Educational · US · HIPAA · TCPA
HIPAA Compliant Texting: What Plastic Surgery Practices Can Send, and What Needs Consent
Two federal regimes sit over every text your practice sends a patient, and they ask different questions.
- HIPAA does not ban texting. It expects reasonable safeguards and the minimum necessary detail in anything sent over an unencrypted channel.
- Treat your texting vendor as a business associate. No signed business associate agreement, no clinical messages.
- The TCPA decides whether you could send the text at all. Promotional texts generally need prior express written consent; health care messages sit in a separate category.
- Run care and marketing as two programs with separate lists, separate consent and opt outs honoured across both.
- Reminders are worth keeping. A Cochrane review found text reminders lifted attendance compared with no reminder.
Your front desk probably texts patients every day. Appointment confirmations, preoperative reminders, a quick "how are you feeling?" two days after a procedure. Patients answer texts far faster than voicemail, so the habit makes sense.
The problem is that two separate federal regimes sit over every one of those messages, and most practices only think about one of them. HIPAA governs what health information you put in the text and how you protect it. The Telephone Consumer Protection Act governs whether you were allowed to send the text at all. A message can pass one test and fail the other.
Here is how both work in practice, and how to set up a texting program your compliance lead will actually sign off.
Is texting patients allowed under HIPAA?
Yes. HIPAA does not ban texting, and it never has. What it demands is reasonable safeguards around any protected health information you send.
The clearest statement comes from the HHS Office for Civil Rights, which answered the question for email. It confirmed that the Privacy Rule allows providers to communicate electronically with patients as long as reasonable safeguards are applied, and that it does not prohibit unencrypted messages for treatment communications. It pairs that with a caution: limit the amount and type of information in anything that is not encrypted, and keep the Security Rule in view for any electronic transmission.
That guidance was written about email, and the same logic is widely applied to standard SMS. The practical takeaway for your team is simple. A text that says "Reminder: your appointment is Tuesday at 10am" carries little risk. A text that says "Reminder: your abdominoplasty follow up is Tuesday" discloses a procedure. The first is a scheduling message. The second is protected health information traveling over an unencrypted channel to a phone that may be shared, left without a passcode or synced to a family tablet.
What does HIPAA compliant texting actually require?
It requires three things working together: the right platform, the right content and the right record.
The platform
If a texting vendor stores or transmits patient information for your practice, treat it as a business associate. That means a signed business associate agreement before a single message goes out. Many consumer tools and general marketing SMS platforms will not sign one. If yours will not, it should not be anywhere near clinical messages.
The content
Keep standard SMS to the minimum necessary. Names, dates and times are usually enough. Procedure names, photos, medication instructions and anything about results belong in an encrypted patient portal or a secure messaging app, with the text itself doing nothing more than prompting the patient to log in.
The record
Patients have a right to ask you to contact them by a particular method, and HHS expects providers to accommodate reasonable requests. The flip side is documentation. If a patient asks you to text them detailed information over a standard channel, warn them of the risk, let them decide, and note the decision in their file.
Does the TCPA apply to texts from medical practices?
Yes, and this is where most plastic surgery practices get caught. The TCPA is a telecommunications law, not a health privacy law, and the Federal Communications Commission has long treated texts as calls for the purposes of its robocall rules. If your texting platform sends messages automatically, the TCPA applies to it.
The rules split messages into two broad groups.
Promotional texts, the kind that advertise a treatment, a new injectable or an open evening, generally need prior express written consent before you send them to a mobile number. A signature on an intake form that mentions "communications" rarely meets that standard. The consent needs to be clear that the patient agrees to receive marketing texts from your practice at that number.
Health care messages are treated differently. The FCC's rules carve out calls and texts that deliver a health care message from a HIPAA covered entity or its business associate, which need prior express consent rather than written consent. That carve out does not stretch to cover promotions. A text that starts as a postoperative check and ends with "and book your next filler appointment for 15% off" has become a marketing message.
The same rules say you cannot force patients to opt out through one exclusive method. If a patient replies "stop," or tells your receptionist they want the texts to end, treat that as a revocation.
How do you separate care messages from marketing messages?
Run them as two programs. That one structural decision prevents most of the problems we see.
Your care program covers appointment confirmations, preoperative instructions, postoperative check ins and anything else tied to treatment the patient has already booked. It runs through a platform with a signed business associate agreement, uses minimal content and relies on the consent the patient gave when they handed over their number for scheduling.
Your marketing program covers anything promotional: new services, seasonal campaigns, event invitations and reactivation offers. It needs its own written consent capture, its own opt out handling and a record of when and how each patient agreed. HIPAA adds its own layer here. Under HHS guidance, a communication that meets the Privacy Rule's definition of marketing needs the patient's authorization, with limited exceptions, and any promotion paid for by a third party such as a device manufacturer must say so in that authorization. Some messages about your own services fall outside the definition, so get the line drawn by someone qualified rather than guessing.
Keep the lists separate in your software. A patient who opts out of promotions should still get their surgery reminders, and a patient who never agreed to promotions should never land in a campaign because someone exported the wrong segment.
Do appointment reminder texts reduce no shows?
They do, and that is why it is worth getting the compliance right rather than switching the whole program off.
A Cochrane review of mobile phone messaging reminders found that text reminders improved attendance compared with no reminders, with attendance of 78.6% in the text reminder groups against 67.8% where no reminder was sent. The review also found text reminders worked about as well as phone call reminders while costing less.
For a surgical practice, a missed consultation is an empty slot that a coordinator spent time filling. A missed postoperative review is a clinical risk as well as a scheduling one. Reminders earn their place. They just need to be built properly.
What should a compliant texting setup look like?
Start with an audit of every automated message your practice sends today, including the ones your booking software sends by default. Most practices are surprised by how many exist.
Then work through this order. Confirm every vendor that touches patient numbers has a signed business associate agreement. Strip procedure names and clinical detail out of standard SMS templates. Split your contact lists into care and marketing, and check that every number on the marketing list has written consent on file. Make sure "stop" and similar replies are honored automatically across both programs, in line with the FCC's consent revocation rules. Finally, write the policy down and train the front desk, because the riskiest texts are usually the manual ones a well meaning staff member sends from a personal phone.
None of this is complicated. It is the kind of thing that only becomes expensive when nobody owns it.
Not sure whether your patient texting would hold up to a review? Talk to our team and we will walk through it with you.
Frequently asked questions
Can I text patients from my personal phone?
It is risky and hard to defend. Personal phones rarely have the access controls, audit trails or backups your practice needs, and messages stay on the device when a staff member leaves. Route all patient texting through a practice platform.
Is iMessage or WhatsApp HIPAA compliant?
Encryption alone does not make a tool compliant. You also need a vendor willing to sign a business associate agreement and controls over who can access the messages. Consumer messaging apps generally do not offer that arrangement.
Do I need consent to send postoperative check in texts?
These are treatment communications, so they sit in the health care message category rather than marketing. You still need the patient to have given you their number for that purpose, and you must honor a request to stop.
What if a patient texts us photos of their incision?
Once received, those images are part of the patient's health information and need to be stored and protected like any other clinical record. Move them into your records system and remove them from any device that is not secured.
How long should we keep texting consent records?
Keep them for as long as you keep sending messages to that patient, and then for as long as your records policy and state law require. If a consent is ever challenged, the record is your only evidence.
This article is general information only and is not legal or regulatory advice. It summarises the HIPAA Privacy and Security Rules, HHS guidance and the FCC's rules under the Telephone Consumer Protection Act as published at the time of writing, and does not address state law, professional board rules or carrier and platform policies, which can impose further requirements. Regulatory guidance changes, and how it applies depends on your circumstances. Confirm your obligations with a qualified adviser before relying on any of it.
References
- Federal Communications Commission. (2024, January 25). FCC fact sheet: Strengthening consumer protections against unwanted robocalls. docs.fcc.gov
- Gurol-Urganci, I., de Jongh, T., Vodopivec-Jamsek, V., Atun, R., & Car, J. (2013). Mobile phone messaging reminders for attendance at healthcare appointments. Cochrane Database of Systematic Reviews. pubmed.ncbi.nlm.nih.gov
- Restrictions on Telemarketing, Telephone Solicitation, and Facsimile Advertising, 47 C.F.R. Part 64, Subpart L. ecfr.gov
- U.S. Department of Health and Human Services. (n.d.). Marketing. hhs.gov
- U.S. Department of Health and Human Services, Office for Civil Rights. (2013). Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients? hhs.gov
About the author
Dr Sandy Adel · Content Strategist, ContentClicks
Sandy is a practising dentist with a Bachelor of Dentistry from Alexandria University and over eight years of clinical experience in general dentistry. She brings that firsthand clinical knowledge directly to her writing, so the content she produces for dental and medical audiences is accurate at the clinical level before it is optimised for anything else.
Before joining ContentClicks she spent more than four years writing dental copy for practices across the Australian, US and UK markets, including two years as a dental copywriter at one of Australia's specialist healthcare marketing agencies. She writes about ethical marketing, realistic patient expectations, and the gap between what clinics promise and what biology can guarantee. More from Sandy.
