# HIPAA-aligned patient messaging. - Canonical URL: https://www.broadnet.me/solutions/healthcare - Language: en - Last updated: 2026-10-01 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. Healthcare · patient messaging Appointment reminders that show up. Lab-result nudges that stay private. Medication loops that actually close. BroadNet runs the messaging spine for hospital networks, primary-care groups and lab chains — across SMS, WhatsApp and Voice — under HIPAA, GDPR and the health-data laws of the regions you operate in. [Design secure patient messaging](https://www.broadnet.me/contact?topic=patient-messaging&industry=healthcare) [Review patient communication flow](https://www.broadnet.me/contact?topic=patient-flow&industry=healthcare) HIPAA-aligned GDPR + UAE PDPL DHA · SCFHS · NHS DSP ![The BroadNet snow leopard resting beside gentle appointment-reminder pulses flowing to a phone](https://www.broadnet.me/marketing/solutions/sol-healthcare.webp) BroadNet · healthcare Healthcare messaging <3s OTP delivery 200+ countries 99.99% SLA Reminder cadence T-72h T-72h, T-24h and T-2h touches, tuned per service line Reminder delivery 2.6s Typical P50 on direct Gulf routes PHI in the message body 0 Result values stay in the EMR; the SMS carries a signed portal link Audit retention 7yr Default, configurable per workspace For health-IT teams ## FHIR in. Audit trail out. Reminders, lab notifications, adherence loops and telehealth invites all ride a single REST surface. PHI never crosses the boundary in a message body — patient references travel, the scrubber redacts, and the patient gets a deep-link to your portal. BAA confirmed in contracting · PHI scrubber inline FHIR R4 · HL7 v2 · SMART-on-FHIR POST · api.broadnet.me/sms/sendSms Example ``` 1# Appointment reminder2curl -X POST https://api.broadnet.me/sms/sendSms \3 -H "Authorization: Bearer $BROADNET_TOKEN" \4 -H "Content-Type: application/json" \5 -d '{6 "senderId": "CLINIC",7 "destinationNumber": "447700900123",8 "message": "Reminder: your appointment at City Clinic is tomorrow at 10:30. Reply YES to confirm or RESCHEDULE to change it.",9 "messageType": "TEXT"10 }'11 12# → 200 OK — the response body is the message ID, e.g. 2603121407537573731 ``` Use cases ## Six conversations that run the patient day. Each one is a template, a consent rule, a fallback channel and an audit trail — shipped together. Tune the cadence per service line; the platform handles the routing, the regulator, and the receipts. ### Appointment reminders Timed reminders with one-tap reschedule deep-links, so a freed slot can go to another patient and clinic capacity goes to higher-acuity visits. SMS WhatsApp T-72h · T-24h · T-2h ### Lab results notifications Discreet 'results are ready' nudges with a signed deep-link into the patient portal. Result values stay inside the EMR — never in the SMS body. SMS WhatsApp Signed portal link ### Medication reminders Adherence cadences for chronic care — diabetes, hypertension, post-op antibiotics. Two-way replies log to the care team's dashboard. WhatsApp SMS Two-way ACK ### Telehealth invitations One-tap join links delivered minutes before the consult, with a voice fallback for elderly patients who miss the message. WhatsApp SMS Voice Auto-fallback ### Patient onboarding One-time-passcode verification for patient-portal sign-in, consent capture, pre-visit forms and insurance pre-auth — orchestrated as one conversation across SMS and WhatsApp. SMS WhatsApp Consent on record ### Emergency alerts Outbreak notices, ward closures, recall messages. Geo-targeted to affected catchment areas with sender-ID protection and a full audit trail. SMS Voice WhatsApp Priority lane On-device previewA2P SMS ## See exactly what your customer sees, the moment it arrives. Illustrative example — sample content, not a real customer message. Aster Clinic 9:41 AC Aster Clinic Verified healthcare sender Today 9:41 AM Reminder: your appointment with Dr. Sara Khan is tomorrow at 10:30 AM, Clinic 4, Level 2. Please arrive 10 minutes early. 9:41 AM Confirm Reschedule Your lab results are ready. To protect your privacy, no health details are sent by message — sign in securely to view them. 11:15 AM View results securely Text message One appointment, five touchpoints ## A reminder journey, end-to-end. Channels handed off by intent, not by cost. SMS for delivery certainty, WhatsApp for two-way confirmation, Voice for accessibility. Every step logged and replayable. 1. T-72h SMS First reminder · reschedule deep-link 2. T-24h WhatsApp Conversational confirmation · 'Reply YES' 3. T-2h SMS Final nudge with directions 4. T-15m Voice Fallback call if unread (elderly cohort) 5. T+1d WhatsApp Post-visit care plan · medication ACK loop Compliance posture ## Aligned to the laws that bind your providers. Healthcare messaging is a regulated act. BroadNet ships posture, not promises: BAAs where they apply, DPAs where they don't, in-region processing for jurisdictions that demand it, and per-region sender-ID approval handled by our regulatory team. [Browse all compliance dossiers](https://www.broadnet.me/compliance) Global baseline HIPAA-aligned Workspaces can be provisioned under a BAA-compatible posture. PHI is segregated from message payloads, access is least-privilege, and processor logs are exportable for covered-entity audits. Europe GDPR + UK GDPR Lawful-basis tagging at the contact level, EU-resident processing options, and DPA/SCCs through BroadNet's EU entity. Right-to-erasure honoured without undue delay across reminders, logs and consent receipts. UAE DHA / SEHA / DoH Approved sender IDs for licensed providers via TDRA, alignment with UAE Federal Decree-Law 45/2021 (PDPL) and the DHA Health Data Law (No. 2 of 2019). Resident processing in Dubai South. Saudi Arabia SCFHS / MOH PDPL (2023) aligned with KSA in-Kingdom data residency on request. Sender IDs registered through CST. Arabic-first message templates with auto-RTL rendering. United Kingdom NHS DSP Toolkit Data Security and Protection Toolkit-aligned controls for NHS trusts and primary-care networks. UK-resident routing through London POPs, OFCOM-registered numbering. Operational Audit-ready by default Every send carries a delivery receipt: timestamp, route, operator MCC/MNC, template hash and consent ID. 7-year retention by default, longer on request. Patient privacy ## Treat the message like a record. Every notification a hospital sends becomes part of the patient's footprint — regulators expect to read it back. Four primitives keep that footprint clean. Receipt · evt_8f12b9 logged channel SMS · MCC 424 template appt_remind_v3 consent informed · 2026-04-12 delivered 2.61s ### PHI never leaves the EMR Message bodies carry deep-links, not values. Lab numbers, diagnoses and dosages stay inside the hospital's portal — patients authenticate to view. ### Delivery receipts Each event — queued, delivered, read, replied — is time-stamped. Receipts are exportable to the EMR for medico-legal record-keeping. ### Granular audit logs Per-user, per-template, per-cohort. Filter by clinician, ward, campaign or patient. Exportable to SIEM via webhook or to S3 via signed nightly drops. ### Consent at the contact Opt-in basis (informed, contractual or vital-interest) is tagged at the patient record. STOP and opt-out replies are honored network-wide within seconds. Channel mix ## Right channel, right patient. The platform chooses by intent and patient profile. You write the message once; BroadNet renders it to SMS, WhatsApp Business or voice — with the right fallback when one path doesn't land. Reminders ### SMS Universal reach across every patient phone — feature phones, locked screens, low-bandwidth catchments. The default for time-sensitive nudges. Best for: T-24h appointment reminders, prescription pickups, ward updates. Two-way care ### WhatsApp Rich, conversational follow-ups: symptom check-ins, medication ACKs, telehealth confirmations. Patient replies route to the care-team inbox. Best for: chronic-care cohorts, adherence loops, post-discharge follow-up. Accessibility ### Voice Synthesised voice calls in Arabic, English, Hindi, Urdu and Tagalog — for elderly patients, visually-impaired patients and anyone who misses the SMS. Best for: geriatric clinics, dialysis schedules, urgent recalls. PHI-safe routing ## From EHR event to patient handset, PHI-redacted. An inline PHI scrubber sits between template render and operator submit. Names, MRNs and diagnoses are redacted to signed portal deep-links by default — your privacy office approves any clinical-necessity waivers up-front. 1. 01 · EHR EHR / HIS Cerner, Epic, InterSystems or in-house EHR pushes a FHIR or HL7 event. Patient ref only — no PHI in payload. p50 < 30ms 2. 02 · Edge BroadNet edge TLS 1.3 + mTLS termination. BAA scope check. Template lookup. Patient consent ledger validated. p50 < 40ms 3. 03 · Scrub PHI scrubber Outbound body scanned for PHI patterns. Names, MRNs and results redacted to portal links unless template waiver. p50 < 18ms 4. 04 · Route Operator route In-region SMSC bind. UAE traffic stays in UAE, KSA in KSA. WhatsApp Business on Meta's healthcare-cleared cluster. p50 < 1.2s 5. 05 · Patient Patient + ACK Message delivered. Patient replies (YES / RESCHEDULE / STOP) flow back to your EHR via webhook. p50 < 2.6s 6. ← patient ACK · STOP / RESCHEDULE · webhook 01 · EHR EHR / HIS Cerner, Epic, InterSystems or in-house EHR pushes a FHIR or HL7 event. Patient ref only — no PHI in payload. p50 < 30ms 02 · Edge BroadNet edge TLS 1.3 + mTLS termination. BAA scope check. Template lookup. Patient consent ledger validated. p50 < 40ms 03 · Scrub PHI scrubber Outbound body scanned for PHI patterns. Names, MRNs and results redacted to portal links unless template waiver. p50 < 18ms 04 · Route Operator route In-region SMSC bind. UAE traffic stays in UAE, KSA in KSA. WhatsApp Business on Meta's healthcare-cleared cluster. p50 < 1.2s 05 · Patient Patient + ACK Message delivered. Patient replies (YES / RESCHEDULE / STOP) flow back to your EHR via webhook. p50 < 2.6s Healthcare customers ## When reminders run themselves, clinicians get their day back. Healthcare network in the Gulf Tertiary care · GCC AE **Challenge** Cardiology no-shows were costing the network revenue, with no compliant Arabic-English reminder track. **Approach** A multi-touch reminder rail with native bilingual templates and PHI scrubbing at the edge. Patient experience director · illustrative deployment, results vary 0 PHI in message body KSA specialist hospital group Tertiary care · GCC SA **Challenge** National data-residency rules disqualified the incumbent messaging vendor for clinical workloads. **Approach** BroadNet's in-country region holds every FHIR webhook, template render and DLR inside the local jurisdiction. Head of digital health · illustrative deployment, results vary South Asian primary-care network Primary care · South Asia PK **Challenge** Two-way local-language WhatsApp adherence loops for chronic-disease patients exceeded the prior aggregator's capabilities. **Approach** BroadNet stood up adherence flows across several provinces with localised templates and an outcome dashboard. Chief medical information officer · illustrative deployment, results vary Case study · A UK health network ### A primary-care network puts every appointment reminder on one cadence. This UK health network runs a federated GP network nationwide. Before BroadNet, no-shows were rising and retraining reception staff was the only lever to pull. The team rolled out a BroadNet-orchestrated reminder cadence across SMS and WhatsApp, with a Voice fallback for elderly patients. > “The reminder rail is the quietest part of our operation now. It runs. Patients confirm, reschedule, or get a call — and the audit log writes itself.” Director of Digital Operations · a UK health network In production with ### Hospital and clinic networks on three continents. - UK A UK health network United Kingdom Appointment SMS across a federated GP network - SH A leading GCC hospital group KSA · UAE · Egypt Multi-country reminder + lab-result flow - AH A pan-regional healthcare provider GCC + India Telehealth invites with voice fallback - MH A Gulf private-hospital network UAE Two-way WhatsApp adherence for chronic care Patient-facing templates in Arabic, English, French, Hindi, Urdu and Tagalog — auto-rendered RTL where required. Questions clinical IT teams ask ## Eight answers, reviewed by our privacy team. We operate under a HIPAA-aligned control set covering technical, administrative and physical safeguards. BAA availability is confirmed during contracting, and a BAA must be in place before any production PHI traffic. The BAA scopes which environments (regions, accounts, channels) handle PHI, and an attestation pack is available for your privacy office. We are not a covered entity ourselves — under a BAA we act as a Business Associate under your direction. Our PHI scrubber sits inline between template render and operator submit. Inbound payloads carry patient references — not names, MRNs or diagnoses. Outbound bodies are scanned for PHI patterns and either redacted to a signed portal deep-link or blocked entirely unless the template carries a clinical-necessity waiver approved by your privacy officer. Every redaction is logged for audit. Templates ship in Arabic, English, French, Hindi, Urdu, Tagalog, Bengali, Malayalam, Turkish and Swahili out of the box — auto-rendered RTL where required. SMS encoding (GSM-7 or UCS-2) is picked automatically per language; WhatsApp Business handles the rest. Custom locales for tribal or regional languages can be added in 5-7 business days. We maintain a per-patient consent ledger keyed to your EHR patient reference. Clinical messages (appointment reminders, results, telehealth invites) ride a 'care' consent class that respects your jurisdiction's treatment-communication carve-out; marketing-class sends require a separate explicit opt-in and honour STOP/ELGHA/CANCEL keywords in any language within 60 seconds across all channels. Yes. We run in-country edge and storage regions in UAE (Dubai), KSA (Riyadh), Egypt (Cairo) and the EU (Frankfurt). When residency is set on a workspace, FHIR ingest, template render, scrubber decisions, DLRs and audit logs all stay on-shore. Cross-border replication is opt-in per workload and disabled by default for PHI workspaces. FHIR R4 and HL7 v2 are first-class. We provide SMART-on-FHIR launch flows for Cerner and Epic, and pre-built adapters for InterSystems TrakCare, Oracle Health, and the major MENA EHR vendors (CGM, Bayanat Health, Synapse). Custom HL7 segments map through a low-code transform engine — most hospital integrations are clinically validated in 4-6 weeks. Reminder flows ladder automatically: if SMS fails to deliver inside the configured TTL we re-pin to a backup operator, then escalate to WhatsApp Business, then to a voice IVR call for elderly cohorts. Every escalation is logged and visible to your operations team. Critical clinical alerts (lab criticals, telehealth join) get priority routing on dedicated binds. For non-life-threatening critical results (e.g. abnormal CBC requiring follow-up), yes — with a clinician-authored template, a priority routing class, and an automatic voice fallback. For true life-threatening emergencies (code calls, mass-casualty events) we recommend a dedicated paging integration alongside; SMS and WhatsApp are not regulatory-grade emergency channels in most jurisdictions. Need a deeper privacy or BAA review? [Review patient communication flow →](https://www.broadnet.me/contact?topic=patient-flow&industry=healthcare) ![Carrier-grade messaging coverage across global industries](https://www.broadnet.me/marketing/generated/viz-coverage.png) Built for your industry ## Your industry, on a carrier-grade network. Compliant, reliable messaging tuned to your sector — across MENA, Africa and Asia. 200+ Countries 60,000+ Enterprises Since 2003 Operator-direct [Talk to sales](https://www.broadnet.me/contact) Built for patient time ## Lift attendance. Protect privacy. Sleep at audit time. Talk to BroadNet's healthcare team about a pilot on one service line. We bring templates, regulator paperwork and the channel rail; you bring the patient list and the EMR endpoint. [Design secure patient messaging](https://www.broadnet.me/contact?topic=patient-messaging&industry=healthcare) [Review patient communication flow](https://www.broadnet.me/contact?topic=patient-flow&industry=healthcare) 2.6s reminder delivery · delivery receipts · voice fallback Related guides & answers Go deeper on the concepts behind this product. [What is OTP Read](https://www.broadnet.me/answers/what-is-otp) [HIPAA for messaging — what healthcare senders need to know Read](https://www.broadnet.me/answers/hipaa-for-messaging) [What is 2FA (two-factor authentication) Read](https://www.broadnet.me/answers/what-is-2fa) [What are SMS OTP best practices Read](https://www.broadnet.me/answers/sms-otp-best-practices)