Summary
Patient messaging is HIPAA compliant when the practice has a signed business associate agreement with the vendor, applies access and audit controls, addresses encryption in its risk analysis and honours how each patient asks to be contacted. HIPAA has no certification, so no product is compliant on its own. Readiness comes from the agreement, the safeguards and the way the practice runs them. Spruce includes a business associate agreement on all trials and paid plans, from $24 a user a month on 9 November 2026. Weave offers 2-way texting from $199 a month. Wai suits private clinics wanting messages on the patient's own record. Email, web forms, WhatsApp and calls reach 1 thread per patient, every reply is drafted for a named person to approve, and Wai signs a business associate agreement before go-live. Data is encrypted with AES-256 at rest and TLS 1.3 in transit. Review each channel you plan to use in your own risk analysis, with your privacy lead, before it goes live.
Each rival detail comes from that company's own page, read 9 November 2026. 12
See it in your clinicYou can be running this week. No procurement, no minimum term. A 7-day trial, then one published price.
Request a demo| Product | BAA | Channels | Published price, read 9 November 2026 |
|---|---|---|---|
| Spruce | Included on all trials and paid plans | Phone, SMS, secure messaging, video, fax | Basic $24, Communicator $49 a user a month |
| Weave | See Weave's terms | 2-way texting, missed call texting, confirmations | From $199 a month |
| Wai | Signed before go-live | Email, web forms, WhatsApp and calls in 1 thread per patient | Studio priced per location after a demo |
What the rule asks
A practice may let a vendor handle protected health information once it has written assurance of safeguards.3 The business associate agreement entry explains the document. The Security Rule requires access limited to authorised people and mechanisms that record and examine activity.4
Encrypting data in transit is an addressable specification, applied whenever deemed appropriate.4 Patients may also ask for communications by a particular method or at a particular address, and providers honour reasonable requests.5
Reviewing each channel
Each channel deserves its own line in the risk analysis, from secure app messages to SMS, email and WhatsApp. Record which content may travel on each, and how a patient's stated preference is applied.
This article is general information, and your privacy lead or counsel makes the final call. HIPAA and clinical AI covers related vendor questions, and the HIPAA entry gives the background.
Messages on the Wai record
Wai is designed for practices covered by HIPAA, signs a business associate agreement before anything goes live and logs every read of a record.6 Access is enforced by role in the database.6
Replies are drafted for a named person to approve,7 as set out in human approval of patient messages. One inbox for clinic messages shows the working day.
Bring your risk analysis. We answer each question in writing, control by control.
Request a demoFrequently asked questions
Is texting patients HIPAA compliant?
Do we need a BAA with our messaging vendor?
Yes, where the vendor handles protected health information for a covered practice.3
Is encryption required under HIPAA?
Encryption in transit is an addressable specification, applied whenever deemed appropriate, and the decision belongs in the risk analysis.4
Is Wai HIPAA compliant?
HIPAA has no certification. Wai is designed for practices covered by HIPAA and signs a business associate agreement before go-live.6
Who sends the messages on Wai?
A named person at the clinic approves each reply before it goes.7
Can a patient choose how we contact them?
Yes. Providers must accommodate reasonable requests for communication by other means or at other locations.5
Sources
- Pricing, read 9 November 2026
- Pricing, read 9 November 2026
- 45 CFR 164.502, uses and disclosures of protected health information, read 9 November 2026
- 45 CFR 164.312, technical safeguards, read 9 November 2026
- 45 CFR 164.522, rights to request privacy protection, read 9 November 2026
- HIPAA at Wai, read 9 November 2026
- The clinic platform, read 9 November 2026
Every patient message, approved by your team
Bring one real clinic day and we will walk through it on your own workflows. We reply within 24 hours.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what Wai does between the visits