Secure Patient Messaging Beats Texting From a Personal Phone

Secure patient messaging exists at almost every behavioral health practice, and at almost every behavioral health practice somebody is still texting patients from a personal phone. It starts for a good reason. A patient is anxious about a first appointment, the front desk is closed, and a clinician does the humane thing with the tool in their hand.

Then it becomes the channel. The patient texts that number when they need to reschedule. They text it at 11pm. They text it after the clinician leaves the practice, to a number the practice does not own and cannot see.

Nothing about that exchange is in the record. It is not visible to the covering clinician, it cannot be audited, and it does not exist if anyone ever asks what was said. The convenience was real. So is the exposure, and behavioral health feels this boundary harder than any other specialty because the relationship is the treatment and the pressure to stay reachable is constant.

The personal number is not a policy gap, it is a product gap

Practices usually respond to this with a memo. Do not text patients from your phone. The memo does not work, because it removes a capability without replacing it, and the underlying need was real.

The need is asynchronous contact that does not require anyone to be at a desk. Patients want to confirm, reschedule, ask a logistics question, and say they are running late, and they want to do it by typing. If the practice does not offer a channel that does that, staff will improvise one.

So the fix is to make the sanctioned channel more convenient than the improvised one. Messages sent to the patient through athenaOne secure messaging, replies landing in a queue the practice actually watches, and an automated first response that handles the common cases without waiting for a human.

When the sanctioned channel answers in seconds and the personal phone answers whenever the clinician looks, the improvisation stops on its own.

Patients are already in the channel you are not using

The objection is usually that patients will not use a portal. That was true once and it has moved.

Nearly three in five individuals nationwide reported they were offered and accessed their online medical record or patient portal in 2022, a 50 percent increase since 2020. The channel carries real volume now, which is what makes it worth instrumenting rather than treating as a checkbox.

Behavioral health has an additional reason to prefer it. Portal access is identity-bound and auditable in a way a phone number never is. When a patient’s circumstances change, and in this specialty they change often, you can see and control who has access. A personal cell number gives you neither.

Enrollment is the work. A practice that treats portal sign-up as something that happens at check-in when there is time will always have a low-adoption channel. A practice that runs enrollment as an outbound motion, with a call and a follow-up secure message, gets a channel it can rely on within a quarter.

Inbound messages route on a field that is usually wrong

Move the traffic into the sanctioned channel and you inherit a routing problem that the personal phone did not have. A text to a clinician’s cell always reached that clinician. A secure message has to be routed, and most practices route it on the chart’s primary provider field.

That field is stale almost everywhere. Patients get assigned at registration and never reassigned, clinicians leave, caseloads get rebalanced, and the field keeps reporting a relationship that ended. In behavioral health, where a patient may have moved from an intake clinician to a therapist to a prescriber, it is wrong more often than it is right.

The fallback that works is recent contact. Who has actually seen this patient in the last several months, and who is scheduled to see them next. Read that instead of trusting the field, and messages land where the patient expects them to land.

When the answer is genuinely ambiguous, which happens when a patient sees both a prescriber and a therapist, the message goes to the practice queue with both names attached and a human assigns it. The system does not pick between two clinicians. That is the handoff, and keeping it explicit is what prevents a message quietly sitting in the wrong inbox for three days.

Do not rebuild the inbox problem you were trying to escape

There is a failure mode waiting on the other side of this migration. You move everyone into secure messaging, volume grows, and the clinician inbox becomes the new place work goes to die.

That pattern is well documented outside behavioral health. The AMA has covered clinician inbox burden at length, noting that most organizations can reduce inbox volume by 50% by eliminating redundant notifications and other noise. The lesson is that channel migration without triage design just relocates the load.

So the design has to sort before a clinician sees anything. Scheduling requests, cancellations, billing questions, form and letter requests, and insurance questions are administrative and can be handled or queued without clinical attention. What reaches the clinician is what actually requires them.

The AI does not decide how a patient is doing and does not respond to anything clinical. It reads what the patient asked for, handles the logistics it can complete, and passes the rest through untouched with the context attached. Every automated exchange is written to the record, which is precisely what the personal phone could never do.

Say what the channel promises, in the channel

The most common real-world harm here is not a breach. It is a patient who believed somebody was reading.

A channel that answers scheduling questions in ten seconds teaches people that messages get read immediately. If that channel is not monitored overnight, the practice has made a promise it does not keep, and the patient who needed something urgent typed it into a queue instead of calling.

So the automated response states the boundary every time, in plain language. What this channel is for, when a person reads it, what to do if the situation cannot wait, and the emergency instruction stated first rather than buried. That message costs nothing and it is the single most valuable line in the whole workflow.

For programs covered by the federal confidentiality rules for substance use disorder records, the consent and disclosure requirements are stricter than the general privacy rule, and the channel configuration has to reflect that rather than assume the default is sufficient. Get that reviewed once, in writing, before the volume arrives.

Key Takeaways

Treat personal-phone texting as a missing product rather than a discipline problem, because a memo removes the capability without replacing it.
Make the sanctioned channel faster than the improvised one, since staff improvise only when the approved path is slower.
Run portal enrollment as an outbound motion instead of a check-in afterthought, or the channel stays too thin to rely on.
Stop routing inbound secure messages on the chart’s primary provider field and use recent contact instead.
Send genuinely ambiguous messages to a practice queue with the candidate clinicians named, and let a human assign them.
Sort administrative requests out of the clinical inbox before migration, or you rebuild the overload you were escaping.
State what the channel promises inside the channel, with the emergency instruction first, every single time.

The personal phone problem never gets solved by policy alone, because the behavior is a response to a real gap. Close the gap instead. Put the traffic on athenaOne secure messaging, route it on who has actually seen the patient, handle the administrative half automatically, and say plainly in every reply what the channel is and is not for. Then every exchange is in the record, the covering clinician can see it, and nobody’s continuity of care depends on a number the practice does not control.

Sources