HIPAA Compliant Texting for Insurance Agents: What to Send

HIPAA-compliant texting means sending texts in a way that does not expose protected health information (PHI), or sending PHI only through a secure service that is covered by a Business Associate Agreement. For most insurance agents, the practical rule is simple: use two-way SMS for scheduling, reminders and follow-up, and move anything sensitive to a secure channel. Separate federal rules on consent and opt-out apply to the same texts, and both sets of rules need attention.

TL;DR

• HIPAA applies to texts that contain PHI and are sent by a covered entity or by a business associate working for one. Agents who handle health plan data may fall into that second group.
• Standard SMS lacks the controls HIPAA’s Security Rule expects. Keep diagnoses, claims details, and policy or payment information out of regular texts.
• A name, a time and a meeting place alone do not necessarily make a text PHI. Most appointment and follow-up texts can be written this way.
• Marketing texts fall under the TCPA, not HIPAA. Record opt-in consent and honor every reasonable opt-out request.
• Document everything: consent, warnings, opt-outs and message history.

Table of Contents

• When HIPAA applies to an insurance agent’s texts
• What makes a text message PHI
• Why ordinary SMS is not enough for sensitive details
• When a client asks to text sensitive information
• Two-way SMS and opt-in: where HIPAA stops and the TCPA starts
• A practical texting policy for an agency
• Consequences of getting it wrong
• Choosing tools for secure patient and client messaging
• Our perspective
• Run two-way texting and follow-up in one place
• FAQ
• Sources

When HIPAA applies to an insurance agent’s texts

HIPAA does not cover every text an agent sends. It covers PHI sent by a covered entity or a business associate acting for one. The HIPAA Journal summarizes the position: PHI can be sent by text through a HIPAA-compliant service covered by a Business Associate Agreement, with safeguards such as access controls and encryption.

The definition of covered entity matters here. Under the federal regulation, covered entities are health plans, health care clearinghouses and certain health care providers. An independent agent is usually not one of these. The question is whether the agent acts as a business associate. HHS describes a business associate as a person who performs functions on behalf of a covered entity that involve creating, receiving, maintaining or transmitting PHI.

That depends on the line of business and the contract. An agent working with a health plan under an agreement that involves member health data should read that agreement and ask the carrier or an attorney how HIPAA applies. Agents selling products such as term life or annuities should confirm the same point with the carrier. Medicare and health agents are the group most likely to meet HIPAA terms in their contracts.

What makes a text message PHI

PHI is identifiable health, treatment or payment information. Whether a text is a problem depends on the sender, the content, the service used, the safeguards in place and any request or authorization from the patient, according to the HIPAA Journal’s 2026 update.

The same source notes that a text with only identifiers such as a name, a venue and a time does not necessarily qualify as PHI when it is not kept in a designated record set with health or payment information. This is the basis for safe appointment texting.

The pattern is consistent. A text works best as a nudge to start a conversation. The details go through a call, a secure portal or an encrypted channel.

Why ordinary SMS is not enough for sensitive details

Plain SMS lacks the controls needed to support HIPAA Security Rule compliance, per the HIPAA Journal. A message can sit on a phone lock screen, be forwarded, or be stored on a device the agent does not control.

HHS also advises people to remove or secure transmitted health data on personal devices. The same habit helps agents. Clients should be told not to leave sensitive messages sitting on a shared phone.

A point worth knowing: no texting platform can, by itself, be HIPAA-compliant. Compliance depends on how the platform is configured and used, the agreements in place, and the policies of the business. A vendor label does not replace those.

When a client asks to text sensitive information

Clients sometimes ask to use regular text for sensitive matters. The American Psychiatric Association gives guidance for clinicians that translates well to any HIPAA-regulated setting. It recommends end-to-end encrypted platforms where possible, and says unencrypted SMS may be used only if the patient is warned of the risks and consents, with both the warning and the consent documented.

The same page says that when a patient asks for communication by an alternative means such as SMS, the provider should warn the patient of the risks, offer a compliant alternative and document the warning. For an agent, a workable process looks like this:

1. Offer a secure option first, such as a secure link, a portal or a phone call.
2. If the client still prefers regular text, explain in plain words that SMS is not private in the way a secure channel is.
3. Get the client’s agreement in writing, in a reply text or an email.
4. Save the warning and the agreement in the client’s record.
5. Keep the content of each text as limited as the client’s need allows.

This guidance comes from the healthcare field. Agents who are business associates should confirm with the carrier or counsel what the contract requires.

Two-way SMS and opt-in: where HIPAA stops and the TCPA starts

HIPAA governs how health information is protected. It does not decide whether an agent may send a marketing text. That question belongs to the Telephone Consumer Protection Act (TCPA) and related rules. Agents often mix the two up, and they need separate handling.

Consent for marketing texts

For telemarketing, the FTC has said written consent must be clear and conspicuous, not buried in general user agreements, and must name the party for whom consent is given. The same letter says that for telemarketing robocalls, express written consent cannot be a condition of receiving services.

For an insurance lead form, this means a dedicated consent checkbox, unchecked by default, with the agency’s name and a plain description of the texts. It should not sit inside a long terms page.

Opt-out requests

The FCC’s 2024 order states that consumers may revoke consent for autodialed texts in any reasonable manner that clearly expresses a wish not to receive more messages. Reasonable methods include replying with words such as “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel” or “unsubscribe,” or using a website or phone number the sender provided for that purpose.

In practice, that means:

• Treat every one of those words as a valid opt-out, not only “STOP.”
• Stop all marketing texts to that contact, and record the date and time.
• Do not make a client explain or repeat the request.
• Make sure the opt-out applies across every tool that can send messages.

Two-way texting helps here. When replies come into the same inbox as outgoing messages, an opt-out reply is seen once and acted on once. Related guides on this site cover building a TCPA audit trail for insurance texting, reducing opt-outs when choosing between SMS and email, and 10DLC registration for insurance SMS.

A practical texting policy for an agency

A written policy turns the above into daily habits. A short one is enough if everyone follows it.

Define what may be texted

List the allowed message types: appointment times, call-back requests, document-ready notices without detail, renewal reminders without plan detail, and review requests. List what is never texted: diagnoses, medications, claim status, premium amounts tied to a health plan, Social Security numbers and bank details.

Set the secure channel

Name the one place where sensitive documents go, whether that is an encrypted e-signature flow, a client portal or a phone call. Every agent should know it by heart. Contract signing is one example where a dedicated flow beats a text thread, and an e-signature tool for contracts keeps the document out of the message stream.

Control devices and access

Require screen locks on any phone used for client messages. Remove access when someone leaves the agency. Avoid personal phone numbers for client texting, since personal texting apps leave no shared record. A business number tied to a CRM keeps history in one place. Broader guidance on this topic is in the guide to CRM data privacy for insurance agencies.

Keep records

Save consent records, opt-out dates, secure-channel warnings and the full message history. If a regulator, carrier or client asks what was sent, the agency should answer from records, not memory. Medicare agents also face marketing record expectations, covered in five CRM steps for CMS Medicare marketing compliance.

Train the team

Run a short review each quarter using real examples. Have each agent rewrite three risky texts into safe ones. The table above is a good starting exercise.

Consequences of getting it wrong

HIPAA violations can lead to civil penalties, criminal charges, legal action, termination or professional-board sanctions. Criminal penalties can include fines and imprisonment. Penalty amounts are adjusted over time and depend on the level of culpability, so the HHS Office for Civil Rights is the place to check current figures.

TCPA violations carry their own risk. Private lawsuits over unwanted texts are common, which is why consent records and honored opt-outs matter as much as message content.

Limiting message content, using a secure channel for details, and keeping records are the three habits that reduce both kinds of risk.

Choosing tools for secure patient and client messaging

When comparing messaging tools, look at the type of tool, not only the brand. These are the features that matter for an insurance agency:

The last row is a contract point. Where HIPAA applies, ask any vendor for its agreement in writing before PHI touches the tool. Email follows similar logic, and agencies that also send email can read about email marketing for healthcare providers to see how secure messaging fits into a wider workflow.

Our perspective

Most agents do not need to text sensitive details. They need to text fast, get a reply, and move the client to a call. Speed of follow-up is where deals are won or lost, and text is the quickest way to start that conversation.

We built CallBack for insurance sales workflows. Two-way SMS, email and voicemail follow-up sit in one inbox with the contact record. Our deliverability practices include unique message hashing, iMessage deliverability and sending phone carrier approved verbiage. Those are designed to help real client messages arrive and to keep wording within carrier expectations.

We recommend agents write short, low-detail texts, keep consent and opt-out records in the CRM, and send documents through a separate flow. Automation handles the repeat work, so agents do not have to remember each rule at every send. Agents with HIPAA obligations should confirm the specific requirements with their carrier or counsel.

Kyle

Run two-way texting and follow-up in one place

CallBack is a CRM and sales automation platform for insurance agents, agencies and IMOs. It combines pipelines, automated follow-up by SMS, email and voicemail, workflows, e-signatures and reporting. The Professional plan costs $97 per month. Enterprise plans with 10, 25 and 60 full CRM accounts cost $297, $397 and $497 per month. Usage fees for SMS, email and AI are billed separately, and the fees page lists them.

Agents can start with the Professional plan. Agencies with several licensed producers can compare the Enterprise plans. More about the platform is at callbackcrm.com.

FAQ

Is regular SMS HIPAA compliant?

Regular SMS lacks the controls needed to support HIPAA Security Rule compliance. That does not mean every text breaks the law. A message with only a name and an appointment time may not contain PHI. Anything with health, treatment or payment detail should go through a secure, covered channel.

Does HIPAA apply to life insurance agents?

HIPAA applies to covered entities and their business associates. Health plans are covered entities. Whether an agent is a business associate depends on the contract and the work done for a health plan. Agents should check with the carrier or an attorney about their own situation.

How should an insurance agency record SMS opt-in?

Store the date, the source form or conversation, the exact consent wording and the phone number. Consent should name the agency and be clear, not buried in a long agreement. Save the record in the contact file so it can be found later.

Which words count as an opt-out?

The FCC says consumers may revoke consent in any reasonable way. Replies such as stop, quit, end, revoke, opt out, cancel and unsubscribe are all reasonable. Agencies should honor all of them, not only one keyword.

Can a client choose to receive PHI by regular text?

Professional guidance says unencrypted SMS may be used only after the client is warned of the risks and consents, with both documented. A secure alternative should be offered first. Agents bound by HIPAA should confirm their carrier’s rules before agreeing.

Sources

• Is Texting in Violation of HIPAA? 2026 Update
• HHS: Business Associates FAQs
• Covered Entity definition, 45 CFR 160.103
• HHS: Telehealth Privacy Tips for Patients
• HIPAA-Compliant Texting of PHI: The Good, The Bad
• Texting Patients: Rules of the Road, American Psychiatric Association
• FTC closing letter, July 14, 2015
• FCC 24-24, TCPA revocation rules
• 7 Best Email Marketing Platforms for Healthcare Providers

Recommended

• Insurance Texting: Build a TCPA Compliant Audit Trail in One Week
• SMS vs Email for Insurance Agents: Cut Opt Outs and Stay Compliant
• AI SMS Writers for Insurance Agents: Four Steps to an Audit Trail
• Ringless Voicemail for Insurance Agents: Rules and Setup