Text appointment reminders can be HIPAA compliant, but the text itself is only half of the answer. HIPAA allows you to remind patients about appointments without a signed authorization, and the other half is who handles the patient data behind the message. Any company that creates, receives, stores or sends it for your practice generally needs a business associate agreement (BAA) with you. This guide walks through that decision, shows what a minimal reminder says, and builds the reminder list in Google Sheets without putting clinical detail anywhere it does not belong.
This is general information from public sources, not legal advice. Have your privacy officer or a healthcare attorney confirm your setup.
HIPAA treats an appointment reminder as part of treatment and health care operations, so you do not need a patient’s written authorization to send one. Vendor guides such as
Trumpia’s and Demandforce’s explain that reminders relate to treatment, and the federal definition of “marketing” carves out communications for treatment (45 CFR 164.501). A plain reminder is therefore not marketing, as long as nobody pays you to send it.
Permission to send does not make the message safe, though. A text that names a patient and ties them to a provider is protected health information (PHI) in practice, and standard SMS is not encrypted. That is why the usual advice is the same across the guides we read: say as little as possible, and use a vendor that will sign a BAA.
Yes, in most setups: a BAA is needed whenever a vendor handles patient information on your behalf, and a reminder tool usually does. The regulation defines a business associate as a person who “creates, receives, maintains, or transmits protected health information” on behalf of a covered entity (45 CFR 160.103). A texting tool that holds your patients’ names and phone numbers and sends the appointment time does exactly that.
A few sources argue that very short messages avoid the BAA question. That position is the weakest in what we found, and the regulation’s definition has no exception for short messages. Minimal content lowers the harm if a message is seen by the wrong person. It does not change who is handling the data.
The BAA is also a contract between two named parties. A vendor’s own suppliers having agreements in place does not give you one, so the agreement has to be with the company you pay for the tool.
Work through four questions, in order, and stop at the first one that changes your plan.
Does the tool ever see a patient’s name or phone number together with the fact that they are your patient? If yes, treat that data as PHI. A reminder list almost always meets this test.
Does the tool store it, process it or send messages from it for you? If yes, it is a business associate, and you need a signed BAA before patient data goes in.
Will the vendor sign a BAA in writing? If yes, get it signed and filed. If no, or if the answer is vague, do not load patient data into that tool.
Do the other places the list lives have an agreement too? Your spreadsheet, shared drive and email count. Google, for one, says customers who are subject to HIPAA must accept its BAA before putting PHI in Workspace, and that third-party add-ons are not included in what the BAA covers (Google Workspace HIPAA guidance).
The last point matters for any add-on. Accepting Google’s BAA covers Google’s own services, not whatever you install on top. A texting add-on needs its own agreement with you.
A PHI-safe reminder names the practice, the date and the time, and sends everything else to a phone call or the patient portal. Guides from Trumpia and Demandforce agree on that core, Textline has more example templates, and Ready adds that a specialty or facility name can give away a condition.
Include
Leave out
Patient’s first name
Diagnosis, condition or reason for the visit
Practice name
Medication names
Appointment date and time
Test results or clinical detail
Office phone number
Provider specialty or a department name that implies a condition
A way to confirm, and a way to opt out
Balances, insurance details or anything from the chart
Here are templates for a fictional clinic, Hillview Family Clinic. Each is under 160 characters, so it should go out as one segment. The variables match columns in the sheet built below.
Confirmation request
Hi {FirstName}, Hillview Family Clinic here. Your appointment is {ApptDate} at {ApptTime}. Reply C to confirm. Reply STOP to opt out.
Reschedule prompt
Hi {FirstName}, we need to move your {ApptDate} appointment at Hillview Family Clinic. Please call 555-0142 to pick a new time. Reply STOP to opt out.
Portal nudge
Hi {FirstName}, you have a new message from Hillview Family Clinic. Please log in to the patient portal to read it. Reply STOP to opt out.
Compare those with a message like “Hi Maria, your colonoscopy prep starts tomorrow.” It reads naturally and it discloses a procedure to anyone who sees the phone. Keep that kind of detail for the portal or a call. For more reminder wording, see the patient SMS reminders guide.
Keep a master tab for your schedule and a separate send tab that holds only the four fields a reminder needs. The add-on sends to the rows of the tab that is open, so the send tab is the one to open when you send.
Set up the master tab, called Master, with these headers in row 1:
Column
Header
Example
A
FirstName
Dana
B
Phone
the patient’s mobile number
C
ApptDate
a real date, such as 2026-11-04
D
ApptTime
a real time, such as 10:30 AM
E
TextConsent
Yes or No
Do not add diagnosis, visit reason or chart notes to this tab. A reminder list does not need them, and every extra column is more PHI to protect.
On a second tab called Send, type FirstName, Phone, ApptDate and ApptTime in cells A1 to D1, then put this Google Sheets formula in A2:
It lists tomorrow’s appointments for patients who agreed to texts. The headers must sit above the formula because variables read the column headers in the first row of the tab being sent from. Format the ApptDate column on the Send tab as a date (for example “Thu, Oct 15”) and ApptTime as a time, since a variable inserts what the cell shows. If nobody is booked tomorrow the formula shows #N/A, so wrap it in IFERROR if that bothers your staff. Change the +1 to match your lead time.
Then, with the Send tab open, write a message in the sidebar using the variables, check the preview of each recipient’s message, and send. Sheet Gurus SMS keeps no saved templates in the add-on, so paste the wording from a Templates tab in your own sheet. Delivery status for each message is reported after sending on every plan, and replies arrive in the two-way inbox, linked to the patient’s row.
Two limits shape the routine. Nothing sends automatically when a row is added, so someone runs the batch each day. And scheduling a send for a later time is on the Growth and Pro plans, goes out at one time for the whole batch, and cannot repeat, so each day’s batch is scheduled separately. A scheduled send reads the tab when you schedule it, so rows changed afterwards are not in that batch.
A practice with 300 appointments a week sends about 1,300 one-segment reminders a month. On Starter ($9 a month plus $0.04 per segment) that comes to $9 plus $52, or $61. On Growth ($49 a month plus $0.03 per segment) it is $49 plus $39, or $88. Starter is cheaper at that volume, and Growth only adds scheduling and a few extras. Patient replies are billed at the same per-segment rate on Starter and Growth and are free only on Pro, so add a few hundred segments if many patients answer C.
Sheet Gurus SMS handles the sending and filtering, and the HIPAA paperwork is still yours to settle before patient data goes in. It filters messages automatically to help keep sends compliant, and it has automated opt-out. Before you load real patient data, ask Sheet Gurus, as you would any vendor, whether it will sign a BAA, and keep the signed agreement with your compliance records.
Practical steps that stay true whichever tool you pick:
Send only the four fields in the send tab, and keep clinical notes out of every sheet that feeds messages.
Tell patients that texts can be read by others and that they should not text symptoms or questions about their care. Two-way replies mean a patient’s answer lands in your inbox, so say where to call instead.
Share the sheet only with the staff who run reminders, and not by an anyone-with-the-link setting.
HIPAA does not require authorization for reminders, but texting rules do require consent and an opt-out. Under the TCPA, informational healthcare texts such as appointment reminders need the patient’s prior express consent, for example giving a mobile number at intake for that purpose, while prior express written consent is required for marketing texts. The safe route is documented consent at intake plus a STOP reply on every message. Collect consent in your intake form and record it in the TextConsent column, which is why the formula above filters on it. Our guides to opt-in text messaging and SMS compliance for Google Sheets cover the consent record and wording in more depth.
Are text appointment reminders HIPAA compliant? They can be. Keep the text to a name, date and time, and use a vendor that signs a BAA.
Do I need a BAA for appointment reminders? Generally yes, if a vendor stores or sends patient names and numbers for you. Get it in writing before you load any data.
Can I put the reason for the visit in the text? No. Leave out conditions, procedures, medications and results, and point patients to the portal or a phone call.
Does Google’s BAA cover an SMS add-on? No. Google states that third-party add-ons are not covered by its BAA, so an add-on needs its own agreement with you.
Can I schedule reminders in advance? Yes, on Growth and Pro, for one time per batch. There are no recurring schedules, and a scheduled send reads the tab when you schedule it.
You can test the workflow with dummy data first: the free trial lasts 30 days and includes 50 credits. See the getting started guide for the sidebar steps, and use made-up patients until your agreements are in place.
