Tool category

HIPAA compliant texting? Messaging apps that sign a BAA

Phone, text and messaging platforms for practices that sign a BAA — what's included in the price, how the agreement is put in place, and what to watch for when texting patients. A BAA is necessary for a vendor that handles PHI, but it does not by itself make texting patients secure or appropriate — that also depends on your own safeguards and policies.

Products 2Criteria 2Commissions None

Patient texting and messaging at a glance

Texting patients under HIPAA needs two things: a messaging vendor that signs a BAA for the channels you use, and rules about what you send — standard SMS to a patient's phone is not encrypted end to end. We compare 2 products in Patient texting and messaging. 2 sign a Business Associate Agreement (OhMD, Spruce Health). Every value links to the vendor's own documentation and shows when it was checked.

Sign a BAA	OhMD, Spruce Health
Products compared	2
Compared on	BAA without a sales process, BAA on entry-level team plans

2 more facts

Commissions	None — no vendor pays us
Facts checked since	2026-10-06

Compare the providers ↓

Comparison

Alphabetical. No vendor pays us for listings, rankings or referrals — methodology.

Product	Signs a BAA	BAA without a sales process	BAA on entry-level team plans
OhMD Website	Yes	Not verified	Yes
Spruce Health Website	Yes	Yes	Yes

Found an outdated or wrong fact? Report it

What to check before you choose

What the BAA covers: Check which channels the agreement lists — app messages, SMS, MMS, voicemail, call recording — and on which plan.
Texts to patients' own phones: Standard SMS is not encrypted end to end. If a patient prefers text messages, tell them the risk, record their choice, and keep messages to what is needed — an appointment time, not a diagnosis. Phone carriers that only carry the message are conduits, not business associates, so the protection has to come from what you send.
Staff-to-staff messages: Clinical messages between staff go through the platform covered by the BAA, not personal texting apps.
Lost or replaced phones: An app PIN, remote sign-out or wipe, and no message previews on lock screens (our recommendation; device rules in 164.310(d)).
Keeping what belongs in the record: Messages that inform care decisions may belong in the patient record. Check how messages are kept, exported and deleted.

Common mistakes

Using personal cell numbers for clinical texts because it is faster.
Appointment reminders that name the service or condition.
Assuming a BAA makes texting patients secure — it covers the vendor, not what you choose to send.

How we compare

BAA without a sales process: You can put the BAA in place yourself — it is included in standard terms or accepted in account settings — rather than requesting it and waiting for approval.
BAA on entry-level team plans: The BAA is available on the vendor's entry-level business or team plan, not only on enterprise tiers.