Text messaging is the de facto communication standard for home health staff in 2026. A scheduling coordinator texts a field nurse to confirm a visit time. A clinical supervisor texts a nurse to ask about a patient's wound status. A nurse texts the office to report that a patient was unexpectedly hospitalised. A billing coordinator texts a colleague to confirm a patient's insurance status. Each of these messages contains patient information. Each of these messages is sent through a consumer text messaging platform — the native SMS app on a personal smartphone, or iMessage, or WhatsApp — that has no encryption, no access controls, no HIPAA compliance, and no Business Associate Agreement. Each of these messages is, legally, a HIPAA violation.
I recognise that framing every routine clinical text message as a HIPAA violation sounds alarmist. But the legal reality is precisely that, and the practical implications are significant: if any of those text messages becomes part of a breach investigation, an OCR audit, or litigation, the agency's use of unencrypted personal messaging for patient information is an independently citable compliance failure. More importantly, unencrypted text messages containing patient information are a data loss vector — messages can be screenshotted, forwarded, or read by anyone who has access to the recipient's device.
What HIPAA Actually Says About Text Messaging
HIPAA does not explicitly prohibit text messaging. It requires that electronic transmissions of PHI be protected through "appropriate encryption and decryption" unless the organisation can document that the specific transmission presents a low probability of compromise. For a consumer SMS text message — which travels unencrypted across cellular networks and is stored on devices with no HIPAA-compliant access controls — documenting a low probability of compromise is not achievable. OCR has consistently stated in guidance documents that standard unencrypted text messaging for PHI does not satisfy HIPAA's technical safeguard requirements.
The Practical Reality: Why Staff Text and How to Redirect That Behaviour
Staff use personal text messaging for clinical communication because it is faster, simpler, and more familiar than any approved alternative. Prohibiting it through policy without providing an alternative that is equally fast, simple, and familiar does not stop the behaviour — it drives it underground. Supervisors receive unreported text messages about patients. Nurses develop workarounds that technically comply with the word of the policy while violating its intent. The policy becomes another compliance document that exists on paper but not in practice.