Which texting app is HIPAA compliant?

Yes, several dedicated messaging apps are HIPAA compliant, but popular consumer apps like regular SMS, WhatsApp, and Signal are not fully compliant because they lack signed Business Associate Agreements (BAAs) and specific administrative healthcare controls.

Top HIPAA-Compliant Messaging Apps

• TigerConnect: Built for clinical collaboration and hospital care teams, offering secure texting, encryption, and role-based user directories.
• Spruce Health: An all-in-one platform designed for independent practices and therapists, combining secure patient texting, calling, and telehealth.
• OhMD: Focused on patient texting, engagement, and two-way communication without requiring patients to download a separate heavy app.
• iPlum: Provides secure communication, texting, and second phone lines specifically tailored for small practices and individual providers.
• OnPage: Built for critical on-call messaging and clinical alerts with guaranteed message delivery and audit trails.
• Microsoft Teams: Can be configured to be HIPAA compliant for enterprise health systems, provided a BAA is executed with Microsoft.

What Makes an App Compliant?

An app is only HIPAA compliant if the vendor signs a Business Associate Agreement (BAA) accepting liability for protected health information (PHI). Essential technical features include:

• End-to-end encryption in transit and at rest.
• Audit logs tracking who accessed or sent messages.
• Access controls such as multi-factor authentication and auto-logoff timeouts.
• Remote wipe capabilities if a mobile device is lost or stolen.

RCS (Rich Communication Services) messages are significantly more private and secure than traditional SMS, but whether they are completely end-to-end encrypted depends on who you are messaging.

Personal Messages (Person-to-Person)

• Android-to-Android: Chats sent using Google Messages are end-to-end encrypted (E2EE) by default, meaning only you and the recipient can read them.
• Cross-Platform (iPhone and Android): End-to-end encryption for cross-platform RCS messaging is rolling out. When E2EE is active, carriers and tech companies cannot read the message contents.
• When E2EE is unavailable: Messages fall back to Transport Layer Security (TLS) encryption. This protects the message in transit between your device and the server, but it is not end-to-end encrypted.

Business Messages (RCS for Business)

• Not End-to-End Encrypted: Messages sent from a verified brand or business are encrypted in transit (using TLS), but they are not end-to-end encrypted.
• Intermediary Access: Because business messages pass through carrier networks and platform infrastructure for spam scanning and compliance, the operators can technically access the content. You should avoid sending sensitive personal data or confidential information to businesses via RCS.

Metadata and Privacy Considerations

• Metadata Collection: While message contents may be encrypted, metadata—such as who you are messaging and when—is still visible to network intermediaries and servers (such as Google’s Jibe infrastructure, which handles a large portion of RCS routing).
• Platform Trust: Unlike dedicated private messengers like Signal, standard RCS implementation relies heavily on carrier and Google infrastructure, raising structural privacy questions for strict advocates.

To make texting HIPAA-compliant, you must use a secure messaging platform with end-to-end encryption, obtain written patient consent, and sign a Business Associate Agreement (BAA) with your software vendor. Standard consumer SMS text messaging is not secure and cannot be made compliant on its own if it contains Protected Health Information (PHI).

Core Requirements for Compliant Texting

• Sign a BAA: Choose a software provider willing to execute a legal Business Associate Agreement accepting liability for data security.
• Enforce Encryption: Ensure messages are encrypted both in transit and at rest.
• Implement Access Controls: Require user authentication, unique staff login credentials, and auto-logouts.
• Maintain Audit Logs: Track all message history, reads, and user access.
• Obtain Patient Consent: Inform patients of text messaging risks and secure their written or documented electronic consent before sending messages.

Best Practices and Workflows

• Follow the Minimum Necessary Rule: Limit text content to basic scheduling, reminders, or general updates.
• Avoid Plain-Text PHI: Never send diagnoses, test results, or social security numbers via standard SMS. Instead, send a secure link directing the patient to log into an authenticated patient portal.
• Use Secure Alternatives: Adopt healthcare-focused communication solutions (such as TigerConnect, Klara, or secure Text Request tools) rather than standard cellular text apps.

Police cannot read the actual content of live iMessages because of end-to-end encryption, but they can trace metadata and contact logs through Apple or access stored backups.

What Police Cannot Access

• Live Message Content: Apple uses end-to-end encryption for iMessages (the blue bubbles). Apple states they do not possess the decryption keys for in-transit messages, meaning they cannot comply with live wiretap orders for message bodies.

What Police Can Trace and Access

• Contact Logs and Metadata: When your phone checks Apple's servers to see if a number is registered with iMessage, Apple briefly logs connection data. According to The Intercept, Apple can share these lookup logs (showing which numbers were queried, timestamps, and IP addresses) under a court order or pen register. Apple generally purges these specific logs after 30 days.
• iCloud Backups: If you have iCloud Backup or "Messages in iCloud" turned on, your message history may be stored on Apple's servers. Because Apple holds the keys to standard iCloud backups, law enforcement can obtain these stored message archives with a valid search warrant.
• Physical Device Extraction: If law enforcement physically seizes an unlocked or compromised iPhone, or obtains a local computer backup, forensic software can extract existing or recently deleted message histories directly from the hardware.
• SMS Fallback: If an iMessage fails and sends as a standard SMS text (the green bubbles), that message is not encrypted. Cell phone carriers store SMS logs and content, which can be subpoenaed with a warrant.

No, FaceTime is not HIPAA compliant because Apple refuses to sign a Business Associate Agreement (BAA), which is a legal requirement for handling protected health information (PHI).

Why FaceTime Fails HIPAA Compliance

• No Business Associate Agreement (BAA): Apple will not enter into a BAA with healthcare providers. Without this signed agreement, using the app for patient care violates HIPAA regulations.
• Missing Administrative Controls: FaceTime lacks mandatory features like audit logs, persistent access controls, and administrative management tools required to track and protect PHI.
• End of Emergency Rules: The temporary COVID-19 enforcement discretion that allowed non-compliant video apps ended in August 2023. Standard HIPAA rules now fully apply.

HIPAA-Compliant Alternatives

Instead of FaceTime, healthcare providers should use dedicated telehealth platforms that offer signed BAAs and proper security configurations, such as:

• Zoom for Healthcare
• Microsoft Teams
• Google Meet (via Google Workspace)
• Doxy.me