Short answer: When your clinic falls under HIPAA, email and texts with patients about their care are allowed with reasonable safeguards. Any service that stores those messages for you needs a business associate agreement. WhatsApp’s own policy says not to send health information where the rules demand stronger systems.
Before you read: This guide sums up what HHS and WhatsApp publish about patient messages. It is general information, not legal advice. Ask your attorney or compliance lead about your own case.
When HIPAA covers your messages
Doctors and clinics fall under HIPAA when they send information electronically as part of a transaction that HHS has set a standard for. A decision tool on the HHS site walks you through the question.
In our reading, if your patients pay you directly, check with that tool or your attorney before you assume HIPAA doesn’t apply to your messages.
Email with patients
The Privacy Rule lets covered providers communicate with patients electronically, such as by email, if they apply reasonable safeguards, HHS says.
Its examples: check the email address before you send, or send an alert so the patient confirms the address first.
Unencrypted email isn’t prohibited for treatment-related messages. Still, HHS asks for other safeguards, such as limiting the amount or type of information in the email.
The Security Rule doesn’t expressly prohibit email either. It asks you to assess how you send information over open networks, choose a way to protect it and document that decision.
If you automate follow-up emails, in our reading the same safeguards apply to every message in the sequence. Our guide to drip campaigns shows how a sequence works.
Patients choose how you reach them
A patient can ask you to contact them by other means or at other places, and you should accommodate a reasonable request. HHS gives an example: reminders by email instead of a postcard.
If a patient who asks for confidential communications doesn’t accept unencrypted email, offer another way, such as a more secure electronic method, mail or the phone.
When a patient emails you first, you can assume email is acceptable to them unless they said otherwise, HHS says. You can also warn them about the risks and let them decide.
Services that store your messages
A cloud service that creates, receives, maintains or transmits patient information for you is a business associate under HIPAA, HHS says. You need a business associate agreement (BAA) with it.
That holds even if the service stores only encrypted data and has no key to read it. The exception for conduits covers only transmission, with no more than temporary storage.
HHS also lists app developers that handle patient messaging for a provider among its business associate examples. Using a cloud service to store patient information without a BAA violates the HIPAA Rules.
Phones are fine too, HHS says, with physical, administrative and technical safeguards in place and BAAs with the services behind them.
Texts and WhatsApp
HHS writes about email. In our reading, a text message to a patient needs the same care: the right number, few details and a BAA with any service that stores it.
WhatsApp’s business policy lets you contact people only if they gave you their number or username and opted in to your messages.
The same policy says not to send or request health information on WhatsApp if the applicable rules require systems with stronger protections. It also bans asking people for card numbers or other sensitive identifiers.
Our guide to the WhatsApp Business app covers the setup. In our reading, use it for general questions and move health details to a channel covered by a BAA.
Marketing texts have their own consent rules, which our guide to the TCPA rules for text messages explains.
Public replies are a separate case. How to answer a review without saying the writer is a patient is in our guide on Google profiles for doctors.
Each channel, the rules and our advice
| Channel | What the rules allow | Our advice |
|---|---|---|
| Allowed with reasonable safeguards; unencrypted email isn’t prohibited for treatment messages (HHS) | Confirm the address and keep details to a minimum | |
| Text message | HHS writes about email; in our reading the same safeguards apply | Send times and directions, not health details |
| Only people who opted in; no health information where the rules require stronger systems (WhatsApp) | Keep health details out of the chat | |
| A patient who writes first | You can assume email is acceptable unless they say otherwise (HHS) | Reply, and offer a safer channel for details |
| Email or texting service | One that stores patient information for you needs a BAA (HHS) | Ask for the BAA before the first message |
The second column summarizes HHS and WhatsApp guidance, and the last one is our advice.
How to set up patient messages at your clinic
- Find out whether your clinic falls under HIPAA, with the HHS decision tool or your attorney.
- List every channel your team uses with patients: email, texts, WhatsApp and any messaging tool.
- Sign a BAA with each service that stores or handles patient information for you.
- Confirm each patient’s email address or number before the first message.
- Keep the health details in each message to the minimum it needs.
- Note each patient’s preferred channel, and offer another one when they ask.
- Write down how you protect messages and why you chose that way.
Steps 1, 3, 4, 5 and 7 follow HHS guidance, and steps 2 and 6 are ours, built on it.
Check these before you message a patient
- You checked whether your clinic falls under HIPAA.
- The address or number is confirmed.
- The message carries only the details it needs.
- The service that stores it signed a BAA with you.
- On WhatsApp, the patient opted in and the chat has no health details.
- A safer channel is ready if the patient asks for one.
RememberUnder HIPAA, email and texts with patients are allowed with reasonable safeguards. Every service that stores those messages needs a BAA, and WhatsApp’s policy keeps health details out where stronger systems are required.
Our marketing for cosmetic surgery clinics helps clinics get found on Google and in AI answers, and nothing goes out until the surgeon approves it.
Common questions about HIPAA and patient messages
Is email HIPAA compliant?
Email can be, if your clinic applies reasonable safeguards, HHS says. Unencrypted email isn’t prohibited for treatment-related messages, but limit what you put in it and confirm the address first. Any email service that stores patient information for you needs a BAA.
Can a clinic text patients?
HHS writes about email, and in our reading the same safeguards fit a text: the right number, few health details, and a BAA with any service that stores the messages. Marketing texts also have their own consent rules.
Is WhatsApp HIPAA compliant?
WhatsApp’s own business policy says not to send or request health information when the applicable rules require systems with stronger protections. It also lets you message only people who opted in. In our reading, use it for general questions and keep health details elsewhere.
Does a patient have to agree to email?
A patient can ask you to use other means or another place, and you should accommodate a reasonable request. When a patient emails you first, HHS says you can assume email is acceptable unless they said otherwise, and you can warn them about the risks.
Do I need a BAA with my email or texting service?
Yes, if it creates, receives, maintains or transmits patient information for you. HHS treats such a service as a business associate, even when it stores only encrypted data without the key. Only transmission with temporary storage falls under the narrow conduit exception.
Sources
Sources read on November 6, 2026. From HHS: Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients? and Does the Security Rule allow for sending electronic PHI (e-PHI) in an email or over the Internet? If so, what protections must be applied? Also from HHS: Business Associates Frequently Asked Questions (FAQs), Guidance on HIPAA & Cloud Computing and Covered Entities and Business Associates. From WhatsApp: Business Policy.