On this page
No. As of November 12, 2026, Apple offers no BAA for iMessage. Its iOS software license has HIPAA covered entities agree not to use Apple's software or services to "create, receive, maintain or transmit" protected health information, and its iCloud terms say the same. Texting a patient from your iPhone's Messages app, blue bubble or green, is outside any BAA.
Checked November 12, 2026 on Apple's iCloud terms (last revised September 14, 2026) and its iOS and iPadOS 26 software license (PDF). Confirm Apple's current terms before you rely on this.
What does Apple say?
Apple has no HIPAA page for iMessage. The answer is in two contracts every iPhone user accepts.
- The iOS software license. Section 10(b), headed "HIPAA Covered Entities and Business Associates," reads: "If you are a HIPAA covered entity or business associate, you will not use the Apple Software, Apple Services, or any component or function thereof, to create, receive, maintain or transmit any sensitive, individually-identifiable health information, including protected health information." It goes on to bar any use that would make Apple your business associate.
- The iCloud terms. The "Limitations on Use" section has covered entities and business associates agree not to use any part of the service to create, receive, maintain or transmit protected health information. iCloud is where Messages syncs and backs up.
So Apple doesn't just decline to sign. Its terms ask a practice not to put patient information into its services at all.
Blue bubbles, green bubbles: does it matter?
Not for this question.
- Blue (iMessage) goes through Apple's servers, encrypted end to end. Encryption is a real safeguard, but it isn't a BAA, and Apple's terms rule out the use.
- Green (SMS or RCS) goes through your mobile carrier. You have no BAA with the carrier either.
Either way, the thread lives in the Messages app on your phone, with no audit trail, no way to remove a former VA's access and no link to the chart.
Where do the messages end up?
This is the part practice owners underestimate. With one Apple account, a text to your phone can also appear on:
- your Mac at home and your iPad on the sofa
- a family member's device, if an Apple account is shared
- your Apple Watch, as a banner anyone next to you can read
- iCloud backups
- the lock screen, if message previews are on
A patient who texts a photo of her lab report to your personal number has now placed it in your camera roll, your backups and every device signed in to your account.
What can a practice still use iMessage for?
- your own team and family, about anything that isn't a patient
- vendors, your VA and referral partners, with no patient names tied to health details
- a one-line redirect to a patient who texted you first
Keep out: symptoms, medications and doses, lab results, photos, appointment details that name the visit type, and "quick questions" from patients about their care.
What if a patient texts your personal number?
You can't prevent it. What you do next is up to you. Don't carry on the clinical conversation in the thread.
A reply that works: "Thanks for reaching out. To keep your information private, we can't discuss care by text on this number. Please message us in the patient portal or call the office line." Then answer in the portal, note it in the chart and delete the thread, including any photo saved to your camera roll.
The lasting fix is to stop giving out your cell. Put a practice number on your website, your forms and your email signature, so patients have somewhere covered to text from day one.
Where do practices slip up?
It starts on launch day. The owner's cell is the only phone the practice has, so it goes on the intake form. Six months later there are forty patient threads in Messages, mixed in with family chats, syncing to a laptop the kids use.
The second slip is the iPhone as a relay. A practice buys a texting tool with a BAA, then turns on forwarding so texts also arrive in Messages "to be safe." That copy is the problem the tool was bought to solve.
What to use for patient texts instead
| Option | BAA | Plan |
|---|---|---|
| iMessage or carrier texting from your phone | No | Not on any plan |
| No | Not on any plan | |
| Spruce Health | Yes | All trials and paid plans |
| Quo (formerly OpenPhone) | Yes, on request | Business or Scale |
| Google Voice with Workspace | Yes, under the Workspace BAA | A Voice license on a paid Workspace account |
| Your EHR's portal or messaging | Covered by the EHR's BAA | Depends on the EHR |
Each of these runs as an app on the same iPhone, so you still carry one device. The difference is where the messages are stored and who has signed for them. For consent wording and what a reminder may say, read HIPAA-compliant texting for a solo practice. Related: Is Google Voice HIPAA compliant? and Is WhatsApp HIPAA compliant?
To check every tool you use, try the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Apple sign a BAA for iMessage?
No. Apple's iOS license and iCloud terms have HIPAA covered entities agree not to use Apple services for protected health information, or in any way that would make Apple a business associate (as of November 2026).
Is iMessage HIPAA compliant because it is encrypted?
No. End-to-end encryption protects a message in transit, but HIPAA also requires a BAA with the vendor, and Apple's terms rule that out. Messages also sync to other devices and backups.
Can I text patients from my personal iPhone?
Not from the built-in Messages app. Use a texting app with a BAA on the same phone, such as Spruce, Quo on the right plan, or Google Voice with Workspace.
What should I do if a patient texts me health information?
Reply without clinical detail, direct them to your portal or practice line, answer there, record it in the chart and delete the thread from your phone.