Data minimization
Default reminder templates can avoid unnecessary clinical details in SMS messages and lock-screen previews.
Security & privacy
Design the privacy controls before the first sensitive message is sent.
Care Messaging is being built for care-related workflows, so security, consent and data minimization are part of the product architecture—not an afterthought.
Encryption
Production data should be encrypted in transit and at rest using modern, supported protocols and managed keys.
Role-based access
Caregivers, staff and administrators should only see the recipients and controls appropriate to their role.
Audit history
Security-relevant actions and reminder events can be recorded to support review and accountability.
Consent & opt-out
Production SMS enrollment will include appropriate consent, verification and STOP/HELP handling.
Vendor controls
Healthcare deployments can use infrastructure and messaging vendors that support the required contractual and security obligations.
HIPAA-related use cases
Compliance is a verified operating state—not a logo we should add prematurely.
For customers subject to HIPAA, a production service may need a combination of appropriate vendor agreements, business associate agreements, policies, access controls, training, incident procedures, secure configuration and documented risk management.
Care Messaging will only describe a production configuration as HIPAA compliant after those controls and agreements have been implemented and verified for the applicable service.
Current website status: This marketing site describes the intended security approach. It is not a statement that an unfinished or pre-production Care Messaging service is already HIPAA compliant.
ApplicationAuthentication · authorization · audit events
DataEncryption · minimization · retention controls
MessagingConsent · opt-out · privacy-conscious templates
OperationsPolicies · monitoring · incident response
VendorsSecurity review · contractual requirements · BAAs where applicable
Safety boundaries
Care Messaging is a reminder and communication tool.
Not an emergency service
Recipients and caregivers should call 911 or the appropriate local emergency service for urgent or emergency situations.
Not medical advice
Care Messaging does not prescribe medications, change dosages or replace instructions from qualified healthcare professionals.
Not proof of ingestion
A text confirmation indicates what the recipient reported. It does not independently verify that medication was taken.
Not continuous monitoring
SMS delivery and user responses can be delayed or unavailable. Care Messaging should not be used as a sole safety monitoring system.
Planning for security or compliance requirements?
Tell us about your use case through early access so the production architecture can be evaluated against the right requirements.