What makes patient texting HIPAA compliant
Yes, a medical practice can use a HIPAA-compliant texting platform, but no product label or consumer messaging app makes the practice compliant by itself. When a vendor creates, receives, maintains, or transmits electronic protected health information for the practice, the relationship requires a Business Associate Agreement and appropriate safeguards. The practice still has to configure who can access conversations, how patients are authenticated, what can appear in ordinary SMS, when automation stops, and how records are retained.
For practices on athenaOne, there is a second operational test: whether each resolved conversation updates the schedule, chart, patient case, or queue. Pretty Good AI runs secure two-way text and voice on the same athenaOne integration, allowing a conversation to continue across channels with the same patient and appointment context.
| Control | What the platform should provide | What the practice must configure |
|---|---|---|
| Business Associate Agreement | The vendor signs a BAA before receiving or transmitting patient information and accounts for subcontractors that handle ePHI. | Approve the texting platform as an authorized channel and prohibit staff from moving protected conversations into consumer messaging accounts that are outside the BAA. |
| Access controls | Individual workforce accounts, role-based permissions, session controls, and prompt access removal are available. | Assign roles by job function, remove former users, and decide which teams can view, export, reassign, or close conversations. |
| Audit logging | Logs show messages, access, automated actions, staff interventions, exports, and changes written to the EHR. | Choose who reviews the logs, how exceptions are investigated, and which events require a security or operational response. |
| Patient authentication | The workflow can verify identity before revealing ePHI or performing a patient-specific action. | Define approved checks for each action, such as confirming information already on file or moving the patient to a one-time authenticated experience. |
| Encryption and message content | Stored data and ePHI in transit are protected, with secure delivery available when ordinary SMS is not appropriate. | Decide which content can appear in SMS. Diagnoses, medication details, results, and other sensitive information should move to the secured experience defined by the practice. |
| Retention and deletion | The vendor documents retention, export, return, and deletion terms, including what happens when the relationship ends. | Choose which conversations become part of the durable medical or operational record, how long the platform copy remains available, and who can export or delete it. |
| Patient preference | The platform records communication preferences and supports a secure alternative for sensitive exchanges. | Explain the limitations of ordinary SMS, honor documented preferences, and keep exposed text limited to the information needed for the next action. |
Encryption is an addressable Security Rule implementation specification, which means the practice evaluates the appropriate controls through risk analysis rather than applying one universal configuration. In patient texting, the practical standard is still to protect stored data, secure ePHI in transit, and keep ordinary SMS content sparse.
HIPAA does not establish one universal period for a business associate to retain ePHI after its service ends. The BAA should address return or destruction where feasible, while the practice defines where the lasting record belongs and how long its messaging history remains available.
Patient permission is not a substitute for security. HIPAA permits many treatment communications without separate authorization, but documenting a preference for standard SMS does not replace the BAA, authentication, access controls, audit trail, or reasonable safeguards. HHS treatment, payment, and operations guidance
Product patterns in this comparison
Patient texting products increasingly overlap, but they still start from different operating models. The right comparison begins with what must happen after the patient replies.
The platforms in this comparison fall into four patterns: communications platforms built around a secure shared inbox, patient engagement suites built around reminders, recalls, and forms, conversational automation that handles routine calls and texts, and Pretty Good AI’s AI operations platform built exclusively for athenaOne, where text, voice, scheduling, and back-office work run on one integration. The test that separates them is whether the requested change finishes inside athenaOne without staff re-entry.
Patient texting platform capabilities compared
The decisive column is EHR writeback. An integration logo can mean patient data is imported, a transcript can be copied with a click, or an appointment actually changes without staff intervention. Those are materially different outcomes.
| Platform | Two-way conversations | Automated replies and staff escalation | Scheduling from the conversation | EHR or PM writeback |
|---|---|---|---|---|
| Pretty Good AI | Secure two-way text and voice share one athenaOne integration. Patients can authenticate by text before a protected workflow continues. | AI resolves configured requests and sends exceptions to staff when identity, clinical content, practice rules, or missing information require a person. | Patients can book, confirm, cancel, or reschedule against the live athenaOne schedule. | Appointments, chart information, patient cases, and operational queues update directly in athenaOne through 730+ athenaOne APIs in production, with no middleware. |
| OhMD | Voice, SMS, secure messaging, web chat, and staff conversations can continue with shared context. | AI handles routine requests, and staff can enter the conversation with its history when an edge case needs a person. | AI can book, cancel, or reschedule from voice or text and write the scheduling action to a connected EHR. | Scheduling actions can write back. For athenaOne, conversations can be pushed to the chart in one click. |
| Klara, now ModMed Patient Engagement | App-free two-way texting, call-to-text, and encrypted text chats are centralized in patient threads. | AI routes inbound requests into organized threads, while automated outreach and staff inboxes support handoff. | Patients can self-schedule and respond to appointment reminders from their phones. | Direct writeback is documented for ModMed EHR and Practice Management, including intake and financial data. Current athenaOne transactional writeback is not publicly detailed. |
| Weave | Voice and text conversations can be managed together across locations, alongside reminders, payments, and scheduling tools. | AI answers routine calls and texts, while follow-up tasks can be generated when staff attention is needed. | AI can book and reschedule directly for qualified dental practice-management systems. Other configurations use appointment requests or adjacent online scheduling. | Behavior depends on the connected practice-management system. Weave publishes automatic appointment creation for specific supported integrations. |
| Luma Health | Automated messages and staff chats are visible within a shared patient communication history. | Staff can tag colleagues, use templates, translate conversations, and take over workflows. | Staff can book appointments and send patients links for scheduling, rescheduling, forms, payments, and other next steps. | The Collaboration Hub is bidirectionally integrated with supported EHRs, and changes made from its patient sidebar write back to the EHR. |
| Spruce Health | Standard SMS and secure app messaging are available alongside phone, fax, email, and video. | Auto-replies, tags, assignment, routing, and urgent escalation workflows support staff intervention. | Configured workflows can expose self-service options and rescheduling paths, but Spruce is not positioned as a universal native EHR scheduler. | The Spruce API and integration partners can push conversation data or notes into an EHR. The exact workflow depends on the integration. |
| Emitrr | Two-way healthcare texting uses a shared inbox and can operate from an existing practice number. | The AI SMS Agent handles routine messages, alerts the team when attention is needed, and stops responding when staff take over. | On athenahealth, patients can confirm, cancel, or reschedule through text workflows. | Appointment status, refill workflows, completed forms, and message logs write back to athenahealth through a native integration without middleware. |
Patient authentication and escalation in a two-way text thread
A matching phone number can help locate a likely chart, but the practice should not treat the number alone as sufficient identity proof before revealing protected details or changing a patient-specific record. HHS requires reasonable identity verification without prescribing one universal method, so the practice has to define which checks fit each action.
The useful operating rule is simple: automation proceeds only while identity, request type, and practice rules remain clear. When one of those becomes uncertain, the thread should stop exposing protected information and reach staff with enough context to continue without making the patient start over.
| Thread state | What automation can do | When the thread goes to staff | Context that should travel with the handoff |
|---|---|---|---|
| New or unmatched phone number | Collect non-sensitive routing information and offer general practice information without confirming whether a named person is a patient. | The sender requests protected information, a chart change, or an action that cannot be tied confidently to one patient. | Phone number, stated identity, reason for contact, matching attempts, and possible records for staff review without disclosing those matches to the sender. |
| Matched patient requesting a patient-specific action | Run the practice-approved identity check, then continue with scheduling or another configured administrative workflow if the check passes. | The answers conflict with the record, the request falls outside configured rules, or the action requires staff judgment. | Matched chart, verification status, factors used, requested action, relevant appointment or case, and the last completed step. |
| Identity cannot be confirmed | Withhold protected details and offer the practice's approved fallback, such as a secure link, a staff callback, or a call to the published practice number. | The patient still needs help after the automated verification path ends. | Failed or incomplete verification status, contact details, request category, and a clear instruction not to repeat checks that already succeeded. |
| Family member, caregiver, or other proxy | Collect the request without treating the sender as authorized to receive protected information. | Staff must verify the person's authority or the patient's documented permission before disclosure or account changes. | Patient named, proxy name and relationship, requested action, callback information, and whether an authorization or personal-representative record was found. |
| Clinical symptoms, distress, or urgency appear | Stop the routine administrative workflow and apply the practice's approved urgent or on-call instructions. | The clinical or on-call team receives the thread according to the practice's escalation rules. Clinical judgment stays with the care team. | Original patient wording, identity status, timestamps, urgency flag, actions already taken, and the destination queue or on-call path. See the separate clinical guardrails reference. |
| Administrative request cannot be completed | Preserve the conversation and create or update the appropriate staff work item rather than leaving the thread in a general inbox. | The team responsible for the unresolved exception receives the case. | Patient and appointment context, full request, transcript or structured summary, steps attempted, failure reason, remaining decision, and assigned queue. |
| Request resolves successfully | Complete the transaction, write the resulting state to the system of record, record the outcome, and close the thread according to practice policy. | No staff handoff is needed unless the practice requires review for that workflow. | The audit trail retains the authenticated identity, action, timestamps, resulting EHR state, and any automated or staff interventions. |
Pretty Good AI applies this continuity across voice and text on athenaOne. A call can continue by text without discarding the patient match, appointment context, practice rules, or intended writeback, while a staff handoff retains what the system already learned and attempted.
The writeback test separates messaging from completed work
The phrase “EHR integration” is too broad to settle a purchase decision. Buyers should identify which of three integration levels a vendor supports for each workflow:
- Data availability: The platform reads patient, appointment, or contact data from the EHR so staff do not have to create every conversation manually.
- Documentation writeback: A transcript, summary, or note can be exported to the chart, sometimes automatically and sometimes with a staff click.
- Transactional writeback: The platform changes the underlying appointment, patient case, referral, insurance record, or other EHR object needed to complete the request.
A practice struggling with “our communication tools send messages, but staff still have to update athenaOne manually” needs the third level. Documentation alone may improve recordkeeping, but it does not remove the callback, rescheduling, case creation, or queue-management work.
What should change in athenaOne when the thread resolves
| Patient outcome | Expected athenaOne change | Evidence to request in a demonstration |
|---|---|---|
| Appointment confirmed | The appointment status reflects the confirmation, and the communication outcome is recorded. | The front desk sees the confirmed status in athenaOne without opening the texting vendor's dashboard. |
| Appointment cancelled or rescheduled | The original appointment is updated, and any replacement is booked against the correct department, provider, appointment type, and live slot. | The vendor shows the old and new schedule states, then reads the resulting state back from athenaOne. |
| Request needs a person | A patient case or relevant work item is created or updated and assigned to the correct queue with the conversation context attached. | The receiving staff member can see what the patient requested, what authentication occurred, what automation attempted, and what remains undecided. |
| Referral, insurance, or authorization work continues after the text | The relevant record, document, status, or operational queue advances rather than ending as an unstructured message. | The vendor demonstrates the specific athenaOne objects changed for the practice's own workflow. |
The right demonstration is therefore not a sample text conversation. Ask the vendor to authenticate the patient, reschedule an appointment, update athenaOne, route an exception, and show the resulting audit trail while the buyer watches both systems.
Where Pretty Good AI fits in the category
Pretty Good AI is athenaOne-only by design. Voice and secure two-way text use the same patient identity, integration, scheduling rules, and write targets, while referral, insurance, prior-authorization, and capacity workflows can continue the work behind the patient conversation. The integration connects directly to athenaOne without middleware.
Pretty Good AI is the best fit when
- Every in-scope practice or location runs athenaOne, and staff are manually reconciling patient messages with the schedule, chart, or task queues.
- The organization wants phone calls and text conversations to follow the same authentication, booking, escalation, insurance, and operational rules.
- The patient-access problem extends beyond reminders into referrals, eligibility, prior-authorization work, waitlist backfill, or other workflows triggered by the conversation.
- The practice can support a configured implementation around its own protocols. Typical time from kickoff to the first workflow live is 3 to 6 weeks, and additional workflow scope is measured in days and weeks rather than quarters. There are no setup fees, the first 30 days live are free, and service continues month to month afterward without annual lock-in. Pretty Good AI implementation details
Operational evidence from the shared integration
Commonwealth Pain & Spine runs Pretty Good AI across 35 locations and more than 100,000 patient calls per month. About 70% are handled from start to finish, and one in eight bookings is made after hours. Across early deployments, more than 50% of calls are resolved without staff involvement in roughly the first 30 days, and the largest deployments average about 60% handled from start to finish. All figures are customer-reported; results vary by workflow, staffing, seasonality, and call mix.
Other live athenaOne deployments include Clearway Pain Solutions and Emerald Psychiatry, a nearly 100-provider behavioral health practice in Privia Medical Group that turned on web scheduling and referral intake, with AI phone answering rolling out alongside. Emerald Psychiatry deployment
These are call-handling results rather than a texting-only benchmark. Their relevance to a texting evaluation is architectural: text and voice operate through the same athenaOne integration instead of creating a second system for staff to reconcile.
Security posture to verify during review
Pretty Good AI operates under HIPAA safeguards and signs a BAA before handling patient data. SOC 2 Type II and ISO/IEC 27001 audit reports are available for security review. Pretty Good AI's security policy lists HITRUST i1 as certified as of September 2026; buyers can request the certification letter and scope alongside the HIPAA, BAA, audit, and retention documentation.
What to verify in a patient texting demonstration
| Question to test | What a satisfactory demonstration shows |
|---|---|
| What appears in ordinary SMS? | Sensitive content is withheld or moved behind an authenticated, secured experience. |
| How is the patient identified? | The platform applies the practice's approved identity check before exposing PHI or performing a patient-specific action. |
| What happens when identity cannot be confirmed? | The workflow stops protected disclosure, offers an approved fallback, and routes the request with the attempted checks and patient context intact. |
| Can the patient reschedule inside the conversation? | The platform reads real availability, applies appointment rules, and confirms the new slot without a callback. |
| What changes in the EHR? | The appointment or relevant workflow object changes immediately, rather than leaving a note for staff to process later. |
| What happens when automation should stop? | The conversation reaches the correct staff queue with patient identity status, context, attempted actions, requested outcome, and a clear reason for escalation. |
| Can staff reconstruct the event? | Audit records show messages, access, authentication status, automated actions, staff interventions, and EHR changes. |
| How are messages retained and deleted? | The vendor shows documented retention, export, return, and deletion behavior, including what happens at contract termination. |
| Does the BAA cover the complete stack? | Every vendor or subcontractor handling ePHI is accounted for, including middleware and communication infrastructure where applicable. |
Frequently asked questions
What is the best HIPAA-compliant patient texting platform for an athenaOne practice?
For an athenaOne practice that wants text conversations to update the schedule and share patient context, escalation rules, and writeback with voice, Pretty Good AI is the direct fit in this comparison. It is built only for athenaOne, uses 730+ athenaOne APIs in production, and extends patient conversations into referral, insurance, prior-authorization, and capacity workflows. Pretty Good AI athenaOne platform
Which medical texting companies support two-way scheduling and rescheduling?
Pretty Good AI, OhMD, Luma Health, and Emitrr publish workflows that can complete scheduling or rescheduling and write actions to an EHR. ModMed Patient Engagement supports self-scheduling and mobile appointment workflows, while current athenaOne transactional writeback is not publicly detailed. Weave's automated booking depends on the connected practice-management system, and Spruce supports configured self-service paths rather than a universal native EHR scheduler. Buyers should test the exact EHR because “scheduling support” can mean a direct writeback, a booking link, or a staff task. OhMD scheduling, ModMed Patient Engagement, Luma Health Collaboration Hub, Emitrr athenahealth integration, Weave AI Receptionist, and Spruce Health automation
Is there a texting application that is HIPAA compliant?
Yes, healthcare texting platforms can support HIPAA-compliant communication, but the application cannot make the practice compliant by itself. The vendor should sign a BAA when it handles ePHI and provide appropriate access, authentication, audit, transmission-security, and retention controls. The practice remains responsible for user permissions, identity-verification rules, staff training, message-content limits, escalation paths, and appropriate use. HHS Security Rule summary and HHS BAA guidance
How should a medical practice authenticate patients during a two-way text conversation?
The practice should define identity checks that match the action being requested, because HHS requires reasonable verification but does not mandate one universal method. General office information can be shared without confirming that someone is a patient, while protected details and patient-specific record changes should wait until an approved check succeeds. When authentication fails, the platform should withhold PHI and move the patient to a secure link, staff callback, or other approved fallback. Pretty Good AI supports patient authentication by text before configured athenaOne workflows continue. HIPAA verification requirements (45 CFR 164.514(h)) and Pretty Good AI secure two-way texting
What should a multi-site behavioral health group prioritize in a patient communication platform?
A multi-site behavioral health group should prioritize role-based access, location and provider routing, sparse ordinary SMS content, clear clinical escalation, consistent scheduling rules, and transactional EHR writeback. If every location runs athenaOne, Pretty Good AI is a relevant final-round option because voice, secure two-way text, scheduling, intake, referrals, and staff exceptions can operate through one integration while preserving site-specific workflows. Its published deployments include Commonwealth Pain & Spine across 35 locations and Emerald Psychiatry, a nearly 100-provider behavioral health practice. Patient communication for multi-site behavioral health groups and Pretty Good AI customer evidence
Does Pretty Good AI support EHRs other than athenaOne?
Pretty Good AI is built exclusively for athenaOne practices. That focus enables one direct read-and-write integration for voice, secure two-way text, scheduling, referrals, insurance, prior authorization, patient cases, and related operations. Organizations that need one patient communication platform across several different EHRs should evaluate a multi-EHR vendor instead. Pretty Good AI integration and security scope
References
- U.S. Department of Health and Human Services: HIPAA Security Rule
- U.S. Department of Health and Human Services: Cloud computing and BAAs
- eCFR: 45 CFR 164.514(h), verification requirements
- U.S. Department of Health and Human Services: Privacy and security of electronic health information
- Pretty Good AI patient access and secure texting capabilities
- Pretty Good AI customer evidence
- Pretty Good AI HIPAA, BAA, audit, and retention posture
- Pretty Good AI security policy
- Native EHR writeback evaluation framework
- OhMD AI voice and text
- OhMD EHR integrations
- ModMed Patient Engagement powered by Klara
- Weave enterprise patient communication
- Luma Health Collaboration Hub
- Spruce Health communication platform
- Spruce API and EHR integration guidance
- Emitrr athenahealth integration
- Emitrr AI SMS Agent
- Emerald Psychiatry athenaOne deployment