# HIPAA for messaging — what healthcare senders need to know

> HIPAA (the US Health Insurance Portability and Accountability Act) governs Protected Health Information (PHI) — any information that ties an individual to their medical care. For messaging, HIPAA is triggered the moment your SMS or WhatsApp message conveys PHI (a clinic name, an appointment specialty, a test result, a prescription). The relevant rules are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

- Canonical URL: https://www.broadnet.me/answers/hipaa-for-messaging
- Language: en
- Last reviewed: 2026-09-27
- Publisher: BroadNet (https://www.broadnet.me)

## When messaging triggers HIPAA

Three patterns. An appointment reminder that names the specialty clinic ("your cardiology appointment") — PHI. A test-result notification ("your lab results are ready") — PHI. A prescription pickup ("your Lipitor refill is at pharmacy X") — PHI. A generic appointment reminder ("appointment tomorrow at 3pm") with no specialty disclosure can be argued to be non-PHI, but most compliance teams treat it as PHI to be safe.

## Business Associate Agreement (BAA)

Any vendor that handles PHI on a covered entity's behalf is a Business Associate. The Business Associate Agreement is mandatory — without one, the covered entity is in violation the moment they push a single PHI-bearing message through the vendor. If you plan to send PHI, ask us about your HIPAA requirements first; BAA availability is confirmed during contracting.

## Encryption requirements

The Security Rule mandates encryption in transit and at rest for PHI. SMS bodies between an SMSC and the handset are not end-to-end encrypted (the OTA path is operator-controlled and confidential, but not encrypted in the GDPR/HIPAA sense). HHS guidance: SMS is acceptable for HIPAA PHI provided the patient has been informed of the unencrypted nature and consented. For higher sensitivity, use WhatsApp (end-to-end encrypted) or push notification to a HIPAA-aligned patient portal.

## Breach notification

If PHI is breached you must notify the patient within 60 days, HHS within 60 days (or immediately for >500-patient breaches), and possibly local media. The CPaaS must notify the covered entity quickly enough that the covered entity can meet the 60-day clock. Our incident-response SLA for HIPAA accounts is 4 hours for initial notification, full root-cause inside 14 days.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [GDPR for messaging — what enterprise senders need to know](https://www.broadnet.me/answers/gdpr-for-messaging)
- [Healthcare solutions](https://www.broadnet.me/solutions/healthcare)