Texting Patients About Trials Without Breaking HIPAA

Patients answer texts. Response rates for recruitment SMS routinely triple those of phone calls to unknown numbers. But messaging about health conditions touches HIPAA, TCPA, and IRB oversight simultaneously, so sites need to get the basics right.

The core rules

Get consent for the channel. Before texting anyone, capture explicit consent to be contacted by SMS — ideally at the point they express interest ("May we text you about scheduling and study updates?"). Log when and how that consent was given.

Keep PHI out of the message. A text that names a condition ("your diabetes study screening") sits on lock screens and shared phones. Keep content neutral: "Hi Maria, this is Sarah from Uptown Research about your upcoming appointment. Reply YES to confirm."

Honor opt-outs immediately and permanently. Every message stream needs a working stop mechanism, and the opt-out must propagate everywhere — not just the texting tool.

Route messaging through auditable systems. Coordinators texting from personal phones means PHI on unmanaged devices and zero audit trail. Use a platform where messages are logged against the person's record.

The IRB dimension

Recruitment communications are recruitment materials. Message templates — especially anything sent before consent — generally need IRB review, just like a flyer. Template libraries with approved language keep coordinators fast and compliant; free-typing novel recruitment pitches at 4:55pm is how violations happen.

Practical template hygiene

Build approved templates for the routine moments: interest acknowledgment, screening reminder, reschedule request, visit confirmation. Personalize with names and times, not health details. Done this way, texting is not a compliance liability — it's the most patient-friendly channel a site has, with a paper trail better than any phone call.