Yes, If the Text Is Only the Doorbell
Text messages get opened. That makes them attractive for patient surveys, including patient-reported outcome (PRO) surveys that track symptoms or recovery over time. The concern is privacy. Standard SMS is not encrypted end to end, messages sit on phones that others may see, and numbers change hands. So can you run a HIPAA compliant SMS survey? You can, if you design the program so protected health information never travels in the text itself.
Keep PHI Out of the Message Body
The core rule is simple: the text should not reveal anything about a patient’s health. Avoid diagnoses, procedure names, medication names, department names that imply a condition, and survey questions that reveal clinical details. Even “How is your knee recovering after surgery?” discloses PHI.
A safe text reads more like this: “Hello from Riverside Health. You have a short survey waiting. Tap the secure link to begin. Reply STOP to opt out.”
Use SMS as a Notification, With an Authenticated Secure Link
In the hybrid model, the text is a notification, and the survey lives behind a secure, encrypted link. Before any health questions appear, the patient confirms identity, for example by entering a date of birth or a one-time code. Responses travel over an encrypted connection and are stored in a protected environment, not in the messaging thread.
This approach keeps the convenience of texting while moving the sensitive content to a channel built for it. Our article on using hybrid SMS and secure messaging technology for patient-reported outcome surveys explains the model in more depth.
Get Consent and Honor STOP
Texting patients requires permission. Capture consent at intake or registration, record when and how it was given, and make the purpose clear. Every message should tell people how to opt out, and STOP requests must be honored immediately across all campaigns, not just the one the patient replied to. HELP should return contact information.
Federal and carrier rules for business texting continue to evolve. Our overview of rules and regulations for SMS covers the essentials.
Register Your Texting Campaigns
In the US, application-to-person texting from standard 10-digit numbers (10DLC) generally requires brand and campaign registration through The Campaign Registry. Unregistered traffic is often filtered or blocked, which can quietly wreck response rates. Registration asks you to describe the use case, sample messages, and opt-in process, so consistent consent practices matter here too. See our guide to text messaging registration with The Campaign Registry.
Other Design Tips
- Short links on your own domain. Generic link shorteners are often filtered and look suspicious to patients.
- Reasonable send times. Respect local time zones and quiet hours.
- Limited reminders. One or two reminders improve completion; more irritates patients.
- Fallback channels. Patients who do not respond to text can receive an automated phone survey instead.
- Language preference. Send the text and the survey in the patient’s preferred language.
- Link expiry. Secure links should expire after a set period or after completion.
Questions to Ask a Vendor
- Will you sign a BAA, and do you have an independent security audit such as SOC 2?
- How do you keep PHI out of message bodies, and can we review templates?
- How is the patient authenticated before survey questions appear?
- How are consent and STOP tracked across campaigns?
- Do you handle 10DLC brand and campaign registration?
Be wary of any vendor that claims that SMS is HIPAA compliant. It’s not. A variation of SMS known as RCS can be HIPAA compliant but it is not available on all devices.
How IVR Lab Approaches Text Surveys
For PRO surveys and other health-related questionnaires, the hybrid SMS and secure link model is IVR Lab’s default. We are a builder of custom IVR, SMS, and secure messaging programs, HIPAA compliant and SOC 2 audited, and we support registration, consent tracking, multilingual content, and phone fallback. We can run the program for you, provide it for your team to manage, or work in a hybrid arrangement, often filling a gap in a survey program you already have. APIs are available under a signed MSA.