Texting patients responsibly is doable — and worth doing

Chiropractic patients prefer text over phone by a wide margin. The compliance question — how do you text patients without violating HIPAA or TCPA — is real but solvable. This is the practical guide.

What’s actually PHI in an SMS context

HIPAA defines PHI as health information that can identify an individual. In an SMS, the question is: would the message body reveal something about the patient’s care if read by someone other than the patient?

Not PHI (safe to send in plain SMS):

• “Hi Sarah, friendly reminder of your appointment tomorrow at 2 PM with Dr. Patel.”
• “Hi Sarah, we missed you this week — tap here to reschedule: [link]”
• “Hi Sarah, your invoice is ready: tap here to view”

Borderline PHI (avoid in plain SMS):

• “Hi Sarah, reminder of your sciatica re-eval tomorrow” — the diagnosis makes this PHI
• “Hi Sarah, your X-ray results are in” — the imaging reference is PHI

Definite PHI (never send in plain SMS):

• Treatment notes
• Diagnostic specifics
• Test results
• Medication lists

The rule of thumb: the SMS body should be appointment-and-logistics oriented; anything clinical lives behind a patient-portal login.

TCPA consent — the other half of the rule

TCPA (Telephone Consumer Protection Act) is the law that governs marketing texts. It’s separate from HIPAA but equally important.

A compliant SMS opt-in looks like this on your intake form:

☐ I agree to receive appointment reminders, scheduling updates, recall messages, and clinic communications via SMS at the phone number provided. Message frequency varies. Standard message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for help. View our Privacy Policy and Terms.

The checkbox cannot be pre-checked. The patient must affirmatively check it. The consent must be logged with timestamp + IP.

A2P 10DLC — what it is and why it matters

A2P 10DLC is the registration framework U.S. carriers use to allow business SMS at scale. Without registering, your texts will be filtered as spam — especially anything with healthcare-related keywords.

Registration is filed through The Campaign Registry, costs $4–$15/mo per number depending on tier, and takes 24–48 hours to approve carrier-side.

The Chiropractor Snapshot includes A2P 10DLC filing for U.S.-based clinics, free of charge. Other vendors charge $150+ for this. It’s a one-time setup pain point.

Quiet hours — the rule most clinics miss

TCPA requires that marketing messages only be sent between 8 AM and 9 PM patient local time. The snapshot stores each patient’s timezone (inferred from area code, confirmed at intake) and enforces the rule automatically.

Most clinics that get TCPA complaints get them because they sent a reminder at 7 AM local time without realizing.

STOP and HELP — what happens when a patient opts out

When a patient replies STOP:

• They are immediately added to the suppression list
• No further SMS is sent to that number from any campaign
• A confirmation is sent automatically: “You’ve been unsubscribed. Reply START to re-subscribe.”
• The opt-out is logged with timestamp

When a patient replies HELP:

• A response goes out with: clinic name, contact phone, opt-out instructions, and message-frequency policy

Both behaviors are required by carrier rules. The snapshot handles both automatically.

What “HIPAA-aware” means (and doesn’t mean)

“HIPAA-aware” in the snapshot context means:

• PHI is never embedded in plain SMS bodies
• Sensitive clinical content routes to the patient portal
• Consent is captured, dated, and logged
• Audit trail is complete

It does not mean:

• The SMS pipe itself is HIPAA-encrypted (SMS as a protocol isn’t)
• Every clinical message can travel via SMS (some can’t — they need the portal)
• The clinic is automatically HIPAA-compliant just by using the snapshot (the clinic still needs a BAA with GHL/Twilio and its own operational practices)

If your clinic needs full PHI-in-message capability for specific clinical workflows, you’ll need a separate BAA-covered secure-messaging app (TigerConnect, OhMD, etc.) alongside the snapshot.

Setup checklist

1. ☐ Intake form has TCPA opt-in checkbox (un-pre-checked)
2. ☐ Intake form has HIPAA acknowledgment checkbox
3. ☐ A2P 10DLC submitted via The Campaign Registry
4. ☐ STOP / HELP keyword handlers configured
5. ☐ Quiet-hours enforcement enabled per patient timezone
6. ☐ SMS templates audited — no PHI in message bodies
7. ☐ Patient portal active for any clinical content
8. ☐ Audit log retains consents + opt-outs for at least 4 years

All of these are pre-configured in the snapshot. You don’t have to set them up — you just need to know they exist when an audit happens.

A real-world example

Lapsed-patient SMS sent by the recall engine:

Hi {{firstName}}, we miss seeing you at the clinic! 🙂 Tap here to grab a quick spot this week: {{bookingLink}}. Reply STOP to opt out.

No PHI. No diagnosis. No treatment specifics. Warm, specific, compliant, and effective.

Book a demo → and we’ll walk through the full SMS template library + consent capture flow.