Secure Patient Messaging
Communication channels that allow patients to exchange PHI with the practice through encrypted, authenticated portals.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- Security
- Primary sources
- 2
- Workspace handoff
- ask d3 →
Where this comes up
This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.
Full definition
What it is in practice
Patient portals and secure-text platforms provide the channel. They support HIPAA transmission security and create an audit trail. Email and SMS without encryption do not meet the standard for PHI exchange initiated by the practice.
How it shows up in your practice
Direct patients to the portal for clinical communication. Document the patient's preferred communication method when they request unencrypted channels per 45 CFR 164.522(b).
Sources
- 45 CFR 164.312 — Technical safeguardshttps://www.ecfr.gov/current/title-45/section-164.312
- NIST SP 800-66 Rev. 2https://csrc.nist.gov/pubs/sp/800/66/r2/final
Confirm secure-messaging rules in Ask D3
Open ask d3 →Related terms
- DocumentationPatient PortalA secure web-based application that lets patients access portions of their health information and communicate with the practice.
- SecurityEncryption in TransitCryptographic protection of ePHI moving between systems or networks, typically via TLS.
- SecurityTransmission SecurityTechnical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network.
- TelehealthOnline Digital E/M (CPT 99421-99423)CPT codes for online digital evaluation and management services provided by a physician for an established patient over the patient portal or other secure platform.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryEncryption in TransitCryptographic protection of ePHI moving between systems or networks, typically via TLS.
- GlossaryTransmission SecurityTechnical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network.
- GlossaryOnline Digital E/M (CPT 99421-99423)CPT codes for online digital evaluation and management services provided by a physician for an established patient over the patient portal or other secure platform.
- GlossaryPatient PortalA secure web-based application that lets patients access portions of their health information and communicate with the practice.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- SRAHIPAA Contingency Plan for a Small PracticeWhat the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.