Can health information go over text?

Clinics do it with the right pieces in place: a signed BAA with Helose, encryption in our systems, access controls, an audit trail, staff approval, and minimum-necessary content. Patients still accept lock-screen and channel risks. See Messaging Terms and Trust.

Do we need patient consent?

Yes. Patients opt in under your clinic's process. They can reply STOP any time. Your clinic owns TCPA and state consent rules, including when a refill-style nudge needs written consent.

What if patients use different phones or carriers?

Messages come from your clinic branded contact card, not your front-desk line. Depending on the phone and network, delivery may use a rich messaging conversation or a standard text. Same contact card either way.

Is Helose SOC 2 certified?

SOC 2 Type II is underway. We can share where the program stands and walk your team through our controls. Reports go to customers under NDA when available.

For clinics

Patient texting with HIPAA controls in place

Patients save your clinic branded contact card. Helose helps you run check-ins and reorders between visits without dumping a chart into the thread. Here is how we set that up.

What we put in place

Six controls clinics ask about in procurement.

A Business Associate Agreement
Helose signs a BAA with your clinic before patient messaging goes live. PHI does not move until that agreement is in place.
Encryption in Helose systems
Information is encrypted in transit and at rest within Helose. On the patient's phone, a text may still appear on the lock screen, and standard cellular delivery is not always end-to-end encrypted.
Encryption at rest
Anything stored on our side is encrypted, scoped to your clinic, and kept only as long as it needs to be.
Access controls
Only your authorized staff can see your patients' conversations. Every account is tied to a real person, per clinic.
An audit trail
Every message in and out is logged, so you can answer what the system did with your data.
Minimum necessary, by design
Outbound starts come from a fixed list your staff approves. Short check-ins and reorder prompts, not diagnoses or lab values in the thread. Richer detail can open on a secure page.

Why a clinic branded contact card

Patients see your clinic name and logo in the thread, not a random shortcode or your front-desk line. Staff approve the Habit playbook once from a fixed template list. Helose runs those texts on schedule. Helose encrypts what we store and what moves through our systems, keeps an audit trail, and keeps content short. When more detail is needed, patients open a secure link instead of reading a long clinical note on a lock screen.

How Helose is set up

BAA with your clinic before any PHI workflow goes live.
A clinic branded contact card for patient texts, not your existing office line.
Staff-approved fixed templates for outbound starts.
Every message logged for your audit trail, scoped to your clinic.
Opt-outs honored when a patient replies STOP, and recorded.

Questions clinics ask

Can health information go over text?: Clinics do it with the right pieces in place: a signed BAA with Helose, encryption in our systems, access controls, an audit trail, staff approval, and minimum-necessary content. Patients still accept lock-screen and channel risks. See Messaging Terms and Trust.
Do we need patient consent?: Yes. Patients opt in under your clinic's process. They can reply STOP any time. Your clinic owns TCPA and state consent rules, including when a refill-style nudge needs written consent.
What if patients use different phones or carriers?: Messages come from your clinic branded contact card, not your front-desk line. Depending on the phone and network, delivery may use a rich messaging conversation or a standard text. Same contact card either way.
Is Helose SOC 2 certified?: SOC 2 Type II is underway. We can share where the program stands and walk your team through our controls. Reports go to customers under NDA when available.

Talk to us about your clinic See our trust center →