linics, hospitals and labs use SMS for appointment reminders, results-ready notices, medication and follow-up prompts, telehealth links and one-time codes for patient portals, because a text reaches every phone, including basic phones and phones on weak networks. The rule that keeps it safe is minimal content: the message carries the time, the place and a secure link or reply option, never the diagnosis, result or medication name. Health data stays in the portal or the electronic medical record, where patients sign in to see it.
Key takeaways
- Main uses: reminders, confirmations and rescheduling, results-ready notices, adherence prompts, telehealth links, portal OTPs and public-health notices.
- Never put diagnoses, results, medication names or other clinical details in the SMS body.
- Two-way replies (YES, or a reschedule keyword) turn reminders into confirmations.
- Record the patient's consent or other lawful basis, and honour opt-outs.
- Keep delivery receipts and audit logs; they are part of the care record.
How do healthcare providers use SMS?
| Use case | What the SMS says | What stays out of the SMS |
|---|---|---|
| Appointment reminder | Date, time, location, how to confirm or reschedule | Reason for the visit, department names that reveal a condition |
| Results-ready notice | "Your results are ready" and a link to the portal | The result itself |
| Medication or follow-up prompt | A reminder to take the scheduled dose or book follow-up | The drug name and dose, unless the patient chose that |
| Telehealth invitation | Start time and a join link | Clinical notes |
| Portal sign-in | A one-time code | Anything else |
| Public-health notice | Clinic closures, recalls, vaccination drives | Individual patient data |
What should never go in a healthcare SMS?
An SMS can be read on a lock screen, by someone who shares the phone, or by the new owner of a recycled number. So keep out anything that reveals a person's health: diagnoses, test results, medication names, the name of a specialist clinic that implies a condition, and insurance or ID numbers. Send a link to the secure portal instead and let the patient authenticate to see the detail.
Two templates that follow the rule:
- "City Clinic: your appointment is tomorrow at 10:30. Reply YES to confirm or R to reschedule."
- "Your lab results are ready. View them securely in the patient portal."
What privacy rules apply to healthcare SMS?
It depends on where the patient is. In the United States, HIPAA governs protected health information held by covered entities and their business associates; see HIPAA for messaging. In the EU and UK, health data is special-category data under the GDPR and UK GDPR; see GDPR for messaging. In the UAE, the Personal Data Protection Law applies, and Saudi Arabia has its own PDPL; see UAE PDPL and Saudi PDPL. Whatever the law, the same practices hold: a lawful basis for each message type, minimal content, access controls and retention you can explain.
Appointment and results notices are service messages, not marketing. If you also send health-promotion campaigns, treat them as marketing: they need consent and an opt-out under most marketing rules.
Do SMS reminders reduce missed appointments?
Reminders are one of the most widely used tools against missed appointments, and two-way reminders add a practical benefit: a patient who replies to cancel frees the slot early enough to offer it to someone else. Results vary by clinic, specialty and timing, so measure your own: track confirmation replies, cancellations received and no-shows before and after you start. Many clinics send a reminder a day or two before and a shorter one on the day.
How should a clinic set up SMS?
- Decide which messages you send (reminders, results notices, prompts) and write a minimal template for each.
- Register a sender ID that patients recognise as your clinic, where the country requires registration.
- Connect your scheduling system or EHR so reminders go out automatically; send patient references, not clinical data, to the messaging platform.
- Enable two-way replies for confirm and reschedule, and route replies to the front desk or care team.
- Record each patient's consent or other lawful basis and honour STOP replies.
- Keep delivery receipts and audit logs with your records.
- Offer a voice-call fallback for patients who cannot read texts.
How does BroadNet support healthcare messaging?
BroadNet's healthcare messaging combines SMS, WhatsApp and voice with two-way SMS for confirmations, the OTP API for portal sign-in, delivery receipts for every message and exportable audit logs. For US covered entities, BAA availability is confirmed during contracting. BroadNet holds SOC 2 Type II and ISO 27001 certification. For the basics of reminders, see SMS for appointment reminders.
Frequently asked questions
Is it safe to send appointment reminders by SMS?
Yes, if the message is minimal: date, time, place and a way to confirm or reschedule, without the reason for the visit or any clinical detail.
Can I send lab results by SMS?
Send a results-ready notice with a link to the secure portal, not the result itself.
Do patients need to consent to SMS reminders?
You need a lawful basis for each message type under the law that applies to the patient. Record it, and always honour opt-out requests.
Are appointment reminders marketing?
No. Reminders and results notices are service messages. Health-promotion campaigns are marketing and need consent and an opt-out.
Does BroadNet sign a BAA?
BAA availability is confirmed during contracting.
What about patients who cannot read SMS?
Offer a voice call as a fallback, for example for elderly or visually impaired patients.
This guide is general information, not legal or medical advice. Reviewed 28 September 2026. See our editorial standards.