BroadNet
Healthcare · patient messaging

HIPAA-aligned patient messaging.

Appointment reminders that show up. Lab-result nudges that stay private. Medication loops that actually close. BroadNet runs the messaging spine for hospital networks, primary-care groups and lab chains — across SMS, WhatsApp and Voice — under HIPAA, GDPR and the health-data laws of the regions you operate in.

Design secure patient messagingReview patient communication flow
HIPAA-aligned GDPR + UAE PDPL DHA · SCFHS · NHS DSP
The BroadNet snow leopard resting beside gentle appointment-reminder pulses flowing to a phone
BroadNet · healthcare
Healthcare messaging
<3s
OTP delivery
200+
countries
99.99%
SLA
Reminder cadence
T-72h
T-72h, T-24h and T-2h touches, tuned per service line
Reminder delivery
2.6s
Typical P50 on direct Gulf routes
PHI in the message body
0
Result values stay in the EMR; the SMS carries a signed portal link
Audit retention
7yr
Default, configurable per workspace
For health-IT teams

FHIR in.
Audit trail out.

Reminders, lab notifications, adherence loops and telehealth invites all ride a single REST surface. PHI never crosses the boundary in a message body — patient references travel, the scrubber redacts, and the patient gets a deep-link to your portal.

BAA confirmed in contracting · PHI scrubber inlineFHIR R4 · HL7 v2 · SMART-on-FHIR
Example
# Appointment reminder
curl -X POST https://api.broadnet.me/sms/sendSms \
  -H "Authorization: Bearer $BROADNET_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "senderId": "CLINIC",
    "destinationNumber": "447700900123",
    "message": "Reminder: your appointment at City Clinic is tomorrow at 10:30. Reply YES to confirm or RESCHEDULE to change it.",
    "messageType": "TEXT"
  }'
 
# → 200 OK — the response body is the message ID, e.g. 2603121407537573731
Use cases

Six conversations that run the patient day.

Each one is a template, a consent rule, a fallback channel and an audit trail — shipped together. Tune the cadence per service line; the platform handles the routing, the regulator, and the receipts.

Appointment reminders

Timed reminders with one-tap reschedule deep-links, so a freed slot can go to another patient and clinic capacity goes to higher-acuity visits.

SMSWhatsApp
T-72h · T-24h · T-2h

Lab results notifications

Discreet 'results are ready' nudges with a signed deep-link into the patient portal. Result values stay inside the EMR — never in the SMS body.

SMSWhatsApp
Signed portal link

Medication reminders

Adherence cadences for chronic care — diabetes, hypertension, post-op antibiotics. Two-way replies log to the care team's dashboard.

WhatsAppSMS
Two-way ACK

Telehealth invitations

One-tap join links delivered minutes before the consult, with a voice fallback for elderly patients who miss the message.

WhatsAppSMSVoice
Auto-fallback

Patient onboarding

One-time-passcode verification for patient-portal sign-in, consent capture, pre-visit forms and insurance pre-auth — orchestrated as one conversation across SMS and WhatsApp.

SMSWhatsApp
Consent on record

Emergency alerts

Outbreak notices, ward closures, recall messages. Geo-targeted to affected catchment areas with sender-ID protection and a full audit trail.

SMSVoiceWhatsApp
Priority lane
On-device previewA2P SMS

See exactly what your customer sees, the moment it arrives.

Illustrative example — sample content, not a real customer message.

Aster Clinic
One appointment, five touchpoints

A reminder journey, end-to-end.

Channels handed off by intent, not by cost. SMS for delivery certainty, WhatsApp for two-way confirmation, Voice for accessibility. Every step logged and replayable.

  1. T-72hSMSFirst reminder · reschedule deep-link
  2. T-24hWhatsAppConversational confirmation · 'Reply YES'
  3. T-2hSMSFinal nudge with directions
  4. T-15mVoiceFallback call if unread (elderly cohort)
  5. T+1dWhatsAppPost-visit care plan · medication ACK loop
Compliance posture

Aligned to the laws that bind your providers.

Healthcare messaging is a regulated act. BroadNet ships posture, not promises: BAAs where they apply, DPAs where they don't, in-region processing for jurisdictions that demand it, and per-region sender-ID approval handled by our regulatory team.

Browse all compliance dossiers
Global baseline
HIPAA-aligned

Workspaces can be provisioned under a BAA-compatible posture. PHI is segregated from message payloads, access is least-privilege, and processor logs are exportable for covered-entity audits.

Europe
GDPR + UK GDPR

Lawful-basis tagging at the contact level, EU-resident processing options, and DPA/SCCs through BroadNet's EU entity. Right-to-erasure honoured without undue delay across reminders, logs and consent receipts.

UAE
DHA / SEHA / DoH

Approved sender IDs for licensed providers via TDRA, alignment with UAE Federal Decree-Law 45/2021 (PDPL) and the DHA Health Data Law (No. 2 of 2019). Resident processing in Dubai South.

Saudi Arabia
SCFHS / MOH

PDPL (2023) aligned with KSA in-Kingdom data residency on request. Sender IDs registered through CST. Arabic-first message templates with auto-RTL rendering.

United Kingdom
NHS DSP Toolkit

Data Security and Protection Toolkit-aligned controls for NHS trusts and primary-care networks. UK-resident routing through London POPs, OFCOM-registered numbering.

Operational
Audit-ready by default

Every send carries a delivery receipt: timestamp, route, operator MCC/MNC, template hash and consent ID. 7-year retention by default, longer on request.

Patient privacy

Treat the message like a record.

Every notification a hospital sends becomes part of the patient's footprint — regulators expect to read it back. Four primitives keep that footprint clean.

Receipt · evt_8f12b9 logged
channel
SMS · MCC 424
template
appt_remind_v3
consent
informed · 2026-04-12
delivered
2.61s

PHI never leaves the EMR

Message bodies carry deep-links, not values. Lab numbers, diagnoses and dosages stay inside the hospital's portal — patients authenticate to view.

Delivery receipts

Each event — queued, delivered, read, replied — is time-stamped. Receipts are exportable to the EMR for medico-legal record-keeping.

Granular audit logs

Per-user, per-template, per-cohort. Filter by clinician, ward, campaign or patient. Exportable to SIEM via webhook or to S3 via signed nightly drops.

Consent at the contact

Opt-in basis (informed, contractual or vital-interest) is tagged at the patient record. STOP and opt-out replies are honored network-wide within seconds.

Channel mix

Right channel, right patient.

The platform chooses by intent and patient profile. You write the message once; BroadNet renders it to SMS, WhatsApp Business or voice — with the right fallback when one path doesn't land.

Reminders

SMS

Universal reach across every patient phone — feature phones, locked screens, low-bandwidth catchments. The default for time-sensitive nudges.

Best for: T-24h appointment reminders, prescription pickups, ward updates.

Two-way care

WhatsApp

Rich, conversational follow-ups: symptom check-ins, medication ACKs, telehealth confirmations. Patient replies route to the care-team inbox.

Best for: chronic-care cohorts, adherence loops, post-discharge follow-up.

Accessibility

Voice

Synthesised voice calls in Arabic, English, Hindi, Urdu and Tagalog — for elderly patients, visually-impaired patients and anyone who misses the SMS.

Best for: geriatric clinics, dialysis schedules, urgent recalls.

PHI-safe routing

From EHR event
to patient handset, PHI-redacted.

An inline PHI scrubber sits between template render and operator submit. Names, MRNs and diagnoses are redacted to signed portal deep-links by default — your privacy office approves any clinical-necessity waivers up-front.

  1. 01 · EHR
    EHR / HIS

    Cerner, Epic, InterSystems or in-house EHR pushes a FHIR or HL7 event. Patient ref only — no PHI in payload.

    p50 < 30ms
  2. 02 · Edge
    BroadNet edge

    TLS 1.3 + mTLS termination. BAA scope check. Template lookup. Patient consent ledger validated.

    p50 < 40ms
  3. 03 · Scrub
    PHI scrubber

    Outbound body scanned for PHI patterns. Names, MRNs and results redacted to portal links unless template waiver.

    p50 < 18ms
  4. 04 · Route
    Operator route

    In-region SMSC bind. UAE traffic stays in UAE, KSA in KSA. WhatsApp Business on Meta's healthcare-cleared cluster.

    p50 < 1.2s
  5. 05 · Patient
    Patient + ACK

    Message delivered. Patient replies (YES / RESCHEDULE / STOP) flow back to your EHR via webhook.

    p50 < 2.6s
  6. ← patient ACK · STOP / RESCHEDULE · webhook
Healthcare customers

When reminders run themselves,
clinicians get their day back.

Healthcare network in the GulfTertiary care · GCCAE
Challenge
Cardiology no-shows were costing the network revenue, with no compliant Arabic-English reminder track.
Approach
A multi-touch reminder rail with native bilingual templates and PHI scrubbing at the edge.
Patient experience director · illustrative deployment, results vary
0
PHI in message body
KSA specialist hospital groupTertiary care · GCCSA
Challenge
National data-residency rules disqualified the incumbent messaging vendor for clinical workloads.
Approach
BroadNet's in-country region holds every FHIR webhook, template render and DLR inside the local jurisdiction.
Head of digital health · illustrative deployment, results vary
South Asian primary-care networkPrimary care · South AsiaPK
Challenge
Two-way local-language WhatsApp adherence loops for chronic-disease patients exceeded the prior aggregator's capabilities.
Approach
BroadNet stood up adherence flows across several provinces with localised templates and an outcome dashboard.
Chief medical information officer · illustrative deployment, results vary
Case study · A UK health network

A primary-care network puts every appointment reminder on one cadence.

This UK health network runs a federated GP network nationwide. Before BroadNet, no-shows were rising and retraining reception staff was the only lever to pull. The team rolled out a BroadNet-orchestrated reminder cadence across SMS and WhatsApp, with a Voice fallback for elderly patients.

“The reminder rail is the quietest part of our operation now. It runs. Patients confirm, reschedule, or get a call — and the audit log writes itself.”
Director of Digital Operations · a UK health network
In production with

Hospital and clinic networks on three continents.

  • UK
    A UK health networkUnited Kingdom
    Appointment SMS across a federated GP network
  • SH
    A leading GCC hospital groupKSA · UAE · Egypt
    Multi-country reminder + lab-result flow
  • AH
    A pan-regional healthcare providerGCC + India
    Telehealth invites with voice fallback
  • MH
    A Gulf private-hospital networkUAE
    Two-way WhatsApp adherence for chronic care
Patient-facing templates in Arabic, English, French, Hindi, Urdu and Tagalog — auto-rendered RTL where required.
Questions clinical IT teams ask

Eight answers, reviewed
by our privacy team.

We operate under a HIPAA-aligned control set covering technical, administrative and physical safeguards. BAA availability is confirmed during contracting, and a BAA must be in place before any production PHI traffic. The BAA scopes which environments (regions, accounts, channels) handle PHI, and an attestation pack is available for your privacy office. We are not a covered entity ourselves — under a BAA we act as a Business Associate under your direction.

Our PHI scrubber sits inline between template render and operator submit. Inbound payloads carry patient references — not names, MRNs or diagnoses. Outbound bodies are scanned for PHI patterns and either redacted to a signed portal deep-link or blocked entirely unless the template carries a clinical-necessity waiver approved by your privacy officer. Every redaction is logged for audit.

Templates ship in Arabic, English, French, Hindi, Urdu, Tagalog, Bengali, Malayalam, Turkish and Swahili out of the box — auto-rendered RTL where required. SMS encoding (GSM-7 or UCS-2) is picked automatically per language; WhatsApp Business handles the rest. Custom locales for tribal or regional languages can be added in 5-7 business days.

We maintain a per-patient consent ledger keyed to your EHR patient reference. Clinical messages (appointment reminders, results, telehealth invites) ride a 'care' consent class that respects your jurisdiction's treatment-communication carve-out; marketing-class sends require a separate explicit opt-in and honour STOP/ELGHA/CANCEL keywords in any language within 60 seconds across all channels.

Yes. We run in-country edge and storage regions in UAE (Dubai), KSA (Riyadh), Egypt (Cairo) and the EU (Frankfurt). When residency is set on a workspace, FHIR ingest, template render, scrubber decisions, DLRs and audit logs all stay on-shore. Cross-border replication is opt-in per workload and disabled by default for PHI workspaces.

FHIR R4 and HL7 v2 are first-class. We provide SMART-on-FHIR launch flows for Cerner and Epic, and pre-built adapters for InterSystems TrakCare, Oracle Health, and the major MENA EHR vendors (CGM, Bayanat Health, Synapse). Custom HL7 segments map through a low-code transform engine — most hospital integrations are clinically validated in 4-6 weeks.

Reminder flows ladder automatically: if SMS fails to deliver inside the configured TTL we re-pin to a backup operator, then escalate to WhatsApp Business, then to a voice IVR call for elderly cohorts. Every escalation is logged and visible to your operations team. Critical clinical alerts (lab criticals, telehealth join) get priority routing on dedicated binds.

For non-life-threatening critical results (e.g. abnormal CBC requiring follow-up), yes — with a clinician-authored template, a priority routing class, and an automatic voice fallback. For true life-threatening emergencies (code calls, mass-casualty events) we recommend a dedicated paging integration alongside; SMS and WhatsApp are not regulatory-grade emergency channels in most jurisdictions.

Need a deeper privacy or BAA review? Review patient communication flow →

Carrier-grade messaging coverage across global industries
Built for your industry

Your industry, on a carrier-grade network.

Compliant, reliable messaging tuned to your sector — across MENA, Africa and Asia.

200+
Countries
60,000+
Enterprises
Since 2003
Operator-direct
Talk to sales
Built for patient time

Lift attendance. Protect privacy. Sleep at audit time.

Talk to BroadNet's healthcare team about a pilot on one service line. We bring templates, regulator paperwork and the channel rail; you bring the patient list and the EMR endpoint.

Design secure patient messagingReview patient communication flow
2.6s reminder delivery· delivery receipts· voice fallback
Related guides & answers

Go deeper on the concepts behind this product.

What is OTP

Read

HIPAA for messaging — what healthcare senders need to know

Read

What is 2FA (two-factor authentication)

Read

What are SMS OTP best practices

Read