If parents text your office about fevers, school forms, and unpaid balances, each of those topics can count as protected health information (PHI) under HIPAA. Wrong details sent from the wrong phone can turn a helpful reply into a privacy problem.
HIPAA allows providers to text families once the right safeguards are in place. Pediatric offices face a few extra hurdles here, since one child can have several parents, guardians, or caregivers on file.
When you know the rules, HIPAA-compliant text messaging lets your team answer parents quickly and keep every message tied to the right child and guardian.
What Is HIPAA-Compliant Text Messaging?
HIPAA-compliant text messaging is texting with patients or families that follows the HIPAA Privacy Rule and Security Rule whenever a message includes PHI.
You'll need a messaging tool with access and audit controls and a signed business associate agreement (BAA) from the vendor.
HHS allows providers to message patients electronically with reasonable safeguards.
Standard texts aren't considered secure at rest, since they sit on phones that may lack strong passwords or facial recognition. Each clinic has to decide how it will protect texts, so texting policies can differ from one office to the next.
In an AAP Pediatric Research in Office Settings (PROS) study of 10 pediatric practices in 10 states, clinicians and staff backed text reminders for vaccines and visits, though they named privacy and confidentiality as their main concerns.
What Does HIPAA Require Before You Text PHI?
Before your team texts PHI, check that these four HIPAA requirements are covered:
- A signed BAA: A texting vendor that stores or manages PHI for your clinic counts as a business associate, so their BAA has to be in place before any PHI goes through the vendor's tool.
- A texting risk analysis: Your security risk analysis should cover texting, including where texts are stored, which phones can open them, and what could go wrong if a phone is lost.
- An encryption decision: HIPAA describes encryption as "addressable." Use it when it's reasonable. If it isn't, document why and use an equivalent alternative where one is reasonable.
- Honoring channel requests: A patient, or a parent acting for their child, can ask for a different channel, and your clinic must accommodate reasonable requests.
For unencrypted emails, HHS suggests limiting how much health information you send, and the same caution makes sense for plain texts.
If a parent still wants results by plain text, explain the risks, offer a more secure option, and note their choice in the chart.
Some practices go further and have every family sign a texting or email waiver, then send PHI by plain text or email by default. HHS does let a family choose unencrypted delivery after being warned of the risks, and the practice then isn't responsible for that message in transit. But that covers the family's own request, not a blanket policy. The practice still has to protect PHI on its own phones and systems, still needs a BAA with any vendor that stores the messages, and still owns the mistake when a text goes to the wrong number. In pediatrics, the parent who signed the waiver is also not always the only person reading that phone.
Which Texts Can You Send Over Regular SMS?
The texts you can usually send over regular SMS are visit reminders and other messages that leave out health details.
The HIPAA Privacy Rule lets providers contact patients by mail, by phone, or "in some other manner," and HHS recommends limiting those messages to what's needed to confirm a visit.
A plain text can share the visit date, time, and location, ask the family to confirm or reschedule, or include a link to a secure form or message.
Unless a family has asked for plain texts, keep these details out:
- Diagnoses, strep results, or lab values
- Medication names or dose changes
- Developmental or depression screening scores
- Photos of a rash, cut, or swollen ankle
- Balances tied to a specific service, such as "$40 left for Ronya's asthma follow-up"
Text reminders also give a small lift to vaccine uptake (a relative increase of about 7% for early childhood vaccines in a 2024 meta-analysis; Louw et al., Vaccines, 2024), so a clear message before each vaccine visit can help.
If your clinic is working to reduce no-shows, compliant reminders are a natural place to start.
Why Is Texting Harder in Pediatric Clinics?
Texting is harder in pediatrics because the person reading the text is often someone other than the patient.
A parent, guardian, or other adult acting as a parent is usually the child's personal representative, meaning they can make health decisions and see records for the child. State law and court orders can change who holds that role.
Common pediatric traps include:
- A parent who lost decision-making rights through a court order but is still on file
- Siblings who share one caregiver number, so details can land in the wrong child's thread
- A teen who consented to their own care under state law, and a parent who may not have a right to those details
- A reminder for a teen's confidential visit sent to the parent's number on file, which can reveal the visit before the teen chooses to
- A foster or kinship caregiver who brings the child in while a state agency holds legal custody, so what they can receive depends on the placement paperwork
Teen privacy is already hard to protect in patient portals. In a study across three children's hospitals (Ip et al., JAMA Network Open, 2021), guardians accessed an estimated 64% to 76% of adolescent portal accounts that sent messages. Shared family phone numbers can carry the same risk.
Before staff hit send, match the thread to the correct patient and an authorized guardian. Links for digital patient intake need that same match.
7 Best Practices for HIPAA-Compliant Texting
These seven habits can help your team protect PHI when texting families:
1. Write a One-Page Texting Policy
HIPAA already requires written security policies, and a short texting policy puts those rules where staff will actually read them.
Spell out what staff can text, from which system, and when to call instead. Include who answers after hours.
2. Take PHI Off Personal Phones
Plain texts on a personal phone sit outside your clinic's systems. If staff must use their own devices, require a secure app with a BAA, a passcode, and remote wipes.
Some practice platforms, especially those built for cash-pay and direct primary care practices, send texts and emails as plain SMS and email once a patient opts in, then archive them to the chart. Archiving a text doesn't secure it: the message still traveled as plain SMS and still sits on the phones at both ends.
3. Send a Secure Link for Anything Clinical
Keep clinical details out of the text itself and send a link instead, such as: "You have a new message from Clarence Pediatrics. Tap to view." Contactless patient intake works the same way, with forms sent to families as a text link.
For families who don't have a smartphone or reliable internet, offer a phone call as a backup.
4. Verify the Number and the Guardian
Confirm phone numbers and guardian roles at every check-in, and flag custody changes the same day. For a teen's confidential visit, send reminders to the teen's own number.
5. Record Family Preferences
Log every request for plain texts, plus the risk warning you gave. Update the record when a parent changes their mind.
6. Turn On MFA and Auto-Lock Now
HHS has proposed Security Rule changes that would make encryption and MFA mandatory, with limited exceptions. The rule was still a proposal as of October 2026.
Auto-lock is already an addressable safeguard under the current rule, and turning on MFA now gets your team used to it before any final rule.
7. Train and Audit Twice a Year
Every six months, spot-check real message threads and retrain staff on what you find.
In 2026, HHS raised the calendar-year penalty cap to $2,190,294 for violations of the same HIPAA requirement. Build these checks into your regular pediatric office workflow.
Support HIPAA-Compliant Text Messaging With Develo
Safe texting in pediatrics depends on knowing which child a message is about, which adult can see it, and what a teen has kept private. That's much harder to manage when reminders, intake, and messages run on separate tools.
Develo is the AI-native pediatric operating system built solely for independent pediatric practices. It unifies charting, billing, practice management, and family engagement in one system.
It replaces decades-old EMR systems and the mix of generic tools that slow down documentation. And using fewer tools also means fewer BAAs to track for HIPAA-compliant text messaging.
Develo keeps texts to logistics and links, and keeps two-way conversations in the family portal, where they can be saved to the chart:
- Automated reminders: Visit and payment reminders go out by text. Details without PHI, like the visit date and time, are easy to read in the text itself, and anything with PHI opens only after the family signs in to the family portal. For a teen's confidential visit, the practice can mark the reminder to go to the teen instead of a guardian.
- Text-link intake: Families get a text with a link to update demographics and insurance, sign forms, and complete developmental and behavioral screens on their phones, without having to download an app or create a login. Scored screen results flow right into the visit.
- Family messages: Parents can send messages with images and documents to your team through the family portal, and those images and documents save to the child's chart automatically. That keeps clinical questions off staff phones and out of email, where families and practices often trade pictures and files.
- Portal access without setup: Family portal access runs off the same demographics as the chart, so there's no separate portal account to set up for each child or caregiver. Staff can also text a family a direct link to the family portal at any time.
- Guardian roles per child: Guardian and guarantor relationships are linked to each child, so each caregiver's access follows their role for that child, and self-scheduling blocks a caregiver without authority from booking.
- Communication preferences: Staff record each family's preferred language, and practices can set up their own ways to document other communication preferences, such as a parent's request for plain texts.
- Adolescent confidentiality: Teens get confidential visit summaries and parents get limited ones, both created automatically. Access to records updates automatically as guardian roles change and as a teen reaches the age thresholds the practice sets.
- Security: Develo signs a BAA with every practice. Staff logins support MFA, both on-site and remotely, and tamper-resistant audit logs record access to patient records, so your twice-yearly audit has data to check.
Book a demo to walk through Develo's family engagement tools with your clinic's own workflows in mind.
Frequently Asked Questions
Is Texting Patients a HIPAA Violation?
No, texting patients isn't a HIPAA violation on its own, as long as your clinic protects any PHI in the message. A violation can happen when PHI reaches the wrong person or passes through a vendor that hasn't signed a BAA.
Can You Text Visit Reminders Without a Secure App?
Yes, you can often text visit reminders without a secure app, since HIPAA lets providers reach patients by mail, phone, and other channels. Stick to scheduling logistics, and leave out why the child is being seen.
Do You Need a BAA With Your Phone Carrier?
No, you don't need a BAA with a phone carrier that only transmits your texts, because HHS treats transmission-only services as conduits. A texting platform that stores your messages is different and does need a BAA.
Can Parents Text Health Questions to Your Clinic?
Yes, parents can text health questions to your clinic, since HIPAA governs how your clinic handles PHI and doesn't limit what families send. For email, HHS says providers can assume a patient who writes in first is comfortable with that channel, but you can still steer families toward a more secure option.
What Happens If a Staff Member Texts PHI by Mistake?
A text with PHI sent to the wrong person is presumed to be a breach unless your clinic can show a low probability that the information was compromised. Your documented risk assessment looks at what was sent and who got it. It also weighs whether the recipient opened the text and how well the risk was mitigated.
.avif)
.avif)
