TL;DR: A therapy or behavioral health practice should review its texting program across infrastructure, message content, consent, and staff access. HIPAA generally applies the same Privacy Rule to mental health information as to other protected health information, with specific exceptions such as psychotherapy notes, so neutral appointment reminders are a privacy safeguard chosen by the practice, not a special HIPAA texting rule (HHS mental health guidance). Beam supports HIPAA compliant texting through compliant carrier infrastructure; each practice remains responsible for its own policies and safeguards.
A therapy or behavioral health practice can text appointment logistics, while choosing neutral wording that does not name a diagnosis, medication, session type, or reason for treatment. HIPAA generally treats mental health information under the same Privacy Rule as other protected health information, with particular rules for psychotherapy notes and other specific circumstances (HHS mental health guidance). A practice may still adopt a more conservative content policy because a notification can appear on a shared phone or lock screen. Beam supports HIPAA compliant texting through compliant carrier infrastructure; the practice still owns its content rules, consent records, and staff access controls.
What does HIPAA compliant texting actually require for a therapy or behavioral health practice?
Three layers have to line up, and none of them is optional. The first is infrastructure: review the vendor’s safeguards and determine whether its role makes it a business associate. A covered entity generally needs a written business associate agreement when a vendor creates, receives, maintains, or transmits protected health information on its behalf (HHS business associate guidance). The second is content: what the message actually says, filtered through the minimum necessary standard, which asks a covered entity to limit protected health information to the amount reasonably needed for the purpose at hand (HHS minimum necessary guidance). The third is access and consent: who can read a thread, how the client or guardian agreed to receive it, and what happens the moment someone wants to stop.
A practice should not assume that behavioral health has a separate general texting rule under HIPAA. The minimum necessary standard does not apply to disclosures to the individual who is the subject of the information, so HIPAA does not categorically bar naming a procedure in a reminder to that patient. A behavioral health practice may nevertheless choose stricter neutral wording because the fact of treatment can be sensitive to a particular client and rarely needs to appear for a reminder to do its job.
Why does a diagnosis or treatment detail change the calculus more than a routine appointment reminder?
A dental reminder that says “root canal follow up” discloses a dental procedure. A behavioral health reminder that says “anxiety and depression check-in” or “medication management for your ADHD prescription” reveals the visit’s subject. HIPAA generally applies the same Privacy Rule to mental health information as other health information, but a practice may decide that this detail is unnecessary and could expose private context on a lock screen or shared phone. This is a conservative privacy choice, not a claim that HIPAA creates a separate reminder-text ban for behavioral health.
That privacy choice is why a behavioral health practice may set “logistics only” as its default. Even the word “therapy” in a text thread name can tell a shared device more than a client wants shared. A conservative default strips the message down to time, date, and a neutral way to confirm or reschedule, with nothing describing the nature of the visit.
What can a therapy appointment or telehealth reminder text safely say?
Keep every routine template to four things: when, where (or which telehealth link), how to confirm or reschedule, and how to reach the practice for anything else. None of those four requires naming a diagnosis or a session type.
An appointment confirmation can read: “Hi [first name], you’re confirmed for [day] at [time] with our office. Reply C to confirm or R to reschedule.” A day-before reminder can say: “Reminder: your appointment is tomorrow, [day] at [time]. Reply if you need to reschedule.” For a telehealth visit, “Your session link for [day] at [time] is ready shortly before start: [link]. Reply if you have trouble connecting” gives the client what they need without naming the type of care. A missed appointment follow-up works the same way: “We missed you for your [day] appointment. Call or reply to find a new time that works.” An intake reminder can read: “Your first appointment is [day] at [time]. Please complete the intake form we sent before your visit: [link].”
None of these name a condition, a medication, or a session format beyond “telehealth” versus “in office,” and the telehealth template only names the format because a client needs to know which link to expect. Run every new template through the same test: does removing the clinical word change whether the client can act on the message. If not, the word does not belong in the text.
| Fits a routine behavioral health text | Stays off text entirely |
|---|---|
| Appointment date, time, and location or telehealth link | Diagnosis, condition name, or symptom description |
| A plain confirm or reschedule prompt | Medication name, dosage, or prescription detail |
| A generic practice name or neutral sender identity | Session type (individual, group, family, medication management) |
| Intake form or paperwork reminders | Anything describing risk, crisis history, or treatment progress |
| A number to call for anything beyond logistics | Billing detail tied to a specific diagnosis code |
Does 42 CFR Part 2 add anything beyond HIPAA for a substance use or dual diagnosis program?
For a practice that runs any federally assisted substance use disorder program, yes. 42 CFR Part 2 is a separate confidentiality regulation, administered alongside HIPAA rather than instead of it, that protects records showing someone received substance use disorder treatment (HHS, Understanding Confidentiality of Substance Use Disorder Patient Records, “Part 2”). It restricts redisclosing information that would identify a person as having received that treatment, without a consent that specifically covers that redisclosure.
Practically, a dual diagnosis or integrated behavioral health and addiction practice has a tighter content bar than a general therapy practice, because even confirming the existence of an appointment with a program covered by Part 2 can function as a disclosure the regulation is meant to prevent. A neutral practice name on the texting line, a reminder that never references the program, and a Part 2 specific consent signed separately from general treatment consent are the kind of controls counsel should review before a single template goes live.
How should consent work when the client is a minor, or the practice has multiple therapists?
Capture texting consent as its own record, separate from a general intake checkbox and separate from marketing consent. For a minor client, that consent typically comes from a parent or guardian, and the practice should decide up front whose phone gets the reminder, whether a teenage client’s own evolving right to consent under state law changes anything partway through treatment, and how a guardian revokes consent if the family’s situation changes.
In a multi-therapist practice, consent has a second layer: does the client expect only their assigned clinician to see their texts, or is a shared front-desk inbox acceptable for scheduling only. Many behavioral health clients assume more privacy than a general medical practice’s shared scheduling inbox provides, so say explicitly, at intake, who at the practice can see a text thread and for what purpose. A client who learns later that someone other than their therapist read a reply they sent is a trust problem worth avoiding.
Who should be able to read a client’s text thread, and how should a crisis reply get handled?
Default to the narrowest access that still lets scheduling happen: the assigned clinician and whichever front-desk role actually handles that client’s calendar, not the full staff roster. Give every teammate an individual login, assign each thread to one owner, and shut off access the same day someone leaves, not at the end of a pay period.
Crisis handling needs its own written rule, separate from general reply routing. Any text mentioning self-harm, suicidal thoughts, or an active emergency should trigger an immediate page to a specific clinician or on-call staff member, pause any automated sending on that thread, and point the client toward the practice’s emergency protocol or 911 if the message suggests they need it right now. The text channel’s job in that moment is only to get a human looking at the message fast, not to run the crisis conversation itself; staff should be trained to move that conversation to a phone call the moment it starts.
What should a therapy practice check before signing with any texting vendor?
Run this sequence before signing a contract, not after the first reminder campaign goes out:
- Ask the vendor directly whether a business associate agreement is available, in writing, and confirm exactly what it covers before assuming the answer is yes.
- Confirm the sender name or display identity options, so the texting line does not name a diagnosis-specific service, like an addiction or psychiatric program, on a client’s lock screen.
- Rewrite every existing template to remove diagnosis, medication, session type, and risk language, leaving only date, time, location or link, and a reply instruction.
- If any portion of the practice runs a federally assisted substance use disorder program, have counsel confirm which clients and records fall under 42 CFR Part 2 before any template references treatment type.
- Set up texting consent as its own record, including who consents for a minor client and how a guardian revokes it later.
- Limit thread access to the assigned clinician and the specific front-desk role that handles that client’s calendar, with individual logins and an owner on every thread.
- Write and train staff on a crisis-reply protocol before launch, including who gets paged and what the practice’s emergency escalation looks like.
- Get written sign-off from the practice’s privacy officer or counsel on the approved templates, the consent basis, and the access list, with the date and reviewer recorded.
A clean pass on a confirmation template does not carry over to a recall campaign, a billing reminder, or a different message type. Run each new template through the same checklist, because the content changes even when the vendor and carrier underneath it stay the same.
For the general content and access rules this builds on, what actually makes texting HIPAA compliant covers the vendor, consent, and access split in more depth, and the front desk texting checklist has additional reminder wording for a general practice to compare against. For the channel question underneath all of this, iMessage for healthcare patient communication covers what fits a routine clinical text regardless of specialty, and Beam’s texting compliance hub covers the registration and carrier side: A2P 10DLC, toll free verification, and the HIPAA basics in one place.
What do therapy and behavioral health buyers ask about HIPAA compliant texting?
Can a therapy reminder text mention the type of session, like individual, group, or medication management?
Leave the session type out of a routine reminder template. “You’re confirmed for Thursday at 4 with our Main Street office” tells the client everything they need to show up, and it reads the same on a lock screen whether the visit is individual counseling, a group session, or a medication check. Naming the session type adds a detail a shared or open phone screen could expose, without adding anything the client needs to act on the message.
Does a client’s age change how text consent works for a behavioral health practice?
Yes. For a minor client, a parent or guardian typically gives consent for text communication, and many practices still want the plan to say whether reminders go to the guardian’s phone, the minor’s phone, or both, and what happens once a teenager is old enough under state law to consent to some portion of their own care. Log that decision at intake the same way any other consent is logged, with the exact wording the guardian or client saw and the date they agreed to it, and revisit it if the client’s legal status or treatment plan changes.
What happens under 42 CFR Part 2 if our practice also treats substance use disorders?
42 CFR Part 2 is a separate federal confidentiality regulation that protects records from federally assisted substance use disorder treatment, and it sits on top of HIPAA rather than replacing it (HHS, Part 2 overview). It generally restricts redisclosing information that would identify someone as having received that specific treatment, without the patient’s written consent covering that redisclosure. A practice that runs any substance use disorder program alongside general therapy should have counsel confirm which clients and which records that rule actually covers before any text template references treatment type at all.
Will Beam sign a business associate agreement for a therapy practice?
Beam supports HIPAA compliant texting through compliant carrier infrastructure. Beam does not claim any certification under HIPAA, any third party audit, or a signed business associate agreement, because none is on file today. Confirm in writing what any vendor, including Beam, actually offers before protected health information goes through a line, and keep diagnosis, treatment, and risk detail out of the thread until that question has an answer.
What should staff do if a client texts something about self-harm or a crisis?
Route it to a person immediately, not an automated reply. A texting workflow should have a written rule that any reply mentioning self-harm, suicidal thoughts, or an active emergency pauses whatever automated sending exists on that thread and pages a specific clinician or on-call staff member right away. The text thread itself should not become the crisis intervention; its only job is to get a human looking at the message within the practice’s defined response window, and to point the client to the practice’s emergency protocol or 911 if the situation calls for it.
None of this is legal advice. A practice’s privacy officer or counsel should review the actual templates, consent language, and access list, including whether 42 CFR Part 2 applies, before a client texting program goes live. For the voice side of behavioral health outreach, agencies running both channels can see how outbound calling fits alongside texting in RizzDial’s guide to AI dialers for medical practices.