HIPAA-compliant texting for treatment center admissions

A mother fills out your insurance verification form at 11:40 PM. At 8:15 the next morning your admissions coordinator texts her: "Hi Dana, this is Sarah from Cedar Path Recovery following up on detox for Michael. Is now a good time?" That text lights up the family iPad on the kitchen counter, where Michael is eating cereal.

Nobody broke a rule on purpose. The coordinator was fast, friendly, and doing exactly what good admissions teams do. But a two-line message just told a household something the person who filled out the form may not have been ready to share. HIPAA-compliant texting for a treatment center starts there, with the lock screen, before you ever get to software or legal citations.

A caveat before we go further. We're marketers. We build the forms, the follow-up sequences, and the websites they live on, and we work alongside compliance officers on them all the time. We aren't your lawyer, and nothing here replaces a review by counsel who knows your license, your state, and your payer mix.

Why a follow-up text is a disclosure

In most of healthcare, a reminder that says "your appointment with Dr. Patel is Tuesday" is low stakes. In addiction treatment, the sender's name is the sensitive part. "Cedar Path Recovery" on a lock screen tells whoever glances at the phone that someone in that house contacted a rehab.

Federal law treats that fact with unusual weight. Under 42 CFR Part 2, the confidentiality rule for federally assisted substance use disorder programs, a "patient" includes anyone who has applied for or been given diagnosis, treatment, or referral for treatment at a Part 2 program. Whether a midnight form submission counts as applying is a question for your counsel. We'd plan as if it might, because the cost of guessing wrong falls on the family.

So assume every admissions follow-up gets read by someone other than the person you meant it for: a spouse checking the shared tablet, a teenager who knows the passcode, a coworker glancing at a phone on the desk.

What HIPAA allows for text and email

HIPAA doesn't ban texting or email with patients. HHS says in its email FAQ that providers can use email for treatment-related communication as long as they apply reasonable safeguards, such as limiting what goes in the message. A patient can also ask to be reached by unencrypted email or text after being told the risks, and the provider can honor that.

People also have the right to ask you to reach them by a particular channel or at a particular number. That right is more useful than it sounds. The single best compliance feature on an admissions form is one plain question: how should we contact you, and is it OK to text or leave a voicemail? A family who answers "call my cell, no voicemail, don't text" has just written your follow-up policy for you. Then your team has to follow it, every time, including the coordinator covering the weekend shift.

The 2024 Part 2 rule, briefly

HHS finalized a major update to Part 2 in February 2024, with a compliance date of February 16, 2026. It pulled Part 2 closer to HIPAA in several ways. A patient can now sign a single consent covering future uses for treatment, payment, and health care operations. HIPAA's breach notification rule applies to Part 2 records. And HHS's Office for Civil Rights can now investigate and penalize Part 2 violations under the HIPAA enforcement framework.

That last change is the one marketing teams should notice. Until recently Part 2 enforcement was rare. Now there's an agency with a complaint portal and a penalty structure behind it, and a text that names a program to the wrong person is exactly the kind of thing a family member complains about. The alignment also didn't make Part 2 identical to HIPAA. Records still carry extra protection, and your compliance officer should decide how your intake pipeline, CRM, and messaging tools fit under it.

TCPA is a separate set of rules

Privacy law covers what a message reveals. The Telephone Consumer Protection Act covers whether you were allowed to send it at all, and it's the rule that produces class-action lawsuits, with statutory damages of $500 to $1,500 per message.

For an admissions team, most of the risk sits in a few habits. Get clear consent on the form before texting anyone, with a checkbox that isn't pre-checked and plain language about what they'll receive. Honor opt-outs fast: since April 11, 2025, people can revoke consent by any reasonable means, including replying "stop," "quit," or "cancel," or telling a staff member on the phone, and you have no more than 10 business days to process it. And keep promotional texts inside the federal 8 AM to 9 PM window in the recipient's time zone, knowing that some states set tighter hours and stricter consent rules than the federal floor.

One piece is still moving. The FCC's "revoke-all" provision, which would make a stop request apply to every message a business sends, was pushed back to January 31, 2027, and the FCC has circulated a draft that would rewrite it. If someone texts STOP to your admissions line, the simplest safe policy is to stop everything and move them to phone-only, if they've said phone is OK.

What a follow-up can say

Run every template through one test: if the wrong person reads this on a locked phone, what have they learned? The safe answer is "someone named Jordan wants to talk."

The lock-screen test for treatment center follow-up texts: the risky version discloses the program, the person, and the level of care before anyone unlocks the phone.

A text that passes looks like this: "Hi, this is Jordan returning your message from Tuesday night. Is now a good time to talk? Reply STOP to opt out." No program name in the preview, no patient name, no level of care, no insurance details. If the person replies and confirms it's them, your coordinator can move the conversation to a phone call, which is where it belonged anyway.

Whether your facility's name appears in the sender ID or the message body is a judgment call to make with your compliance officer. Some centers use a neutral business name for outbound messages. Whatever you choose, once the person is talking to you, tell them plainly who you are. A neutral preview protects the family; a fake identity would just be lying to them.

Email follows the same logic with a few extra traps:

• Subject lines and preview text show up on lock screens and in shared inboxes, so keep them neutral ("Following up on your request").
• Insurance cards, assessments, and anything clinical go through an encrypted portal or a secure message, never as a regular attachment.
• Marketing email platforms often load tracking pixels and rewrite links by default. Ask what your platform records about who opened what before you send anything health-related through it.
• An auto-reply that says "Thank you for contacting Cedar Path Recovery about treatment" is a disclosure too. Templates count.

Tools that sign a BAA

Any vendor that stores or handles messages about someone seeking treatment is likely a business associate under HIPAA, which means you need a signed business associate agreement before using it. That covers the texting platform, the CRM, the email system that carries follow-ups, and the call-tracking tool that records calls. Ask each vendor whether they'll sign a BAA and whether they understand Part 2. In our experience, some texting platforms built for general small-business marketing won't sign one, or only sign on a pricier healthcare tier, so ask before your team builds templates in it.

Two habits undo good tools. The first is coordinators texting families from their personal cell phones, which puts the conversation on a device you don't control and a carrier backup you can't audit. The second is advertising pixels firing on the form's thank-you page, which can tell an ad platform that a specific visitor just asked about rehab. OCR's guidance on online tracking was partly vacated by a federal court in 2024, but the core point stands: once a visitor is identifiable and seeking treatment, their data shouldn't go to an ad vendor without authorization. We covered the chat side of this in our post on after-hours live chat and text lines.

A follow-up cadence that respects families

Speed still matters. The family that submitted a verification request at midnight is often talking to several centers, and the first thoughtful reply tends to earn the conversation, which is why we treat the insurance verification form as a front door and not paperwork.

But fast isn't the same as relentless. A sales-style sequence of eight texts in five days reads very differently to a frightened parent than it does to someone pricing roofing quotes. Our default suggestion is a reply within the first hour during staffed times, one more attempt the next day by the channel they picked, a final neutral note a few days later, and then nothing unless they reach back out. Every message after a STOP or a "please don't text" is a liability and a broken promise at the same time.

Write every text for the lock screen

Pull up the last ten follow-up texts and emails your admissions team sent and read them as if you were the teenager holding the family iPad. That ten-minute exercise usually tells a center more than any vendor demo, and fixing what it turns up rarely costs you speed.

Most of that lives in the website and form layer, which is where we spend a lot of our time. Our website work for treatment centers covers intake forms, consent language, and keeping ad pixels off pages they shouldn't touch, built to whatever standard your compliance team sets. If you want a second set of eyes on what your forms and follow-ups say today, start with a free audit.