What HIPAA SMS is
ZentryVoice HIPAA SMS is two-way texting between a practice and its patients, sent from the practice’s own number rather than a staff member’s cell or a separate app number. Every conversation is encrypted in transit and at rest, stored next to the patient’s calls, faxes and voicemails, and covered by the Business Associate Agreement (BAA) that ZentryVoice countersigns at signup. HIPAA SMS costs $15 per practice per month.
HIPAA itself never says “no texting”. The HHS Office for Civil Rights has confirmed that the Privacy Rule permits providers to communicate electronically with patients as long as reasonable safeguards are applied (45 CFR 164.530(c)), and the Security Rule (45 CFR 164.312) sets the technical safeguards for electronic PHI: access control, audit controls, integrity, authentication and transmission security. HIPAA SMS is texting built to meet those safeguards, with a vendor that has signed a BAA.
“10DLC” stands for 10-digit long code: an application-to-person (A2P) messaging channel in which businesses sending texts from ordinary local numbers must register their brand and use case with The Campaign Registry (TCR) before carriers deliver the traffic. ZentryVoice registers your practice through Telnyx, its carrier, during activation.
How it works
From activation to a patient replying “C” to confirm, this is the path a message takes.
- 1BAA firstThe BAA is sent for e-signature as the second step of activation. The portal will not send a text until it is signed.
- 210DLC registrationZentryVoice attaches a messaging profile to your number and registers your brand and campaign with The Campaign Registry through Telnyx. Brand vetting typically takes 1–7 business days.
- 3Consent capturedPatients opt in when they text the practice first or agree to receive texts at intake. Every message can be stopped by replying STOP.
- 4Send from the practice numberStaff text from the desktop app, mobile app or portal. Template chips cover the routine cases: appointment reminder, running 10 minutes late, please call us back, your results are ready.
- 5Logged in the timelineReplies arrive on the practice number, in the patient’s conversation, marked “HIPAA encrypted”. Unread counts show on every device.
- 6AuditedWho sent what, when and from which device is written to the practice’s immutable audit log.
What makes it different from texting on a cell or a consumer app
Most practices already text; the question is whether those texts are in the record, encrypted and covered by a BAA.
| Capability | Personal cell or consumer app | ZentryVoice HIPAA SMS |
|---|---|---|
| Sender number | A staff cell or an app-assigned number | The practice number patients already call |
| Business Associate Agreement | Usually none; consumer apps do not sign BAAs | Countersigned at signup, before the first text |
| Encryption | Carrier SMS in clear text | Encrypted in transit and at rest |
| Record | On one person’s phone | In the patient timeline next to calls and faxes, visible to the whole team |
| Carrier registration | Unregistered; messages may be filtered as spam | 10DLC brand and campaign registered with The Campaign Registry |
| Opt-out handling | Manual, if remembered | STOP honored automatically and recorded |
| Templates | Retyped each time | Reminder, running late, call back, results ready |
Compliance notes: consent, minimum necessary and carrier rules
Two rulebooks apply to practice texting. HIPAA governs the content and handling of PHI. The HHS minimum necessary standard (45 CFR 164.502(b)) asks you to limit what you disclose to what the purpose needs; for texting that means “Your results are ready, please call us” rather than the results themselves. HHS guidance on unsecured PHI treats encryption consistent with NIST SP 800-111 (data at rest) and NIST SP 800-52 (data in motion) as rendering PHI unreadable to unauthorized people, which is the standard ZentryVoice designs to.
The second rulebook is telecom. The Telephone Consumer Protection Act (TCPA), enforced by the FCC, requires consent for automated texts, and the CTIA Messaging Principles and Best Practices (2023) set the industry expectations carriers enforce: clear opt-in, an easy STOP, and no deceptive content. 10DLC registration through The Campaign Registry is how carriers verify that a sender and its use case are legitimate before delivering messages at volume.
- Get and record consent before texting; a patient texting you first is consent for that conversation.
- Honor STOP immediately; ZentryVoice does this automatically and logs it.
- Send the minimum necessary: reminders, callbacks and confirmations, not diagnoses or results.
- Keep texts inside the practice account so they are in the record and covered by the BAA.
- Train staff that personal-phone texting of PHI is outside the practice’s safeguards.
Consumer messaging apps and carrier SMS from a personal phone are not covered by a BAA. If a vendor will not sign one, it should not be handling PHI.
Pricing and plan facts
HIPAA SMS is an add-on at $15 per practice per month on top of $20 per seat, with 10DLC registration handled by ZentryVoice. Month-to-month, 30-day trial, cancel anytime. The BAA is included and countersigned at signup.
Frequently asked questions
Is texting patients HIPAA compliant?
It can be. HHS permits electronic communication with patients when reasonable safeguards are in place. Texting PHI is compliant when the messages are encrypted, access-controlled, logged, limited to the minimum necessary, and the vendor has signed a Business Associate Agreement.
Is Google Voice HIPAA compliant for texting?
Consumer Google Voice is not offered under a BAA and should not be used for PHI. Some paid Google Workspace editions can be covered by Google’s BAA for specific services; check whether the specific service and plan are listed in that BAA before using it for patient texts.
Is iMessage or WhatsApp HIPAA compliant?
No. Apple and Meta do not sign Business Associate Agreements for iMessage or WhatsApp, and messages live on personal devices outside the practice’s record and audit controls.
What is 10DLC and do I need to register?
10DLC is the carrier framework for business texting from ordinary 10-digit numbers. Senders register a brand and a campaign with The Campaign Registry; unregistered traffic is filtered or blocked. ZentryVoice registers your practice through Telnyx during activation.
Do I need patient consent to send appointment reminder texts?
Yes. The TCPA and CTIA guidelines expect prior consent for automated business texts, and HHS expects reasonable safeguards. Capture consent at intake or when the patient texts first, and always honor STOP.
Can I text from my practice phone number instead of a separate number?
Yes. ZentryVoice sends and receives texts on the same practice number patients call, so one number appears on your website, reminders and caller ID.
How much does HIPAA-compliant texting cost?
ZentryVoice HIPAA SMS is $15 per practice per month, added to the $20 per seat plan, with the BAA and 10DLC registration included.
Sources
- FAQ 570 — Does HIPAA permit health care providers to use e-mail to discuss health issues with patients?· HHS Office for Civil Rights
- 45 CFR 164.312 — Technical safeguards (HIPAA Security Rule)· eCFR (Office of the Federal Register)
- Minimum Necessary Requirement (45 CFR 164.502(b), 164.514(d))· HHS Office for Civil Rights
- Guidance to render unsecured PHI unusable, unreadable or indecipherable (encryption per NIST SP 800-111 and 800-52)· HHS Office for Civil Rights
- The Campaign Registry — 10DLC brand and campaign registration· The Campaign Registry
- Messaging Principles and Best Practices· CTIA(2023)