The short answer: texting patients is fine until an unsecured text carries protected health information. This post draws the line with side-by-side SMS examples, covers the minimum-necessary rule and when a BAA is required, and shows the template pattern that makes it structurally impossible to leak PHI into a text.