HIPAA-Compliant Texting for DPC and Concierge Practices (2027 Guide)

Can Doctors Text Patients Under HIPAA?

Yes. HHS says the HIPAA Privacy Rule lets covered health care providers communicate electronically with patients, provided they apply reasonable safeguards when they do. For a DPC or concierge practice, that usually means texting through a vendor that signs a business associate agreement (BAA), keeping each message to what the patient needs, and saving clinical conversations to the chart. Personal phones and consumer apps are where most of the risk lives, because the practice has no BAA, no shared inbox and no record of what was said.

Texting is a big part of why patients join a direct primary care or concierge practice in the first place. They want to reach their doctor without a phone tree, and most physicians who open a membership practice want that too. This guide covers what HHS actually says, why the BAA matters more than encryption, how the main texting platforms compare in October 2026, and a short office policy you can adapt. It is general information, not legal advice, so run your final policy past a healthcare attorney.

What Does HHS Say About Texting and Emailing Patients?

HHS has not published a separate rule for texting. Its guidance on email with patients is the closest official answer, and it applies the same principles to any electronic message. The FAQ says the Privacy Rule does not prohibit unencrypted email for treatment-related communication, but providers should take precautions such as checking the address before sending and limiting how much information goes into an unencrypted message. It also reminds practices that electronic protected health information has to be handled in line with the Security Rule.

The same FAQ makes two points that matter for texting:

• Patients can ask for alternative means. Under 45 CFR 164.522(b), a patient can ask to be contacted another way if it is reasonable, such as getting appointment reminders electronically instead of by postcard.
• Patients who start the conversation set the tone. If a patient emails first, HHS says the provider can assume that channel is acceptable unless the patient says otherwise, and can warn the patient about the risks and let them decide whether to continue.

What if a patient wants their records sent in an unsecure way?

The right of access goes further. HHS says individuals have a right to receive a copy of their health information by unencrypted email if they ask for it that way. The practice must give a brief warning that there is some risk the information could be read by a third party in transit, and confirm the patient still wants it sent that way. If the patient says yes, the practice has to comply.

That is a narrow rule about a patient's own records at the patient's request. It is not permission for staff to run everyday clinical texting through personal phones. For routine messaging, the safer default is a platform built for healthcare with a BAA in place.

Why the BAA Matters More Than Encryption

When a vendor creates, receives, maintains or transmits patient information on your behalf, HIPAA treats it as a business associate. HHS explains that covered entities generally have to sign a written contract with each business associate that limits how the vendor can use the information, requires it to safeguard the data under the Security Rule, and requires it to report breaches back to the practice.

That contract is what turns a texting app into a tool your practice can defend. Encryption protects a message in transit, but the BAA is the vendor's written promise about everything else, including storage, staff access, subcontractors and what happens when something goes wrong. If a vendor will not sign one, treat that as the answer to whether you can use it for patient messages.

Is iMessage HIPAA compliant?

iMessage encrypts messages end to end, which is why the question comes up so often. The problem is not encryption. We could not find any Apple page offering a business associate agreement for iMessage, and without a BAA the practice has no contract covering how patient information is handled.

There are practical gaps too. iMessage lives on one person's phone, so there is no shared inbox for the front desk, no way to hand a thread to a nurse, no audit trail the practice controls and no clean way to save the conversation into the chart. The same goes for WhatsApp, Facebook Messenger and regular SMS from a personal cell. When a physician leaves or a phone is lost, the practice loses the record. Many DPC and concierge practices that start on personal phones move to a healthcare texting platform once the panel grows past what one person can track.

Best HIPAA Texting Apps for DPC and Concierge Practices in 2027

The tools below are the ones DPC and concierge practices most often consider. BAA status and prices come from each vendor's own website, and the Sources line at the end says when each priced page was last checked. Vendors change plans often, so confirm on a demo call before you sign anything.

What each one covers, and the two more priced by quote or by use:

• Spruce Health. Phone, text, fax, video, email and team chat, with the BAA listed on the pricing page.
• OhMD. A text-enabled landline, with voice and video calling and the BAA listed in the plan comparison. Enterprise is by quote.
• Weave. VoIP phones, two-way text and fax, with a BAA published.
• Podium. Text and chat, with a phone system as an add-on and a BAA in its legal terms.
• Luma Health. Text, broadcasts and automated outreach with EHR integration, with a BAA published. Priced by quote.
• Klara (now part of ModMed). Sold as ModMed Patient Engagement, by quote. Ask ModMed about a BAA: we could not find a public BAA page.
• Twilio. Building blocks for SMS, voice and video that you or a developer assemble, with a BAA on the Security or Enterprise Edition for HIPAA-eligible products. Usage-based, with edition pricing through Twilio sales.

Spruce vs OhMD vs Klara

These three come up together because each started as a patient texting tool for medical offices, and each has moved in a different direction since.

Spruce is a common pick among small DPC and concierge practices. Its plans page bundles a BAA with phone, text, fax, video and team chat in one shared inbox, bills month to month and publishes per-user prices, which makes the cost easy to plan for a solo doctor and one staff member. It is best for a practice that wants one place for every patient conversation without a long contract. We walk through a working setup in our Spruce messaging workflow for DPC.

OhMD is built around making your existing office line textable. Its pricing page lists two-way SMS, a text-enabled landline, voice and video calling and a BAA in the Core plan, with automated routing and scheduling in higher tiers. It is best for a practice that wants patients to keep texting the number they already know.

Klara was acquired by ModMed in 2022, according to ModMed's announcement, and klara.com now leads to ModMed's patient engagement product. That makes it most natural for practices already on ModMed's specialty software. Primary care practices on other EHRs should ask how it connects before committing.

Where Weave, Podium, Luma and Twilio fit

Weave and Podium both bundle patient texting with phones, reviews and payments, and both publish a BAA. They suit a practice that wants its front desk phone system, reminders and review requests from one vendor. Our Weave patient communication workflow shows how that looks day to day.

Luma Health is aimed at larger groups and health systems that want automated outreach tied tightly to the EHR. Twilio is not a finished app. It is the messaging infrastructure many healthcare tools are built on, and its HIPAA page says customers must be on the Security or Enterprise Edition and use only HIPAA-eligible products to sign its BAA. It fits a practice with a developer or an integration partner building something custom.

Who Should Pick Which

• Pick Spruce if you want texts, calls, faxes and video with patients in one shared inbox. Where it wins: calls, texts and faxes in one place; one per-user plan for the whole team.
• Pick OhMD if you want your existing office line text-enabled, with routing and scheduling automation as you grow. Where it wins: texting with voice and video calling on its base plan; AI voice and text on its automation plan.
• Pick Weave if you want phones, texting, reviews and payment requests from one vendor. Where it wins: text-to-pay and payment reminders; reviews collected and managed in one place.
• Pick Podium if online reviews matter most and you want texting and payment requests in the same place. Where it wins: an AI employee from first inquiry to booking.
• Pick Luma if you are a larger group that wants automated patient outreach tied to the EHR. Luma says it is for health systems. Where it wins: outreach tied to your EHR and workflows.
• Pick Klara if you already run on ModMed and want its patient communication. Where it wins: patient communication and collaboration, now part of ModMed.
• Pick Twilio if you have engineers and want texting built into your own patient app. Where it wins: developer APIs priced by the message.
• What Tabflows does not do: replace your patient messaging.

Do Practices Need 10DLC Registration to Text Patients?

Usually, yes, though your vendor typically handles it. US carriers treat texts sent from a business phone number through software as application-to-person (A2P) traffic. Twilio's documentation explains that A2P 10DLC is the standard carriers use to make sure texts to US phones from 10-digit numbers are verified and consensual, and that anyone sending SMS over a 10DLC number from an application to the US must register.

Registration ties your number to your practice's legal business name and to a described messaging use, such as appointment reminders and patient care conversations. Twilio notes that registered senders get lower filtering and higher throughput, while unregistered traffic faces extra carrier fees. When texts quietly stop arriving, an incomplete registration is a common cause, so ask your vendor during onboarding whether they register the brand and campaign for you and how long approval takes.

Registration also connects to consent. Reminders and care messages to your own members are different from marketing blasts, and the federal Telephone Consumer Protection Act treats them differently. Keep marketing texts separate, get clear opt-in for them, and honor STOP replies. Ask your attorney where your own messages fall.

A Practical Texting Policy for a DPC or Concierge Practice

A written policy protects the practice and makes life easier for the team, because nobody has to guess what is allowed at 9 p.m. on a Saturday. Here is a starting point you can adapt.

What staff can text

Good uses for text are appointment reminders and scheduling, short follow-ups after a visit, lab results the physician has already reviewed and marked as fine to share by message, refill confirmations, billing and membership questions, and quick check-ins. Keep each message to the minimum the patient needs, which is the same principle HHS applies to unencrypted email.

Some things belong on a call or a visit instead. These include new serious diagnoses, abnormal results that need a conversation, mental health crises and anything the patient has asked to keep off their phone. Sensitive categories such as behavioral health and substance use treatment may carry extra rules in your state, which our DPC laws by state guide can help you start researching.

Consent language

Put texting consent in your membership agreement or intake forms so every patient sees it before the first message. A simple version reads like this:

"Our practice uses a secure messaging platform to text and message patients. Text messages may include appointment details, test results and care instructions. Standard text messaging carries some risk that a message could be seen by someone with access to your phone. You can choose a different way to hear from us at any time, and you can reply STOP to stop routine texts. Messaging is not for emergencies. If you have an emergency, call 911."

If a patient asks you to use plain SMS or email instead of the secure app, give the short risk warning HHS describes, confirm their choice and note it in the chart.

After-hours expectations

Membership patients value access, but unlimited access with no ground rules burns out a solo physician fast. Spell out response times in the membership agreement, for example a reply by the end of the next business day for routine messages and a separate path for urgent after-hours concerns. Most texting platforms let you set an after-hours auto-reply that repeats the emergency instruction and tells the patient when to expect a response.

Decide ahead of time who covers messages on weekends and vacations, and route them to that person instead of to whoever happens to check. Our guide to after-hours patient message triage covers routing rules, auto-replies and escalation in more detail.

Keeping texts in the chart

Clinical texts are part of the medical record. If a patient texts a symptom and you give advice, that exchange should end up in the chart the same way a phone note would. Some platforms push conversations into the EHR automatically, while others need a staff member to export or summarize the thread.

Pick one method and make it a routine step, such as saving every clinical thread before it is closed for the day. Gaps here are rarely anyone's fault. They happen because the texting tool and the EHR do not talk to each other, so the copy-and-paste step gets skipped on a busy afternoon.

How Texting Fits the Rest of Your Practice Stack

Texting rarely lives alone. A patient message often starts a refill, a lab order, a billing question or a referral, and each of those is finished in a different system. The texting tool is only one part of the stack covered in our best DPC software for 2027 guide, and the general approach to choosing tools with BAAs is in our guide to HIPAA compliant workflow tools. If you are still deciding between models, DPC vs concierge medicine explains how access expectations differ between the two.

This is where Tabflows helps. Tabflows is a dedicated tech team that connects the tools a clinic already uses, such as the EHR, membership billing and Spruce or another messaging platform, so the work that starts in a text gets finished. Follow-ups become tasks, patient context sits in one place and the clinical thread lands in the chart without someone retyping it.

The Bottom Line

Doctors can text patients under HIPAA when the practice uses reasonable safeguards. In practice that means a texting vendor that signs a BAA, consent captured at intake, a short policy on what goes by text, clear after-hours expectations and a routine for saving clinical messages to the chart. Personal phones and consumer apps like iMessage leave the practice without a contract or a record, which is why most DPC and concierge practices move to a healthcare texting platform as they grow.

Compare the vendors above on the channels you actually need and on how well each connects to your EHR, then check current pricing on a demo call. If you are planning the rest of your practice, start with our guide to starting a DPC practice or browse how other practices set up in the DPC Finder.

Sources

Checked on November 5, 2026: getweave.com, podium.com, lumahealth.io/solutions/outreach/communication, lumahealth.io, modmed.com/press-release/modmed-acquires-maker-of-the-klara-practice-patient-collaboration-platform and twilio.com/en-us/messaging/channels/sms. Checked on November 4, 2026: sprucehealth.com/plans, ohmd.com/pricing, getweave.com/pricing, podium.com/pricing, getweave.com/legal/baa, legal.podium.com and twilio.com/en-us/sms/pricing/us. Spot a wrong fact? Email a correction.