HIPAA Compliant Email and Texting for Therapists

Email and texting are convenient—but convenience doesn't mean compliance. Standard email and SMS texting aren't HIPAA-compliant for protected health information, yet many therapists use them daily without realizing the risk.

This guide covers what's allowed, what's not, and how to communicate with clients while staying compliant.

The Core Problem

Why Standard Email Isn't Compliant

Regular email (Gmail, Yahoo, personal Outlook):

• Not encrypted end-to-end
• Stored on servers without HIPAA protections
• No Business Associate Agreement available
• Vulnerable to interception

Why Standard Texting Isn't Compliant

SMS text messages:

• Not encrypted
• Stored on carrier servers
• Can be intercepted
• No way to verify recipient
• No BAA with carriers

What You Can and Can't Send

Generally Safe (Minimal PHI)

Not Safe (Contains PHI)

The Gray Area

Even appointment reminders can become PHI if the email address or phone reveals mental health treatment is occurring.

Compliant Email Options

Option 1: HIPAA-Compliant Email Services

Dedicated email services with encryption and BAAs:

How they work:

• Messages encrypted in transit and at rest
• Recipient may need to access secure portal
• Provider offers BAA
• Audit trails available

Option 2: Business Email with BAA

Workspace-level email with healthcare configurations:

Important: Personal Gmail/Outlook don't qualify—must be paid business accounts with signed BAA.

Option 3: EHR Client Portal

Most practice management software includes secure messaging:

• SimplePractice → Client portal messaging
• TherapyNotes → Secure messaging
• Jane App → Client messaging

Advantages:

• Already covered under EHR's BAA
• Messages stored with clinical record
• Clients already have portal access

Option 4: Don't Email PHI

Policy approach:

• Limit email to scheduling and logistics
• No clinical content via email
• All substantive communication in session or via secure portal

Compliant Texting Options

Option 1: HIPAA-Compliant Texting Platforms

How they work:

• Messages sent through encrypted app or portal
• Not standard SMS
• BAA provided
• Messages retained and secured

Option 2: EHR Messaging Features

Many EHRs include text-like messaging:

• Client receives notification
• Actual message in secure portal
• No PHI in the text notification itself

Option 3: Limit Texting to Non-PHI

Policy approach:

• Text only: "Please call the office"
• Appointment reminders without clinical context
• No clinical discussions via text

Client Consent and Preferences

Informed Consent for Electronic Communication

Before communicating electronically:

1. Explain the risks — Even secure methods have some risk
2. Get written consent — Document client's agreement
3. Document preferences — How does client want to be contacted?
4. Allow opt-out — Client can choose more secure methods

Sample Consent Language

What If Client Sends PHI Via Unsecure Channel?

You can't control what clients send. If a client texts you clinical information:

1. Don't respond with PHI in the same channel
2. Move conversation to secure platform
3. Educate client about secure communication options
4. Document your attempts to use secure methods

Practical Implementation

Recommended Setup

For email:

1. Get HIPAA-compliant email or business workspace with BAA
2. Use EHR portal for clinical communication
3. Limit regular email to logistics only

For texting:

1. Use EHR or compliant texting platform for anything beyond "call the office"
2. Set clear boundaries with clients about text content
3. Document communication preferences

Communication Policies

Create written policies covering:

• What communication channels you use
• What can be discussed on each channel
• How to handle client requests for non-secure communication
• Response time expectations

Documentation

Document:

• Client consent for electronic communication
• Client communication preferences
• Attempts to educate about secure options
• Any incidents involving non-secure communication

Common Scenarios

Scenario 1: Client Texts About Suicidal Thoughts

The situation: Client texts "Having thoughts of hurting myself"

What to do:

1. Respond immediately—safety trumps HIPAA
2. Assess safety via whatever means necessary (call, text back)
3. Follow your crisis protocol
4. Document the interaction
5. Follow up about secure communication later

HIPAA note: Emergency situations permit disclosure/communication as necessary to prevent serious harm.

Scenario 2: Client Wants Session Notes Emailed

The situation: Client asks you to email their session notes

What to do:

1. Explain HIPAA concerns with regular email
2. Offer alternatives: secure portal, encrypted email, mail, pickup
3. If client insists on regular email after understanding risks, document consent
4. Client can assume risk for their own PHI

Scenario 3: Client Only Has Email, No Smartphone

The situation: Client can't use your secure portal app

What to do:

1. Many portals have web access (no app required)
2. Use encrypted email that doesn't require recipient to have special software
3. Consider phone calls for clinical content
4. Document limitations and consent

Scenario 4: Quick Question Between Sessions

The situation: Client emails asking clinical question, wanting response

What to do:

1. If you have secure portal, respond there
2. If not, brief acknowledgment + "Let's discuss at next session"
3. For urgent clinical matters, phone call
4. Document your communication approach

Email and texting are part of modern practice, but they require thoughtful implementation. Get compliant tools, educate clients about secure options, document consent, and keep PHI out of non-secure channels. Convenience isn't worth a HIPAA violation.