HIPAA and compliance
Is AI SMS texting with patients HIPAA compliant?
By the Recepta Desk team · Reviewed 2026-06-19
Key takeaways
- Standard SMS is not HIPAA compliant on its own.
- A compliant AI texting vendor must sign a Business Associate Agreement (BAA) and keep PHI inside BAA-covered infrastructure that is encrypted and audit-logged.
- Recepta Desk runs patient communication on AWS under a HIPAA BAA, with PHI isolated to that environment.
- Use SMS for scheduling and logistics; keep medical history and diagnoses in your EMR.
It can be, but the details matter. Standard text messaging is not HIPAA compliant on its own. For an AI texting service to handle patient communication safely, the vendor must sign a Business Associate Agreement (BAA) and keep any protected health information (PHI) inside infrastructure that the BAA covers, encrypted in transit and at rest and audit-logged.
Many small-business texting tools skip this step, which puts the clinic at risk. Recepta Desk runs patient communication on AWS infrastructure covered under a HIPAA BAA, with PHI isolated to that environment by design rather than as an afterthought.
One practical rule: keep SMS for scheduling and logistics, such as dates, confirmations, directions, and follow-ups. Medical history and diagnoses belong in your EMR. A compliant service handles PHI safely if a patient sends it, but you should not ask them to.
Sources
Last reviewed 2026-06-19 by the Recepta Desk team. Spot an error? Tell us and we'll correct it.