Everything worth knowing, nothing that isn't.
When messaging triggers HIPAA
Three patterns. An appointment reminder that names the specialty clinic ("your cardiology appointment") — PHI. A test-result notification ("your lab results are ready") — PHI. A prescription pickup ("your Lipitor refill is at pharmacy X") — PHI. A generic appointment reminder ("appointment tomorrow at 3pm") with no specialty disclosure can be argued to be non-PHI, but most compliance teams treat it as PHI to be safe.
Business Associate Agreement (BAA)
Any vendor that handles PHI on a covered entity's behalf is a Business Associate. The Business Associate Agreement is mandatory — without one, the covered entity is in violation the moment they push a single PHI-bearing message through the vendor. If you plan to send PHI, ask us about your HIPAA requirements first; BAA availability is confirmed during contracting.
Encryption requirements
The Security Rule mandates encryption in transit and at rest for PHI. SMS bodies between an SMSC and the handset are not end-to-end encrypted (the OTA path is operator-controlled and confidential, but not encrypted in the GDPR/HIPAA sense). HHS guidance: SMS is acceptable for HIPAA PHI provided the patient has been informed of the unencrypted nature and consented. For higher sensitivity, use WhatsApp (end-to-end encrypted) or push notification to a HIPAA-aligned patient portal.
Breach notification
If PHI is breached you must notify the patient within 60 days, HHS within 60 days (or immediately for >500-patient breaches), and possibly local media. The CPaaS must notify the covered entity quickly enough that the covered entity can meet the 60-day clock. Our incident-response SLA for HIPAA accounts is 4 hours for initial notification, full root-cause inside 14 days.