How to Choose a HIPAA Compliant Messaging App in 2026

To choose a HIPAA compliant messaging app, decide first who is messaging whom, then confirm the vendor signs a business associate agreement, check the security controls and where messages end up in the record, and price the plan per user. A hospital care team, a small practice texting patients and a solo therapist emailing clients need different tools, even though all three are marketed as HIPAA compliant.

Decide who is messaging whom

Secure messaging covers three very different conversations, and most apps are strongest at one of them.

• Clinician to clinician inside a hospital: nurses, physicians and support staff coordinating care, often tied to on-call schedules, alarms and nurse call. TigerConnect is built for this.
• Practice to patient: appointment questions, prep instructions, photos, refill requests and follow-ups by text or secure message. Spruce Health and OhMD focus here.
• Provider to client by email: therapists and solo practitioners who send longer messages, forms and documents. Hushmail for Healthcare fits this pattern.

Many practices also need a fourth channel: outside providers, pharmacies and payers, which still often means fax. If that traffic matters, look for digital fax in the same inbox so staff are not switching between tools.

Write down your main conversation and the volume of each type. A tool that is excellent for one can be awkward for another, and paying for hospital-grade features in a five-person clinic wastes money.

Security features that actually matter

Every vendor in this category says it is HIPAA compliant. That phrase describes how the product can be used, not a certification. The HIPAA Security Rule asks you to protect electronic health information with administrative, physical and technical safeguards, so look for these controls in the product itself:

• Encryption in transit and at rest for messages, attachments and voicemails.
• Unique user logins with multifactor authentication.
• Role-based access, so front-desk staff, clinicians and billing see only what they need.
• Audit logs that show who read, sent or exported each message.
• Remote logout and data removal when a phone is lost or an employee leaves.
• Message retention settings that match your record retention policy.

HHS proposed Security Rule changes in January 2025 that would make encryption and multifactor authentication explicit requirements for most systems. Whatever the final rule says, buy as if those controls are already mandatory. They are the first things an auditor or breach investigator will ask about.

Ask each vendor for its most recent independent security assessment, how it notifies customers of a breach and how quickly, and where your data is hosted. A vendor that answers these questions clearly and in writing is usually one that has thought hard about them. Vague answers during the sales process rarely get sharper after you sign.

Get the BAA and understand its limits

A vendor that stores or transmits protected health information for you is a business associate and must sign a business associate agreement. Spruce Health signs one on every plan and trial, OhMD includes one by default and Hushmail provides one as well. Read it before you send any patient data, and keep a signed copy with your compliance records.

The BAA covers the vendor, not your staff’s habits. Regular SMS is not encrypted and wireless carriers do not sign BAAs, so texting patients from personal phones remains a real risk even if the practice has a secure app. Patients can ask to receive information by unencrypted text or email after being told the risk, but document that preference rather than assuming it.

Some settings carry extra rules. Federally assisted substance use disorder programs fall under 42 CFR Part 2, which adds consent requirements. The largest US hospital accreditor began permitting patient care orders by secure text in 2024, as long as the platform and the hospital’s policies meet its requirements, so hospital buyers should ask how each app supports order documentation.

Check where messages end up

Clinically relevant messages often belong in the medical record. If a patient texts a new symptom and a nurse replies with advice, that exchange should not live only in an app on someone’s phone.

Integration depth varies widely. OhMD syncs patient conversations with more than 85 EHRs, including athenahealth, eClinicalWorks, NextGen and ModMed, and staff can push a conversation into the chart in one click. TigerConnect connects to more than 200 devices, EHRs and communication systems, including nurse call and alarm sources, which suits hospital workflows. Spruce Health includes integrations and API access on its Communicator plan.

If a tool does not integrate with your EHR, decide how staff will document important messages, such as exporting a conversation as a PDF or summarizing it in a chart note, and write that into your policy.

Look past messaging to the rest of the workflow

Secure messaging rarely stands alone. The best fit is often the app that also absorbs the other communication tools your staff juggle.

For practices

Spruce Health adds medical phone lines, video visits and digital fax to the same inbox, and its Communicator plan adds phone trees and after-hours triage. OhMD adds automated reminders and AI phone answering as you grow. If your staff currently switch between a phone system, a fax machine, a texting app and a video tool, consolidating them can save more time than any single messaging feature.

For hospitals

TigerConnect combines secure messaging with physician scheduling, alarm management and nurse call integration, so a message reaches whoever is actually on call rather than a static list. It also offers patient engagement tools for secure text, video and voice outreach without requiring patients to install an app. For a health system, routing messages by role and schedule matters more than the chat interface itself.

Pricing models and realistic costs

Secure messaging pricing falls into a few clear bands, and the right comparison is the total for your whole team.

• Encrypted email for solo providers: Hushmail for Healthcare starts at $11.99 a month, with secure forms and e-signatures on higher tiers.
• Per-user practice apps: Spruce Health costs $24 per user per month for Basic and $49 for Communicator, which adds phone trees, after-hours triage and API access. Texting needs a one-time $19.50 registration fee.
• EHR-linked patient texting: OhMD says pricing starts at $500 a month for its Automate tier.
• Hospital platforms: TigerConnect and similar enterprise tools price by quote, usually across a full health system.

Per-user pricing looks cheap until you count every nurse, medical assistant and front-desk employee who needs access. Multiply by headcount, add phone numbers, fax lines and any annual commitment, then compare. For ratings and prices on all six apps we track, see our ranked list of the best HIPAA compliant messaging apps.

Roll it out with policies, not just downloads

A secure app only protects you if staff actually use it and stop using everything else. Treat the rollout as a policy change:

1. Write a short messaging policy covering what can be sent, response times, after-hours rules and how clinical messages are documented.
2. Turn on multifactor authentication and device controls before anyone logs in.
3. Move every staff member at once, and set a date after which personal texting with patients stops.
4. Tell patients the new number or app, and get consent for text communication where required.
5. Build offboarding into your HR checklist so departing staff lose access the same day.
6. Review audit logs and a sample of conversations each quarter.

Use the free trial or demo to test real situations: a patient sending a rash photo, a nurse escalating an after-hours call, a lost phone that needs to be wiped and a message that must go into the chart. Spruce Health and Hushmail offer 14-day trials, while TigerConnect and OhMD start with a demo. Note that Spruce’s trial does not include SMS texting, so plan your texting test after you pay for the first month.

Questions to ask in every demo

• Will you sign a BAA, and on which plan?
• Is multifactor authentication available and enforceable for all users?
• Can we see audit logs of who read or exported each message?
• How do messages get into our EHR?
• What happens to data on a lost phone or when staff leave?
• How are messages retained, and can we set our own retention period?
• What does the plan cost for our full headcount, including phone and fax lines?

Frequently asked questions