Secure Texting of Patient Information and Orders: What Hospitals Need to Know

Healthcare texting policy has changed substantially since the original version of this article was published in 2016. Hospitals should therefore avoid relying on older summaries that describe texted patient orders as categorically prohibited.

CMS revised its policy in February 2024, and The Joint Commission subsequently updated its position. Under current guidance, hospitals and critical access hospitals may use secure texting for patient information and orders when the required privacy, security, authentication, documentation, and medical-record conditions are satisfied.

Understanding the Current Secure Texting Requirements

Start with the current CMS position

CMS states that texting patient information and patient orders among members of the healthcare team is permissible when it is accomplished through a HIPAA-compliant secure texting platform and complies with the applicable Conditions of Participation. Computerized Provider Order Entry remains the preferred method for entering orders.

That is a meaningful change from earlier CMS guidance, which allowed secure texting of patient information but prohibited texting patient orders. Hospitals should use the current CMS memorandum rather than relying on the older policy.

The current CMS source is available in the Texting of Patient Information and Orders for Hospitals and CAHs memorandum.

Review The Joint Commission's current guidance

The Joint Commission aligns its current guidance with the revised CMS policy. Its current standards FAQ permits organizations to choose secure texting for patient information and orders when the platform and workflow meet the applicable requirements.

The FAQ also emphasizes that the organization remains responsible for the integrity and security of the texting environment. Hospitals can review the current Joint Commission secure-texting FAQ directly when evaluating their policy.

Use a secure texting platform

Ordinary consumer texting should not be treated as equivalent to a secure healthcare messaging environment. The platform needs to support the privacy and security protections required for the information being communicated.

CMS requires organizations to maintain systems that protect privacy and confidentiality and preserve the integrity of author identification. The organization should evaluate encryption, authentication, access controls, device management, auditability, and other controls within its own environment.

Preserve the identity of the author

Hospitals need to know who sent the information or order. Shared accounts, ambiguous sender identity, or communication that cannot be reliably attributed create problems for both care coordination and documentation.

Secure messaging workflows should therefore support authenticated individual access and appropriate permissions. Administrative processes should also address account provisioning, role changes, access reviews, and offboarding.

Make sure orders reach the medical record

Texting an order does not remove the requirement to maintain a complete medical record. Current CMS and Joint Commission guidance requires texted orders to be promptly placed in the medical record and appropriately dated, timed, and authenticated.

Hospitals should map this process explicitly before enabling texted orders. The secure-message workflow, EHR process, staff responsibility, and documentation procedure need to work together rather than assuming that sending the message completes the order process.

Assess the security and integrity of the workflow routinely

Compliance is not established only at implementation. CMS and The Joint Commission expect organizations using secure texting to have procedures for routinely assessing the security and integrity of the systems involved.

Those reviews can include access, authentication, device policies, audit records, workflow changes, staff behavior, integrations, and how information moves into the medical record. The organization should also review relevant state requirements and its own legal and compliance policies.

Distinguish secure messaging from urgent alerting

Healthcare teams use mobile communication for several different jobs. A clinical discussion, patient-information exchange, urgent page, facility alarm, on-call activation, and patient order do not necessarily require the same workflow.

HipLink Secure Text Messaging supports encrypted mobile communication, response visibility, access controls, and audit history for healthcare teams. Hospitals should still validate the specific regulatory and EHR requirements of any workflow involving patient orders before enabling it.

Define which communication belongs in the secure app

Sensitive patient information should not simply move to standard SMS because SMS is convenient. Hospitals should establish which messages must remain inside the approved secure application and which operational messages can use other configured delivery methods.

That distinction can reduce uncertainty for staff. The communication policy becomes clearer when employees know which channel to use for protected information, urgent paging, routine operational alerts, and broad notifications.

Train staff around the workflow, not only the application

A secure platform does not automatically create a compliant operating process. Staff members need to understand which messages are permitted, how orders are documented, how patient identity is verified, when another communication method should be used, and what to do if the normal workflow fails.

Training should reflect the hospital's actual policy and EHR environment. Technical configuration, clinical policy, records requirements, and staff behavior need to support the same process.

How HipLink supports secure healthcare communication

HipLink Mobile supports encrypted messaging, secure attachments, hospital paging, response tracking, device controls, and activity records for healthcare teams. It can support secure communication across clinical and operational workflows without requiring sensitive information to move through ordinary SMS.

Healthcare organizations can explore Secure Text Messaging and review the broader Healthcare environment. You can also request a personalized demo when you want a walkthrough of the workflow.

Frequently Asked Questions

Can hospitals text patient orders?

Current CMS and Joint Commission guidance permits hospitals and critical access hospitals to text patient orders when the required secure-platform and medical-record conditions are met. CPOE remains the preferred order-entry method.

Can standard SMS be used for patient information?

Hospitals should not treat ordinary SMS as equivalent to a HIPAA-compliant secure texting platform for protected patient information. The organization needs an approved environment with the privacy, security, authentication, and documentation controls required for its use case.

Does a secure messaging app automatically make texted orders compliant?

No. The full workflow also needs to address author identification, documentation, medical-record requirements, organizational policy, security review, and other applicable obligations.

Does HipLink replace the hospital's EHR order-entry system?

No. HipLink provides secure communication and alerting capabilities, while the hospital remains responsible for the EHR, medical-record process, clinical-order workflow, and compliance requirements.