Is Texting Dental Patients HIPAA Compliant?
Plain SMS is not HIPAA compliant on its own. That does not mean you cannot text patients — it means what you send and what carries it both have to be right.
Reactivation and recall by text works better than any other channel a dental practice has. It is also the channel where a careless message creates a real problem. Here is the honest version of what is allowed, what is not, and the two separate sets of rules people confuse.
Can a dental practice text patients under HIPAA?
Yes, with conditions that are genuinely manageable
Here is the answer practices actually need: standard text messaging is not inherently HIPAA compliant, and you can still run a texting program. The rule is not that texting is forbidden. It is that protected health information requires appropriate safeguards, and an ordinary SMS travelling through carrier infrastructure to an unlocked phone does not have them. The practical consequence is narrower than people fear — it shapes what you put in the message and which platform sends it, not whether you text at all. Most of the reactivation and recall messaging that actually produces bookings contains no protected health information in the first place, which is why this works.
The distinction that matters is content, not channel
“You are due for a visit, we have Tuesday at 10 or Thursday at 3” contains no diagnosis, no procedure and no treatment plan. It is an appointment invitation. “Time to finish your implant” names a procedure and ties it to an identified individual, which is exactly what the safeguards exist to protect. Practices get into difficulty when a well-meaning team member personalises a message with clinical detail because it feels more helpful.
Two separate rule sets, constantly confused
HIPAA governs protected health information. The TCPA governs commercial messaging to mobile numbers and requires prior express consent and a working opt-out, with its own penalties that have nothing to do with health data. A practice can be perfectly clean on HIPAA and still be exposed on TCPA, which is the more common failure in marketing texts.
What makes dental patient texting defensible
A signed Business Associate Agreement, before anything sends
Any vendor handling your patient list on your behalf is a business associate and needs a signed BAA. This is the step that gets skipped when somebody uploads a patient list into a general marketing tool because it was convenient and already paid for. A platform that will not sign a BAA is telling you something important about whether it was built for healthcare.
Encryption in transit and at rest
Your list sits in that vendor’s database. It should be encrypted where it sits and encrypted while it moves, with access controls and an audit trail showing who looked at what. Healthcare-specific platforms treat this as table stakes. General marketing platforms frequently do not, and the difference is invisible until it matters.
Minimum necessary, applied to message content
Send the least information required to accomplish the purpose. For reactivation the purpose is getting somebody to book, and that needs no clinical detail whatsoever. This is not merely a compliance posture, it is also better marketing — short, specific appointment offers outperform personalised clinical reminders.
The TCPA side nobody reads until there is a problem
Appointment reminders and marketing are treated differently
Messages about an appointment a patient already has sit in a different category from messages inviting them to book something new. Reactivation campaigns are closer to the second, which is the category with stricter consent expectations. Practices assume the intake form covered it; frequently the intake form covers appointment reminders and says nothing about marketing contact.
Check the actual wording on your forms
This takes ten minutes and it is the single most useful compliance step available to most practices. If your consent language only references appointment reminders, update it, and until then be conservative about what you send to patients who signed the old version. This is a question for whoever handles your compliance, not for your marketing agency to decide unilaterally.
Opt-outs are permanent and must be instant
A reply of STOP has to stop everything, immediately and forever. Suppression lists that get overwritten when a new list is uploaded are one of the most common ways practices generate complaints, and carrier complaints can get your messaging shut off entirely — a far more immediate consequence than a regulatory one.
No messages at hours that would wake somebody, and a cadence that does not feel like pressure. A four-touch reactivation sequence across a month is reasonable. Four messages in a week is how you generate opt-outs and complaints from people who were perfectly happy with you.
What a compliant dental reactivation text actually looks like
Short, from a named practice, with two times offered
“Hi Sarah, it is Megan at Lakeside Dental. You are due for a cleaning — we have Tuesday 10am or Thursday 3pm. Reply 1 or 2, or STOP to opt out.” That message names the practice and a person, contains no protected health information, gives a four-second decision, and carries an opt-out. It also outperforms longer, warmer messages consistently.
What to move to the phone
Anything clinical. If a patient replies asking about the crown they were told they needed, that conversation happens on a call, not in the thread. Train whoever monitors replies on that boundary, because the natural instinct is to answer helpfully in the channel the question arrived in.
Who to exclude before sending
Patients who formally transferred care, anyone marked deceased, anyone who opted out, and — as a matter of judgement rather than law — patients with outstanding balances, because mixing a collections conversation with an invitation to return goes badly for both.
Find out how many patients you are sitting on
Twenty minutes. Tell me what software you run and I will tell you how to pull your lapsed list, what it is worth, and how to work it without creating a compliance problem.
