Is Texting Patients HIPAA Compliant? A Dentist's Guide (2026)

Does HIPAA let a dental practice text patients?

Yes. The HIPAA Privacy Rule treats an appointment reminder as part of treatment, so you do not need a separate authorization to send one. HHS says this plainly.

The limit is on what the message says. The minimum necessary standard does not apply to a message you send to the patient about their own care, but that is not a license to put clinical detail in a text. A reminder can be read on a lock screen or seen by someone holding the phone, so the safe content is the logistics of the visit and nothing about why the patient is coming in.

Patients also get a say in how you reach them. Under 45 CFR 164.522(b), a patient can ask you to use a specific number or channel, and you have to accommodate a reasonable request. If someone asks you not to text them, that preference belongs in their record.

One more HIPAA point sits behind the scenes: the service that sends the texts. Most reminder and texting platforms store your patient list and the messages, so they create, receive, or maintain protected health information on your behalf, which makes them a business associate that needs a signed agreement. A pure phone carrier that only passes a message along, without storing it, is the narrow conduit exception. If you are not sure which one your vendor is, treat it as a business associate and get the agreement.

What can you put in a text reminder, and what you can't?

Treat the text like a postcard a stranger could glance at. The date, the time, where to go, and who to call are fine. The reason for the visit is safer left out, because a text can be read by whoever is holding the phone.

Is texting patients a TCPA violation?

Not by itself. The TCPA, the Telephone Consumer Protection Act, treats a text as a phone call, and it runs on the FCC's rulebook, not HIPAA's. The question it asks is narrow: did you have the patient's consent to send an automated text to that number, and is the message about their care rather than a promotion?

For a dental practice, that consent usually already exists. There is no blanket exemption for health care texts, but the FCC has long treated a patient who gives a health care provider their cell number as having consented to care-related messages at that number, within the scope of the relationship and absent instructions otherwise. The American Dental Association describes the same rule. Courts have been re-examining how far that rule reaches, so treat it as the usual starting point rather than a guarantee: a reminder sent to a patient who gave you their number, with no marketing in it, generally clears the consent bar.

Marketing changes everything. A text promoting whitening or a membership plan is not a care message, and it needs the patient's prior express written consent before it goes out. Folding a promotion into an otherwise routine reminder is the fastest way to lose the protection the reminder had.

What about consent and opt-outs?

The opt-out rules got stricter in 2025. Since April 11, 2025, a patient can revoke consent using any reasonable method, not just a keyword you chose for them. A reply of STOP counts, and so does any clear wording to the same effect. Once it arrives, you have to stop.

One newer wrinkle works in your favor, for now. The FCC has a "revoke-all" rule that would treat a STOP to one kind of message as a STOP to everything you send. In January 2026 the FCC pushed that requirement back to January 31, 2027, so for now an opt-out applies to the program the patient replied to. The simpler practice is to honor it broadly anyway.

There is also a Do Not Call angle. Texts to a number on the National Do Not Call Registry can draw a claim, and courts are still working out exactly how those rules apply to texts. The safe path does not depend on the outcome: text patients who gave you their number for care, keep marketing on a separate track, and honor every opt-out.

What did Jefferson Dental do wrong?

In 2024, a Texas dental group showed how the opt-out rule bites. Jefferson Dental, a network of more than 60 clinics run by JDC Healthcare Management, faced a class-action lawsuit claiming it kept sending marketing texts to people who had already replied STOP, and to numbers listed on the National Do Not Call Registry, over a four-year stretch.

The company denied any wrongdoing, but agreed to pay about $1 million to settle. The deal covered roughly 10,000 people, which works out to a small check each. The lesson for a solo practice is not the headline number. It is that the texts were not exotic. They were ordinary marketing texts that ignored opt-outs, and the per-message math did the rest.

You do not have to guess whether your texting setup has the same gap. The free HIPAA Scorecard checks your vendor coverage and your patient-communication practices along with eight other core controls, and names your top gap in about three minutes. It is a starting point, not a full audit, but it tells you where you stand.

A texting class action is also exactly the kind of liability that a dental practice's cyber and liability insurance is meant to absorb, though policies vary widely on what they actually cover.

How to text patients the right way

None of this requires a lawyer. Five habits keep a dental practice on the right side of both laws.

A compliant texting setup is not expensive. Most practice-management platforms include reminders under a business associate agreement, and the secure version costs a fraction of what one ignored opt-out can. The costly path is the one Jefferson Dental took, after the fact. Email raises a parallel set of questions, which we cover in is your dental practice's email HIPAA compliant.

This is general information about HIPAA and the TCPA, not legal advice. The TCPA changes often and varies by state, and your own risk analysis decides what is reasonable for your specific practice. When a texting program grows large or starts to include any marketing, have it reviewed by counsel.

About the author

Dolev Arama is Hipsana's founder. He's the one behind the Scorecard and the short risk reviews it produces. He is not an attorney, and Hipsana is a publisher and referral service, not a law firm or a healthcare provider. The writing here starts where the rules actually live, at HHS, OCR, and NIST, and gets checked against their current text before it goes up. If a line can't be sourced, it doesn't run. More about Hipsana →

Sources

• HHS Office for Civil Rights, FAQ 286, “Are appointment reminders allowed under the HIPAA Privacy Rule without authorizations?” (accessed June 2026).
• 45 CFR § 164.522(b) (confidential communications) and § 164.502(b) (minimum necessary, including uses and disclosures to the individual) (eCFR, current).
• 45 CFR § 164.312(e) (transmission security, an addressable specification) (eCFR, current).
• 45 CFR § 160.103 (definition of “business associate”); HHS, Modifications to the HIPAA Rules (Omnibus Rule), 78 FR 5566 (Jan. 25, 2013); and HHS guidance on cloud computing and the conduit exception (hhs.gov, accessed June 2026).
• Federal Communications Commission, 2015 TCPA Omnibus Declaratory Ruling and Order, FCC 15-72, 30 FCC Rcd 7961 (July 10, 2015) (health care message exemption; prior express consent).
• Federal Communications Commission, 1992 TCPA Order, 7 FCC Rcd 8752 (1992) (providing a telephone number constitutes prior express consent to be called at that number, absent instructions to the contrary).
• 47 CFR § 64.1200 (FCC rules implementing the TCPA: consent, revocation of consent, and the National Do Not Call Registry) (eCFR, current).
• Federal Communications Commission, Consumer and Governmental Affairs Bureau, Order DA-26-12A1 (Jan. 6, 2026) (extending the “revoke-all” provision of § 64.1200(a)(10) to January 31, 2027).
• 47 U.S.C. § 227(b)(3), (c)(5) (TCPA private right of action; statutory damages of $500 per violation, up to $1,500 for willful or knowing violations).
• American Dental Association, “Follow the Rules When Phoning Patients” (TCPA health care message guidance; accessed June 2026).
• Lee v. JDC Healthcare Management, LLC (doing business as Jefferson Dental), TCPA class-action settlement (2024); the company denied wrongdoing.