HIPAA-Compliant Communication Apps

A patient asks whether their referral is ready. Your medical assistant needs a clinician to review the request. The specialist’s office needs the referral letter, recent results and supporting records.

The patient needs an answer, the practice needs to assign the work, and the specialist needs the documents. Choosing HIPAA-compliant communication apps starts with separating those tasks.

Patient messaging supports questions and replies. Team messaging helps colleagues coordinate work. Online fax sends documents to organizations that receive them through fax numbers, including offices outside your messaging platform.

Which communication channel should your practice use?

Start with the task rather than a list of apps.

If your existing patient portal already supports the required conversation, evaluate that workflow before adding another application.

A patient message can explain the next step in a referral while the referral packet travels to the specialist by fax. A team conversation can assign the preparation and follow-up without becoming the external delivery channel.

Delivery indicators also need interpretation. A notification reaching a phone, a message being opened and a successful fax transmission describe different events. None automatically establishes that the intended person reviewed the information and completed the next task.

What makes a communication app suitable for HIPAA workflows?

For a cloud service handling electronic protected health information (PHI) on your organization’s behalf, assess the applicable Business Associate Agreement (BAA), covered services and required configuration.

HHS explains that using cloud services for electronic PHI involves an appropriate BAA and compliance with the HIPAA Rules. Your organization must also understand the service and conduct its own risk analysis. Encryption alone does not settle the full question. HHS cloud-computing guidance.

Three purchasing questions follow:

1. Does the agreement cover the exact product and features you will use?
2. Which subscription and settings are required?
3. How will staff handle information before and after using the service?

A provider may offer secure messaging and ordinary SMS within the same staff inbox. Those channels do not become technically identical because they share an interface.

Likewise, a document received securely can create additional copies when someone downloads it, forwards it or stores it elsewhere. Your procedures need to cover those next steps.

Secure messaging, SMS and fax: understand the delivery path

Secure patient messaging supports ongoing exchanges

A secure patient channel can support administrative questions, follow-up and document requests. Many platforms also allow participants to exchange files.

The patient experience varies. Some services require an account and sign-in. Others provide access through a link and a verification step.

Evaluate what patients receive, how they authenticate, how attachments open and what happens when access fails. “App-free” does not necessarily mean “account-free”: browser access can still require registration or sign-in.

SMS can be a notification or a separate conversation channel

A text directing a patient to a secure message is different from placing the message itself in the SMS body.

Staff need to recognize which delivery path they select and what appears in the recipient’s text or notification preview. Patient preference or consent does not change the channel’s technical protection.

Online fax connects with external fax destinations

Fax is useful when another practice, insurer or organization expects documents at a fax number.

The recipient does not need an account with your fax provider. They need compatible receiving equipment or a fax service. That can avoid asking an outside office to join a new messaging platform before receiving a referral packet.

HHS permits physicians to send patient information to another healthcare provider for treatment by fax, with reasonable and appropriate safeguards. Examples include verifying the recipient number and preventing unauthorized access to received documents. HHS guidance on physician-to-physician faxing.

Healthcare communication apps worth evaluating

These services differ in patient access, staff licensing and document exchange. Those differences matter more than treating them as interchangeable chat applications.

Spruce: several communication channels in one practice workspace

Spruce combines patient communication with a shared practice workspace. Basic includes secure messaging, a shared inbox and fax. Communicator adds application programming interface (API) access and customizable phone menus.

Published prices are $24 per staff user per month for Basic and $49 for Communicator, before applicable taxes and fees. Spruce automatically includes a BAA for qualifying organizations on trials and paid plans. Outbound SMS registration carries a separate organizational fee.

For secure messaging, patients create an account and access it through the Spruce app or a web sign-in. Ordinary SMS is a separate channel. A patient’s ability to receive an SMS therefore should not be confused with enrollment in secure messaging.

Spruce suits an evaluation involving several practice communication methods, including fax. Demonstrate patient registration and the staff controls distinguishing secure messages from SMS before deciding whether its shared workspace fits your practice.

iPlum: a professional number with a separate secure texting channel

Its Professional plan costs $14.99 per user per month with annual billing, or $20.99 month-to-month. This plan includes a BAA and secure texting capabilities. The lower-priced Standard phone plan should not be substituted for that configuration.

For secure exchanges, iPlum documents a workflow using a free client account, with access through mobile applications or the web. That channel is distinct from ordinary carrier SMS. Browser access removes the installation requirement, while the account requirement remains.

This model is relevant to a clinician who wants a professional number separate from their personal identity. Demonstrate how a conversation moves from ordinary texting to the secure channel, including the patient’s account setup.

iPlum lists fax subscriptions separately. A Professional phone subscription should not be assumed to include the fax service needed for external document exchange. Compare buying phone and fax together or separately when pricing the complete setup.

OhMD: patient communication with different delivery paths

Its published starting prices are $300 per month for Core and $500 for AI & Automation, with enterprise configurations on quotation. The service lists a BAA among its communication features. Obtain the applicable agreement and a proposal specifying the purchased configuration.

OhMD distinguishes ordinary SMS with its applicable consent process from secure messaging accessed through a link and access code. That distinction needs to remain visible in staff procedures.

Compare OhMD’s practice-level starting price with the full staff configuration of per-user services. Ask which calling usage and additional capabilities the proposal includes, and demonstrate what staff see when a secure message remains unopened.

OhMD is relevant when patient communication is the main project. Separately establish how staff send records to external organizations that expect a fax rather than a patient-message link.

BloomText: distinguish free team chat from paid patient texting

Its free plan supports secure messages and files for up to five coworkers, unlimited external professional collaborators and a signed BAA. Base Messaging costs $14.50 per user monthly, or $156 per user annually.

Patient SMS is separate, starting at $129 per month for up to 140 unique contacted patients per month. This is a patient count, not a 140-message allowance.

Team Chat and Patient SMS can operate independently. A free team-chat subscription therefore should not be described as free patient texting.

BloomText states that patients do not need to install an app. Evaluate the actual access and delivery process before deciding whether that approach suits your patients; the absence of an installation requirement does not establish how every message is protected.

BloomText is worth evaluating when professional collaboration or patient access without an app is a priority. Compare the required modules and calculate patient usage using the provider’s definition.

Where Fax.Plus fits: exchanging documents with external organizations

When the specialist’s office accepts referrals at its existing fax number, staff can use Fax.Plus to send the packet without requiring that office to join the practice’s messaging application. The same document-exchange role applies to records requests and supporting paperwork.

For PHI, Fax.Plus’s clinical fax service requires Enterprise, enabled Advanced Security Controls and a signed BAA. Basic, Premium and Business are not alternative HIPAA-eligible subscriptions. Fax.Plus healthcare plan requirements.

Staff can use web and mobile applications with individual member access and number assignments. Enterprise includes unlimited members and shared billable fax capacity, so the access model differs from buying a patient-messaging seat for each participant.

Fax.Plus transmission reports help staff check the outcome of a send. A successful transmission does not prove that a clinician read the document or that it was added to a patient chart.

For budgeting, check the assigned users and billable-page rules rather than comparing a fax allowance with a messaging allowance. Incoming pages count for each user assigned to the receiving number; duration and destinations can also affect usage.

A referral workflow using messaging and fax together

For a patient waiting for a specialist appointment, define the handoff between the patient conversation, internal coordination and the external referral packet.

Confirm what the receiving office needs

The staff member preparing the referral verifies the specialist’s fax number and required documents. A familiar office name does not establish that a saved number is current, particularly after a change of location.

Prepare and review the documents

Compile the referral letter and appropriate supporting material. Check the patient, receiving organization and purpose before sending. If both organizations already share an approved document channel, that may also be an option; use fax where the receiving office expects a faxed packet.

Send through the accepted document channel

Send through the practice’s appropriately configured service and check the transmission outcome. Assign any failed send for investigation or retry. A successful report does not establish that the specialist reviewed the referral or filed it in the patient’s chart.

Update the patient through the agreed channel

Use the agreed patient channel to explain that the referral was sent and what the patient should do next. That update need not duplicate the full medical packet in a text or conversation.

Assign follow-up and preserve the relevant record

Assign the unanswered patient question, failed fax or referral that has not progressed to a named staff role. Preserve relevant communications and documents through the approved record process. Verify which steps remain manual instead of assuming the systems automatically synchronize.

Before committing: access, responsibility and records

Can patients use the channel?

Try the complete patient process on the devices people use: notification, authentication, attachment and reply. Establish an approved alternative for patients who cannot complete it, and explain how they should contact the practice when a matter cannot wait for an asynchronous reply.

Who owns the next action?

Set business hours, response expectations, coverage during absence and escalation for shared inboxes. Decide who handles patient replies and who checks the receiving office’s response to a referral. Working call reception or a visible notification does not establish that either queue is being managed.

Can the practice retain control of its records?

Use individual identities and verify access removal when staff leave. Ask IT to confirm which identity-management features the proposed subscription includes and how the organization retains relevant conversations and documents after disabling an account.

Demonstrate exports and any proposed system connection. A PDF export, an application programming interface (API) transfer and automatic chart filing are different capabilities. Establish who reviews and files information where that step remains manual.

What does the complete setup cost?

Price the same staff numbers, patient activity and document tasks. Include required modules, registration and additional usage. BloomText’s contacted-patient allowance, a per-user messaging license and Fax.Plus billable pages measure different things; their starting prices alone do not identify the economical configuration.

Choose the channel around the work

Choose patient messaging for accessible conversations and establish a team process for assigning work. Preserve useful messaging and document-sharing functions you already have.

When the next organization requires a faxed packet, Fax.Plus Enterprise can handle that document exchange with the required HIPAA configuration. The practice still owns recipient verification, transmission follow-up and the handoff into the patient record.