When a physical therapist texts a colleague about a shared patient, or a counseling practice’s front desk emails intake forms to a new client, or an OT supervisor messages a staff therapist about a scheduling change – each of those communications creates a compliance question. HIPAA sets standards for electronic protected health information, and communication tools that practices use every day often fall into gray areas that owners do not recognize until an audit or an incident forces the issue. Getting communication compliance right is mostly about knowing which tools are in scope, what the requirements actually are, and where the common gaps live.

Disclaimer: This article provides general information about HIPAA considerations for communication tools. It is not legal advice. Consult a qualified healthcare attorney for guidance specific to your practice.

What Makes a Communication Tool HIPAA-Compliant

A tool is not automatically HIPAA-compliant just because it has encryption. Compliance requires a set of administrative, physical, and technical safeguards, and for any third-party service that handles protected health information (PHI), it also requires a Business Associate Agreement (BAA). The BAA is the contract that binds the vendor to HIPAA obligations, and if a vendor will not sign one, the tool should not touch PHI – period.

The practical checklist for any communication tool your practice uses or is considering:

  • BAA available and signed. If the vendor does not offer a BAA for your tier of service, the tool is not suitable for PHI.
  • Encryption in transit and at rest. Data must be encrypted both when moving between devices and when stored on the vendor’s servers.
  • Access controls. Only authorized users within your practice should be able to access PHI. Role-based permissions are standard.
  • Audit logging. The system should record who accessed what PHI and when. This matters for both compliance and incident response.
  • Data retention and deletion. You need a clear understanding of how long the vendor retains data and how it is deleted when no longer needed.

Common Communication Tools and Where They Stand

Standard SMS and consumer messaging apps (iMessage, WhatsApp, standard text messaging) are not HIPAA-compliant for PHI. They lack BAAs, audit controls, and the administrative safeguards required. Many practices use them anyway for convenience, which creates exposure that an audit or patient complaint can surface.

HIPAA-compliant texting platforms designed for healthcare (TigerConnect, QliqSOFT, and similar) offer BAAs, encryption, and audit features. These are the appropriate channel for any text communication that includes PHI – appointment details, treatment instructions, care coordination messages.

Email is more nuanced. Standard email (Gmail free, consumer Outlook) is not HIPAA-compliant. Business-grade email services (Google Workspace with a BAA, Microsoft 365 with a BAA) can be configured for compliance. The BAA is the key differentiator, and many small practices use email services without one, not realizing the gap.

Practice management platforms and EHRs typically include secure messaging features that are HIPAA-compliant. These are often the safest default for internal team communication about patients because the compliance infrastructure is already in place.

Team Communication: The Internal Gap

External patient communication gets most of the attention, but internal team communication is where many practices have the biggest compliance gaps. Staff texting each other about patients on personal phones. Clinicians emailing notes to themselves. Front-desk staff discussing scheduling changes in a group chat that includes patient names. These are PHI disclosures in environments without BAAs, access controls, or audit trails in place.

For internal team communication, the safest path is to use the secure messaging built into your EHR or practice management system. If that is not practical – the messaging features are limited, or some team members do not have EHR access – a dedicated HIPAA-compliant team communication platform is the alternative.

AI Communication Tools and Compliance

The newer challenge is AI-powered communication tools: chatbots on practice websites, AI assistants that draft patient messages, automated follow-up systems. These tools process PHI, which means they need the same compliance infrastructure as any other PHI-handling system – BAA, encryption, access controls, audit logging. The additional layer is understanding what the AI does with the data: is it used to train models? Is it stored beyond the communication session? Can patients opt out? AI automation for healthcare practices requires careful vendor evaluation on these points, which many practice owners are not equipped to do alone.

For practices evaluating AI communication tools, AI consulting with a healthcare compliance lens can help separate tools that are genuinely compliant from those that use compliance language in marketing but do not hold up under scrutiny.

Building a Communication Policy

Every practice should have a written communication policy that specifies which tools are approved for which types of communication, what PHI can and cannot be shared over each channel, and what staff should do when a patient initiates communication over a non-compliant channel (patients are not bound by HIPAA – they can text you; your response is where compliance applies). The policy does not need to be long, but it needs to exist and be part of onboarding and annual training.

The communication tools that keep a therapy practice compliant are not exotic. They are the result of deliberate choices: sign the BAA, configure the access controls, train the team, and audit periodically. Most compliance gaps are not from sophisticated attacks – they are from convenience-driven choices that accumulate over time. Practice operations support that includes a communication compliance review is a practical starting point. If you want to assess where your practice stands, get in touch and we can help you work through the audit.