Texting clients: HIPAA rules and consent
Short answer: Yes, therapists can text clients under HIPAA when they weigh the risk, use reasonable safeguards and respect the client's preference. Regular texts are unencrypted, so warn clients of the risk, document their choice, keep texts to scheduling and reminders, and move anything clinical to a secure messaging tool covered by a business associate agreement.
HIPAA does not ban texting clients. It requires you to consider the risk, use reasonable safeguards and respect the client's preferences. Standard text messages are not encrypted, so many therapists limit them to simple logistics. For the full program list, see the HIPAA checklist for therapists. For what belongs in the record when a message is clinical, see psychotherapy notes vs progress notes.
What does HIPAA allow for texting?
Covered entities may communicate with clients by unencrypted channels if the client has been warned of the risks and still prefers that method. You should document the discussion.
What is the safer practice?
- Ask clients how they want to be contacted.
- Explain that regular text messaging is not secure.
- Limit texts to scheduling and reminders.
- Avoid clinical content, diagnoses or sensitive details in texts.
- Use a secure messaging tool for anything more.
What belongs in a texting policy?
- Which staff may text clients
- Approved devices and apps
- What can and cannot be sent by text
- How consent is recorded
- How messages are saved to the record
- What happens if a client sends a crisis message
How should you handle crisis texts?
Tell clients that texts may not be monitored in real time. Give them crisis resources, including the 988 Suicide & Crisis Lifeline (opens in a new tab).
How can you reduce risk on devices?
- Do not use personal numbers without a plan.
- Lock phones and enable remote wipe.
- Do not store client numbers under identifying names if the phone could be seen by others.
- Delete messages after saving what belongs in the record.
When do you need a business associate agreement?
If you use a messaging platform that stores messages, you need a business associate agreement.
Frequently asked questions
Can I text appointment reminders?
Usually yes, with client agreement and minimal details.
Do texts become part of the record?
Anything that is part of care should be documented in the record.
Is secure messaging required?
HIPAA does not name a specific app. Secure messaging with a business associate agreement is the lower-risk option for clinical content.
How Sealed helps
Sealed gives therapists a HIPAA program with ready policies, including communications. Start your risk analysis.
Sources and check date
Checked October 11, 2026.
- HHS OCR guidance on communicating with patients electronically, such as by email (opens in a new tab)
- 45 CFR 164.312 (opens in a new tab) and 164.530 (opens in a new tab) (safeguards and policies)
- Substance Abuse and Mental Health Services Administration resources on 988 (opens in a new tab)
This is general information, not legal advice.