Texting patients and Business Associate Agreements

Yes, with conditions

Practices can text patients. HIPAA does not ban text messages, and plenty of offices send appointment reminders by text every day. What HIPAA cares about is how patient information is handled: who can see it, how it is protected, and whether the outside companies that handle it for you have agreed to protect it too.

That last part is what a Business Associate Agreement, or BAA, is for.

What a BAA is

Under HIPAA, a business associate is an outside company that creates, receives, keeps, or sends protected health information on behalf of a covered entity, such as a medical or dental practice. The BAA is the contract between them. In it, the vendor agrees to safeguard that information, use it only for the work it was hired to do, and tell the practice about breaches.

Your practice likely has several already: with your practice-management or EHR vendor, your billing service, and perhaps your IT provider.

Does a texting vendor need one?

Usually, if the texts involve patient information. An appointment reminder can count even with no clinical detail in it. A name and a mobile number tied to an appointment at your office show that this person is your patient. An appointment list uploaded to a texting system carries the same information, at scale.

So if a service sends reminders from your appointment list, or holds conversations with patients, expect it to be handling protected health information, and ask about a BAA before you sign up. If a vendor says it does not need one, ask it to explain why in writing, and show the answer to whoever advises your practice.

What a BAA does not do

A signed BAA is one piece of a compliance program. It does not make a practice compliant, and no vendor can do that for you. The practice still owns:

• its risk analysis and written policies
• staff training, including what may and may not go in a text
• who has access to which systems, and removing access when someone leaves
• how it handles patient requests about communication, such as a patient who asks not to be texted
• its plan for a lost phone, laptop, or password

A BAA also covers only the vendor’s own system. If staff keep texting from personal phones, those messages sit outside every agreement the practice has.

Keep texts lean

The less a text says, the less there is to protect. A reminder needs a first name, a day and time, and the office name. It does not need the provider’s specialty, the reason for the visit, or anything about results or prescriptions.

SMSWell’s templates are written this way by default. Staff can still type anything into a conversation, which is why a clear house rule matters as much as the template.

Which SMSWell plans include a BAA

A signed BAA comes with the Practice plan ($169 a month per location) and the Group plan ($329). The Front Office plan ($89) does not include one. If your practice needs a BAA for patient texting, choose Practice or Group.

Read the agreement the way you would read any other vendor’s. Questions about it go to support@smswell.com.

Reading the agreement

BAAs tend to look alike, but they are worth a read. When one arrives, look for these:

• what the vendor may use patient information for, and that it is limited to the service
• how quickly the vendor must tell you about a breach, and how
• whether the vendor’s own subcontractors are held to the same terms
• what happens to the information when the agreement ends

If any of these is missing or unclear, ask before you sign. Keep the signed copy with your other vendor agreements, where you can find it in a year.

Questions to ask any texting vendor

• Will you sign a BAA, and on which plans?
• Where are message logs kept, and for how long?
• Does each staff member get their own login, so we can see who sent what?
• What happens to our messages and consent records if we cancel?
• Do your templates keep clinical detail out by default?
• Is there a contract, and how long is it?

Expect plain answers, and treat a vague one as a warning.