Associate FAQs discuss both points.

• Identify which party is the covered entity, which vendor or vendors act as business associates, and which subcontractors may create, receive, maintain, or transmit PHI.
• Map how session content, patient identifiers, clinician messages, headset telemetry, and support logs move among the provider, VR platform, messaging service, and cloud providers.
• Determine whether each service is performed on behalf of the covered entity or business associate, rather than assuming that a vendor’s product label or “HIPAA-ready” marketing decides its status.
• Before allowing a business associate to handle PHI, put a compliant business associate agreement (BAA) in place. A vendor’s general security statement is not a substitute for the required agreement.

What Must a Business Associate Agreement Cover?

A BAA must define permitted and required uses and disclosures of PHI, require appropriate safeguards, set reporting duties for impermissible uses and disclosures, and address the business associate’s responsibilities when the relationship ends. It must also require appropriate protections for relevant subcontractors. Review the agreement against HHS’s sample business associate agreement provisions.

For VR therapy and texting, make the agreement specific enough to govern the actual services. HIPAA establishes core contract requirements; the detailed operational terms below are practical safeguards to negotiate, not a claim that every term is prescribed word-for-word by federal law.

• Specify which PHI the vendor may handle, the services it may provide, and whether it may send or receive messages containing PHI.
• Restrict use of PHI to the contracted services and other uses permitted by the agreement and law. Address secondary uses—such as product analytics, advertising, model training, or research—explicitly rather than relying on broad, unclear permissions.
• Require appropriate administrative, physical, and technical safeguards for electronic protected health information, including the organization’s documented decisions about encryption in transit and at rest.
• Require the vendor to bind subcontractors that handle PHI to applicable restrictions and safeguards, and to provide information about relevant subcontractors and material service changes.
• Set a clear process for cooperation with access, amendment, accounting, and other applicable covered-entity obligations.
• Specify return or destruction of PHI at termination where feasible, and how protections and restricted uses continue if return or destruction is infeasible.
• Provide audit or assessment rights, evidence of safeguards, incident contacts, and termination rights for material violations.
• Set a contractual deadline for reporting suspected security incidents and breaches that is shorter than the federal outer limit when the organization needs time to investigate and meet its own duties.

How Should Organizations Assess Texting Risks and Select Safeguards?

HIPAA does not categorically prohibit electronic communication for treatment, but organizations must use reasonable safeguards and protect ePHI under the Security Rule. HHS says electronic treatment communications are permitted when reasonable safeguards are applied, and the Security Rule requires protections for ePHI sent over electronic networks. HHS’s guidance on provider-to-provider electronic exchange and its guidance on sending ePHI over email or the Internet explain these principles.

Before approving texting, include the VR platform and messaging workflow in the organization’s HIPAA Security Rule risk analysis. The analysis should identify where ePHI is stored, received, maintained, or transmitted; assess relevant threats and vulnerabilities; and guide risk-management decisions. HHS’s risk analysis guidance describes these steps.

• Identify what a message may contain: patient name, appointment details, diagnosis, treatment instructions, session link, or an alert that reveals participation in therapy.
• Assess the whole path: composing, sending, delivery, notifications, recipient devices, backups, message history, vendor support access, and deletion.
• Choose an organization-approved messaging method that limits access to authorized clinicians, supports appropriate authentication, and protects messages in transit. Evaluate whether encryption in transit is reasonable and appropriate for the identified risks.
• Where ordinary SMS is not an approved or adequately protected method, direct staff to an approved secure messaging system or another authorized channel. Do not assume that a short message is safe merely because it omits detailed clinical notes.
• Verify the recipient and use the minimum necessary information for the task. For example, a neutral notification may be preferable to a lock-screen preview that displays a patient’s diagnosis or therapy details.
• Document the risk analysis, selected safeguards, and decisions about addressable Security Rule specifications. Encryption is addressable: the organization must assess it and document its decision, implementing it when reasonable and appropriate or using an appropriate alternative as allowed by the Rule. HHS explains the encryption specification.
• Train clinicians and support staff on approved channels, recipient verification, device handling, misdirected messages, and escalation of suspected incidents.

Which VR Data May Qualify as PHI?

Data is not PHI simply because it comes from a VR headset. HIPAA applies when identifiable health information is created, received, maintained, or transmitted by a covered entity or business associate in the relevant role. The content and context matter: an identifiable record of a person’s therapy participation, symptoms, treatment response, or clinical session may be PHI when handled by a covered entity or business associate.

VR systems may generate names, account or device identifiers, session timestamps, clinician notes, audio, movement or gaze measurements, and performance data. Assess whether these details identify a person directly or in combination with other information, and whether they relate to health care. Do not assume that removing a name alone makes a dataset de-identified.

HHS’s HIPAA de-identification guidance lists biometric identifiers, including finger and voice prints, among identifiers that must be removed for the Safe Harbor method. It also recognizes Expert Determination as another method. HHS’s de-identification guidance does not specifically classify every kind of gaze or motion data; assess whether the particular data identifies, or could reasonably identify, an individual in its context.

• Ask whether voice recordings are retained, whether a voiceprint is derived, and whether either is connected to an identifiable patient or clinical record.
• Ask whether gaze, movement, or interaction data is linked to an account, session, device, or treatment record—and whether its detail could distinguish a person.
• Inventory the identifiers that appear in messages, session exports, analytics, logs, and support tickets, not only in the main clinical record.
• Confirm that any claim of HIPAA de-identification uses one of the recognized methods and is not based only on removing names or replacing them with a code.

What Security Controls Should the Checklist Include?

Use the HIPAA Security Rule risk analysis to select safeguards for the organization’s actual VR and messaging environment. The Security Rule sets standards and required safeguards, while some implementation specifications are addressable and must be assessed and documented. HHS’s Security Rule summary describes administrative, physical, and technical safeguards.

• Access control: Require individual accounts where feasible, role-based access, prompt removal of access when duties change, and controls against unauthorized headset or message access.
• Authentication: Use appropriate login protections for clinician accounts and administrative tools; consider stronger authentication for remote access and privileged accounts.
• Encryption and transmission: Assess encryption in transit and at rest for messages, session records, backups, and headset storage. Document the risk-based decision and any reasonable alternative safeguards.
• Audit controls: Keep and review logs of access to ePHI, message activity, administrative changes, exports, and relevant VR session data.
• Integrity and availability: Protect records against improper alteration or destruction, and plan for backup, recovery, and authorized access during outages.
• Device protections: Evaluate shared-headset sign-out, local caching, automatic lock, lost-device response, software updates, wireless connections, and secure disposal or reconfiguration.
• Notification and display settings: Limit what appears in message previews, alerts, and wearable displays; assess whether messages persist on personal devices or are copied to consumer backups.
• Vendor and subcontractor safeguards: Confirm which parties can access, store, or transmit ePHI, and ensure relevant subcontractors have appropriate contractual protections.
• Documentation and review: Keep the risk analysis and policy decisions current when the vendor, headset, messaging feature, data flows, or security environment changes.

How Should Vendors Report Incidents and Breaches?

The BAA and incident-response policy should distinguish a security incident from a reportable breach. Require the vendor to promptly escalate suspected incidents—such as misdirected messages, lost headsets, unauthorized access, or exposed credentials—so the covered entity can assess the facts. The BAA must address reporting of impermissible uses or disclosures and security incidents; set a practical contractual deadline and the information the vendor must provide.

For a breach of unsecured PHI at or by a business associate, HIPAA requires the business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is an outside federal deadline, not a recommended investigation window; the parties can agree to faster reporting so the covered entity has time to meet its own obligations. HHS’s Breach Notification Rule guidance states the business associate’s reporting duty.

• Require initial notice through a monitored contact method as soon as the vendor discovers a suspected incident involving PHI, followed by updates as facts become available.
• Require available details on what happened, discovery time, systems and messages involved, categories of PHI, affected or potentially affected individuals, containment actions, and the vendor’s investigation contact.
• Require preservation of relevant logs and evidence, cooperation with the covered entity’s investigation, and support for required notifications and mitigation.
• Specify who makes the breach determination and who communicates with affected individuals, regulators, and other parties. A vendor’s internal label should not prevent the covered entity from independently assessing its obligations.
• Track incident response through containment, investigation, remediation, and documentation, including the reason for any delay in notice.

How Should Policies Govern XR Data Use and Retention?

Set a clear purpose and retention period for each category of XR data, including session recordings, voice data, gaze or movement measurements, messages, logs, and backups. Explain whether the data is needed for treatment, operations, safety, troubleshooting, or another approved purpose, and limit collection and access accordingly.

HIPAA’s Privacy Rule does not generally set a medical-record retention period, and HHS says the HIPAA Rules generally do not require a business associate to keep ePHI beyond the time it provides services. A BAA must address return or destruction of PHI at termination where feasible; if that is infeasible, the agreement must continue protections and limit further use or disclosure. Check applicable state law and other contractual or regulatory requirements before setting a deletion schedule. HHS’s retention FAQ and its business associate retention FAQ explain these limits.

• Document what XR data is collected, why it is needed, where it is stored, who can access it, and when it will be deleted or returned.
• Set separate retention rules for active records, temporary files, logs, backups, and data held by subcontractors; define how deletion is verified when required.
• Prohibit unapproved secondary uses and disclosures, including reuse for product development, analytics, advertising, or AI training unless the use is permitted and specifically governed by the agreement and applicable law.
• Specify what happens to records at contract termination, including export format, transition assistance, return or destruction, backup schedules, and any data that cannot feasibly be destroyed.
• Review the XR data retention schedule when clinical workflows, vendor services, laws, or the kinds of data collected change.

In practice, a strong policy connects the vendor’s business associate status, BAA, texting workflow, risk analysis, security controls, incident reporting, and XR data retention rules. Reassess those controls as the platform and its data flows evolve.

FAQs.

Can a VR therapy vendor text PHI to a clinician?

Yes, when the vendor is authorized to handle the PHI, the arrangement is properly governed by a BAA when required, and the organization’s approved texting method and safeguards protect the information. Verify the recipient, limit message content, assess the communication method in the HIPAA Security Rule risk analysis, and follow the organization’s policy. HIPAA does not categorically prohibit electronic treatment communications, but it does require applicable safeguards. HHS’s provider communication guidance explains this principle.

What should a business associate agreement require from a VR therapy vendor?

At a minimum, the BAA should set permitted uses and disclosures, require appropriate safeguards, address reporting of impermissible uses and disclosures, govern subcontractor protections, support applicable covered-entity duties, and require return or destruction of PHI at termination when feasible. For a VR vendor, also specify which session and XR data it may handle, how approved messaging works, how incidents are escalated, and what uses of the data are prohibited or require additional authorization. HHS’s BAA provisions describe the required contract elements.

Can voice or gaze data collected by a VR platform be PHI?

It can be, depending on whether the information relates to health care, identifies or could identify an individual, and is handled by a covered entity or business associate in that role. HHS lists voice prints as biometric identifiers for Safe Harbor de-identification; it does not specifically classify all gaze data. Assess whether voice, gaze, or movement data is linked to a patient or session and whether it can identify the person in context. HHS’s de-identification guidance lists the identifiers relevant to Safe Harbor.

When must a vendor report a suspected breach of PHI?

Require prompt contractual reporting of suspected incidents so the covered entity can investigate. For a breach of unsecured PHI at or by a business associate, HIPAA requires notice to the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The parties can set a shorter contractual deadline; the 60-day limit is the federal outside limit, not a reason to wait. HHS’s breach notification guidance explains the rule.