HIPAA Compliant Texting: Which Messaging Apps Sign a BAA

Texting patients can be HIPAA compliant when the messaging vendor signs a business associate agreement (BAA) and you apply reasonable safeguards, since HHS says providers may "communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so" (HHS). Twilio, Weave, Podium, RingCentral and Google Voice sign a BAA, generally or on specific plans, while Apple's license rules out iMessage for PHI and Meta's terms say the WhatsApp Business Platform is not HIPAA compliant, per Curve's BAA Directory. When those texts lead to a booking, Curve Compliance credits it to the original ad click, strips PHI before data reaches an ad platform and signs its own BAA on every plan.

Book a call. If texts are where patients confirm and book, Curve Compliance keeps those bookings tied to the ads that drove them: it credits each booking to the original ad click and removes PHI before anything is sent to an ad platform. Curve's team does the setup. Book a call with Curve.

Is texting HIPAA compliant?

HIPAA does not ban texting patients. HHS says "The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so." Its examples of safeguards include "checking the e-mail address for accuracy before sending." HHS also says "the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications between health care providers and patients," while asking providers to limit "the amount or type of information disclosed through the unencrypted e-mail" (HHS).

Two more rules apply. HHS says covered entities "will want to ensure that any transmission of electronic protected health information is in compliance with the HIPAA Security Rule requirements" (HHS), and the Security Rule lists "Transmission security" with "Encryption (Addressable)" among its safeguards (45 CFR 164.312). And a vendor that stores your texts is a business associate: HHS says a cloud service that keeps ePHI for a covered entity "is a business associate under HIPAA" (HHS). See what a BAA is.

Which messaging apps sign a BAA

Each row comes from the vendor's own words, quoted in Curve's BAA Directory or on the vendor's page, with the date Curve last checked it. Each linked name opens its Directory entry. Rows are grouped by BAA status, not ranked.

App	Signs a BAA?	Conditions, per the vendor	Checked	Source
Weave	Yes	A Business Associate Addendum supplements Weave's Terms of Service with each client	Sep 29, 2026	Weave BAA
Podium	Yes	Covered entities and business associates agree to Podium's BAA under its terms	Sep 29, 2026	Podium Legal
RingCentral	Yes	Paying covered entity customers, for the services RingCentral lists	Sep 29, 2026	RingCentral HIPAA
Twilio	On specific plans	Twilio Security Edition or Enterprise Edition, for HIPAA-eligible products	Sep 29, 2026	Twilio Docs
Google Voice	On Google Workspace	Licensed users managed in Google Workspace only	Oct 5, 2026	Google
Google Chat	On Google Workspace	On Google's list of Workspace services included in its BAA; see the Google Workspace entry	Oct 26, 2026	Google
Microsoft Teams	On business plans	Office 365 Commercial or GCC; the BAA comes by default through Microsoft's Data Protection Addendum	Oct 5, 2026	Microsoft Learn
Slack	On specific plans	An Enterprise-level Slack plan with the Slack HIPAA Enabled SKU	Sep 29, 2026	Salesforce
Attentive	No	Its Content Policy lists Protected Health Information as content its programs may not contain	Sep 29, 2026	Attentive
WhatsApp	No	Meta's terms say the WhatsApp Business Platform is not HIPAA compliant	Oct 5, 2026	Meta terms
iMessage	No	Apple's iOS and iPadOS license bars covered entities and business associates from using it with PHI	Oct 5, 2026	Apple license
Signal	No public statement	No BAA or HIPAA statement found on Signal's terms, privacy policy or support pages	Oct 5, 2026	Directory entry
Telegram	No public statement	No BAA or HIPAA statement found in Telegram's terms, FAQ or privacy policy	Oct 5, 2026	Directory entry

A BAA is not the whole job. Twilio says "Signing a BAA alone does not make your application HIPAA-compliant" (Twilio). Two vendors rule PHI out in their own terms: Meta says "the WhatsApp Business Platform is not HIPAA compliant" (WhatsApp), and Attentive's Content Policy lists "Any Protected Health Information as defined by HIPAA" among content its programs may not contain (Attentive; see is Attentive HIPAA compliant). For more on patient messaging tools, see is Weave HIPAA compliant and is Podium HIPAA compliant.

When a patient asks for a different channel

Patients have a say in how you reach them. Under 45 CFR 164.522(b), "A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations" (45 CFR 164.522). HHS's example: a provider "should accommodate an individual's request to receive appointment reminders via e-mail, rather than on a postcard, if e-mail is a reasonable, alternative means" (HHS).

It works the other way too. If unencrypted messages are unacceptable to a patient who asks for confidential communications, HHS says "other means of communicating with the patient, such as by more secure electronic methods, or by mail or telephone, should be offered and accommodated." When a patient starts the exchange, the provider "can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual," and can explain the risks and "let the patient decide whether to continue e-mail communications" (HHS). HHS's FAQ speaks of e-mail, so before applying it to texts, talk to your counsel.

SMS marketing is a different question

Everything above concerns care messages: reminders, follow-ups, answers to patient questions. Promotional texts bring in HIPAA's marketing rules and federal and state texting laws. See SMS marketing rules for healthcare and HIPAA marketing authorization and ad tracking.

Texting and your ad tracking

Texts often sit between the ad click and the booking: a form triggers a text, the patient replies, staff send a booking link. Two things matter for your ads. Keep message content out of anything sent to an ad platform, since Curve's BAA Directory lists Meta and Google Ads as not signing a BAA. And make sure the booking that follows still counts toward the ad that started it, which means keeping the ad click from the first visit. See which ad platforms sign a BAA and booked appointment attribution.

How Curve Compliance helps

Curve Compliance ties the bookings that follow your texts to the ads that started them, under the BAA it signs on every plan. When a patient books through a scheduler such as IntakeQ, Calendly, Acuity or Jane App, Curve keeps the ad click, and bookings made days later still match. Outcomes from booking systems, CRMs and call tracking reach Curve through incoming webhooks, and Curve credits each to the original ad click. Curve Forms adds HIPAA-hosted intake and lead forms with ad attribution attached, and can redirect to a booking page after submit.

Curve sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: HHS, FAQ on e-mail with patients; HHS, audio-only telehealth guidance; HHS, cloud computing guidance; eCFR 45 CFR 164.312, 164.506, 164.508, 164.514 and 164.522; Google, HIPAA compliance on Google Cloud and Google Workspace; SimplePractice; IntakeQ; vendor BAA pages as linked in the table, via Curve's BAA Directory.

Frequently Asked Questions

Is it HIPAA compliant to text patients?

Yes, when the messaging vendor signs a BAA and you apply reasonable safeguards, since HHS says providers may communicate electronically with patients "provided they apply reasonable safeguards when doing so" (HHS). Twilio, Weave, Podium, RingCentral and Google Voice sign a BAA, generally or on specific plans (BAA Directory).

Which messaging apps are HIPAA compliant?

None is compliant by itself, but some sign a BAA. Per each vendor's own terms, Weave, Podium and RingCentral sign one; Twilio, Slack, Google Voice, Google Chat and Microsoft Teams do on specific plans or accounts; iMessage and WhatsApp are not offered under one; and Signal and Telegram publish no BAA statement.

How can I make my cell phone HIPAA compliant?

Use a messaging app whose vendor signs a BAA, and apply the Security Rule's safeguards to the phone, such as "Unique user identification," "Automatic logoff" and "Encryption and decryption (Addressable)" (45 CFR 164.312). HHS says "Covered entities using telephone systems that transmit ePHI need to apply the HIPAA Security Rule safeguards to those technologies" (HHS).

Are phone calls HIPAA compliant?

They can be. HHS says "HIPAA covered entities can use remote communication technologies to provide telehealth services, including audio-only services, in compliance with the HIPAA Privacy Rule"; the Security Rule does not apply to a traditional landline but does apply to VoIP and mobile calls, and a phone vendor needs a BAA only when it is more than a mere conduit, for example when it stores recordings or transcripts (HHS). See HIPAA compliant phone systems.

Does SimplePractice have text messages?

Yes, for reminders. SimplePractice says its telehealth software "will even send automated text and email appointment reminders" (SimplePractice), and its BAA is agreed when you create your account (Directory entry). IntakeQ offers "automated SMS and voice reminders" (IntakeQ).

What information can be shared without violating HIPAA?

De-identified information falls outside HIPAA: "Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information" (45 CFR 164.514). For PHI, "a covered entity may use or disclose protected health information for treatment, payment, or health care operations" (164.506), and other uses and disclosures need a valid authorization unless the Privacy Rule permits them (164.508); see HIPAA TPO and the 18 identifiers.

Can Venmo be HIPAA compliant?

Venmo publishes no BAA statement: Curve's BAA Directory found none in Venmo's User Agreement or Privacy Statement (Directory entry). Without a BAA, keep PHI out of Venmo payments and notes.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, credits bookings to the original ad click, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. Your texting tool handles the conversation. Curve Compliance credits the bookings that follow to the ads that drove them, with PHI stripped before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.