Home / Blog / Is texting patients HIPAA compliant? A dental office checklist for automated texts

Is texting patients HIPAA compliant? A dental office checklist for automated texts

What HIPAA, the TCPA and your vendors' BAAs require before a dental office automates patient texts: what to leave out, which tools need a BAA, and a checklist.

By · Published · 9 min read

Your front desk already texts patients from a phone or your practice software. The question usually comes up when someone wants to automate more of it: a text back when a call is missed, recall reminders, a nudge about unscheduled treatment. Is that allowed, and what has to be in place first?

The short version: HIPAA doesn't ban texting patients, but it makes you responsible for what the text says and for every company whose systems carry it. A separate federal law, the TCPA, decides whether you may send the text at all. Most problems come from the second and third parts, not the first.

Not legal advice. We build and test automations; we're not lawyers or compliance officers. This is a plain-English summary of primary sources, checked on October 28, 2026. State privacy laws, your dental board and your own risk analysis add to it. Have your compliance officer (or a healthcare lawyer) sign off before you switch anything on.

What HIPAA says about texting patients

The Department of Health and Human Services (HHS), which enforces HIPAA, has answered the basic questions in its FAQs:

  • Appointment reminders are allowed without a signed authorization. HHS says they "are considered part of treatment" (HHS FAQ 286).
  • Unencrypted electronic messages aren't banned, but they need "reasonable safeguards". HHS's FAQ on email says providers may communicate electronically with patients if they take precautions, such as limiting "the amount or type of information disclosed" in unencrypted messages (HHS FAQ 570). The FAQ is about email; HHS's reasoning is the usual guide for plain SMS too, which is also unencrypted.
  • Patients can ask you to use a different channel. A provider "must accommodate reasonable requests" to communicate by alternative means (45 CFR 164.522(b)). If a patient says "don't text me", that needs to reach your automation, not just the chart.
  • Send the minimum. You must make "reasonable efforts to limit protected health information to the minimum necessary" (45 CFR 164.502(b)).

In practice, the safest automated text says almost nothing: the practice name, a phone number or booking link, and a way to opt out. No procedure, no balance, no "your crown is ready". Compare Hi, this is Smile Dental. Sorry we missed your call. Reply here or call 555-0100. Reply STOP to opt out. with Hi Ana, reminder that your root canal with Dr. Lee is Tuesday at 3. The first one is far easier to defend if it reaches the wrong phone.

Remember that patient replies can contain PHI even when your message doesn't. "Is this about my biopsy?" sitting in a texting log is health information, so the systems that store replies need the same care as the systems that send.

Every tool that touches patient data needs a BAA

This is where automations most often go wrong. HHS's cloud guidance says that a cloud service that creates, receives, maintains or transmits electronic PHI for you is a business associate, even if it only stores encrypted data it can't read, and that using one without a business associate agreement (BAA) puts you "in violation of the HIPAA Rules" (HHS guidance on HIPAA and cloud computing). The "conduit" exception is narrow: HHS limits it to transmission-only services with no more than temporary storage.

A typical automated texting setup has at least four vendors. Here's what we found on each one's own pages:

Tool BAA available? What we found
Twilio (SMS) Yes, with conditions Twilio's docs say "HIPAA Accounts require Twilio Security Edition or Enterprise Edition", bought through Twilio Sales, plus a signed Business Associate Addendum (Twilio docs). Twilio's HIPAA page describes compliance as "a shared responsibility" (Twilio HIPAA page), and the docs above list which products are HIPAA-eligible. Budget for the edition upgrade, not just per-message fees.
n8n Cloud (the automation engine) Not that we could find n8n's Trust Center lists GDPR, SOC 2 and SOC 3, not HIPAA. A January 2026 reply on n8n's community forum says "n8n does not offer a Business Associate Agreement (BAA)". That reply is from a community Top Supporter ('achamm'), not n8n staff, so it isn't an official statement; so ask n8n directly if Cloud matters to you. Until then, self-host n8n on a server whose provider signs a BAA with you.
Google Workspace (Sheets for call lists and logs) Yes Google says HIPAA customers "must enter a Business Associate Amendment (BAA) with Google" before using PHI in covered services (Google Workspace HIPAA help). Accept it in the Admin console first.
Your practice software and clearinghouse Check your contract Most dental software and eligibility vendors offer one, sometimes only on specific plans. Read your contract before connecting an automation to them.

Can you skip Twilio's HIPAA offering if your texts never contain PHI? Some practices take that view for strictly generic messages. But a phone number linked to your dental office, the fact that someone is a patient, and their replies can all count as PHI. That's a judgment for your compliance officer, made in writing as part of your risk analysis, not something to assume.

Whether you may text at all is a different law: the TCPA

HIPAA covers privacy. The Telephone Consumer Protection Act decides whether an automated text needs consent. Its FCC rules are in 47 CFR 64.1200.

There's a specific exemption for healthcare providers in section (a)(9)(iv), but it comes with conditions. Among them:

  • texts go only to the wireless number the patient provided;
  • they state the provider's name and contact information;
  • they're limited to purposes such as "appointment and exam confirmations and reminders, wellness checkups" and similar care messages;
  • they contain no telemarketing, solicitation or advertising, and no "accounting, billing, debt-collection, or other financial content";
  • 160 characters or less;
  • at most one message a day and three a week per patient;
  • every message explains how to opt out by replying "STOP", and opt-outs are honored immediately.

Two caveats. The (a)(9) exemptions apply only when the text "is not charged to the called person or counted against the called person's plan limits", which ordinary business texting may not guarantee. And a recall reactivation or "time to finish your treatment" message may drift toward marketing. So most practices also collect written text consent on their intake or registration form and record it in the chart, and treat the exemption as a backstop. Ask your counsel which approach fits.

Separately, section (a)(10) lets patients revoke consent "by using any reasonable method". Replies such as "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" count automatically, and a revocation must be honored within ten business days at most. Your automation should stop on those words and flag anything else that sounds like "please stop" for staff.

For texts to people who called you and didn't get through, see Is missed-call text-back legal?. It covers the TCPA gray zone and US carrier registration (A2P 10DLC), which applies to dental offices too.

Reminders vs. marketing under HIPAA

HIPAA has its own definition of marketing: a communication "that encourages recipients ... to purchase or use the product or service". It excludes communications for treatment, and for describing a health-related service the provider itself offers, unless the provider is paid by a third party to send them (45 CFR 164.501). Recall reminders and follow-ups on treatment you recommended usually sit in the excluded group. A text promoting whitening on behalf of a manufacturer that pays you would not.

Review requests are a gray area for TCPA consent purposes. Ask your compliance officer whether your office treats them as treatment-related messages or as marketing, and gate them accordingly.

Review replies are where dental offices have actually been fined

In December 2022, HHS's Office for Civil Rights settled with New Vision Dental, a California practice whose replies to Yelp reviews disclosed patients' names, treatment and insurance details. The practice paid $23,000 and agreed to a two-year corrective action plan (HHS settlement page). If any tool drafts review replies for you, the draft should never confirm the reviewer is a patient, and a person should approve it before it's posted.

The checklist

  • Your risk analysis lists every tool in the texting chain (SMS provider, automation server, spreadsheet, practice software) and the data each one sees.
  • You have a signed BAA with each of them, or a written decision by your compliance officer on why one isn't needed.
  • n8n (or any automation server) runs where a BAA covers it; n8n Cloud isn't an option unless n8n confirms a BAA in writing.
  • Automated texts carry no names, procedures, appointment details or balances; just the practice name, a callback number or link, and opt-out wording.
  • Text consent is recorded in the chart, and the automation checks it before every send.
  • Opt-out words and plain-English "stop texting me" replies end texts from every automation, and update the chart.
  • Every automation shares one counter, so a patient never gets more than one automated text a day or three a week across all of them.
  • Your Twilio number has an approved A2P 10DLC campaign.
  • Review replies are drafted generically and approved by a person.
  • You only run one recall system: either your practice software's built-in reminders or the automation, not both.

How our dental recipes handle this, and what they don't

We publish five n8n recipes for Open Dental offices. All of them were tested on October 28, 2026 against a mock server built from Open Dental's, Twilio's and the other vendors' API docs, with field names compared against Open Dental's public test database (read-only). None has run in a live practice. None uses AI to write messages.

  • Missed-call text-back sends one generic text with no name or appointment details, at most once per 12 hours per number, checks Twilio's webhook signature, and writes a STOP reply back to Open Dental so the patient isn't texted again.
  • Overdue recall and reactivation sends up to three generic reminders at least 14 days apart, one per family phone, and gives staff a call list for patients without text consent. It overlaps with Open Dental's own recall texts, so turn one off.
  • Unscheduled treatment follow-up builds a weekly call list and sends at most two generic booking nudges, 30 or more days apart. It shares a send ledger with the other recipes to keep to one text a day and three a week.
  • Review requests with a response guard sends the same request to every patient with text consent (no pre-screening, no incentive), suggests privacy-safe reply wording and flags risky phrases. It never posts anything itself.
  • Insurance verification prep runs eligibility checks through Stedi, which requires Stedi's HIPAA account and BAA, and doesn't text patients at all.

What they don't do: sign BAAs for you, decide whether a message counts as marketing, or replace your compliance officer's review. Each recipe page lists exactly what was tested and what's only documented. For the full list of rules we design around, see the dental hub.

Sources

All checked on October 28, 2026.

The recipe for this problem

  • Missed-call text-back for dental offices, with no patient details in the text (Open Dental + Twilio)
    When a call to the practice is missed, the caller gets one short text within seconds: sorry we missed you, we'll call back, here is the online booking link (after hours: we're closed, here is the emergency line). The text never contains a name, appointment or treatment. Front-desk staff get a callback row in a Google Sheet, the call is logged on the patient's chart in Open Dental, and STOP replies are written back to Open Dental so no recipe texts that number again.
    Verified with mocks · last tested 2026-10-28 · setup, cost and test results
  • Overdue recall and reactivation texts with a call list (Open Dental recall list)
    Each weekday morning the workflow reads Open Dental's recall list for patients who are past due and not booked, sends up to three generic reminders 14+ days apart ('it's time to book a checkup', with your online booking link) and records each one on the recall the same way Open Dental's own recall list does. Families sharing a phone get one text. Patients without text consent, and those who got three reminders and still didn't book, go on a call list.
    Verified with mocks · last tested 2026-10-28 · setup, cost and test results
  • Unscheduled treatment follow-up: weekly call list plus a generic booking nudge (Open Dental)
    Every week the workflow finds treatment-planned procedures in Open Dental that have no future appointment and builds a call list for the treatment coordinator: patient, planned codes, fee and date presented. Patients who agreed to texts get at most two generic nudges per plan, 30+ days apart ('you have a follow-up visit to schedule with us'), never the procedure, tooth or fee. Patients who book drop off; patients who reply or opt out become call-only.
    Verified with mocks · last tested 2026-10-28 · setup, cost and test results
  • Review requests after every visit, plus a privacy check on review replies (Open Dental)
    Part 1: every evening, each patient with a completed visit and text consent gets the same short request for a Google review, at most once a year and once per family phone. There is no 'were you happy?' pre-screen and no incentive. Part 2: when a new public review arrives, the office manager gets an email with a privacy-safe reply template and, if a staff draft was attached, a list of phrases in it that would confirm the reviewer is a patient or reveal care, dates or amounts. Nothing is posted automatically and the reviewer is never looked up in Open Dental.
    Verified with mocks · last tested 2026-10-28 · setup, cost and test results
  • Insurance verification prep 72 hours ahead: eligibility check and front-desk checklist (Open Dental + Stedi)
    Each weekday at 7 am the workflow takes every appointment three days out, follows the patient's insurance in Open Dental (plan, subscriber, carrier), runs a real-time eligibility check through Stedi and writes a checklist for the front desk: active or not, deductible and annual maximum left, coinsurance, and what to do next. Active coverage is marked verified in Open Dental with a note. Inactive plans, payer errors, low remaining maximums and patients without insurance are flagged for a person. Patients get no text.
    Verified with mocks · last tested 2026-10-28 · setup, cost and test results

Found an error or a better source? Corrections policy. More articles on the blog.