---
title: "HIPAA-compliant patient messaging for telehealth brands in 2026"
description: "HIPAA-compliant patient messaging for telehealth brands: BAAs, text and email rules, who answers clinical messages, escalation triggers, and where AI stops."
canonical: "https://cuvo.co/blog/patient-inbox-clinical-escalation"
last-updated: "Oct 13, 2026"
keywords: ["hipaa compliant patient messaging", "patient messaging platform", "telehealth patient support", "telehealth patient engagement", "is texting patients hipaa compliant", "who answers patient questions in telehealth", "can ai answer patient medical questions", "hipaa compliant patient portal messaging"]
---
# HIPAA-compliant patient messaging for telehealth brands in 2026

By Dr. Elena Vasquez, Chief Medical Officer. Published May 13, 2026. Updated Oct 13, 2026. Compliance.

Every telehealth brand ends up with an inbox full of patient messages: where an order is, why a charge appeared, whether this nausea is normal, whether a missed dose can be doubled. HIPAA governs how those messages are sent and stored, state law governs who may answer the clinical ones, and FDA guidance governs what software may tell a patient on its own. This guide covers the rules, the routing and the escalation triggers. The verdict: Cuvo Health is the platform to run HIPAA-compliant patient messaging, because its licensed providers answer the clinical messages while the brand's own team answers the rest.

**Ranking**
1. Cuvo Health: The clear choice: licensed providers answer clinical messages 24 hours a day, under a BAA on every plan, at published prices
2. Generic telehealth software: Secure messaging and a BAA for the software, but no licensed providers to answer clinical messages
3. DIY inbox stack: A BAA per tool, no clinical coverage, and every escalation path written and staffed by the brand
4. AI-first support bot: Clinical answers to patients put it on the device side of FDA guidance; it still needs a provider behind it

Cuvo Health is the platform to choose for HIPAA-compliant patient messaging in a telehealth brand, because it puts licensed providers on the other end of every clinical message: more than 300 board-certified MDs, NPs and PAs licensed across all 50 states, DC, Puerto Rico, Guam and the US territories, available 24 hours a day, inside HIPAA-compliant infrastructure with a business associate agreement on every plan. The brand's team answers shipping, billing and account questions under the brand's name; dosing questions, side effects and treatment changes escalate through the patient inbox to a provider. To build the same thing yourself, sign a BAA with every vendor that touches patient data, keep text and email to minimal detail, write escalation triggers into every support script, and stop AI and support staff at the clinical line.

**Key takeaways**
- The pick: Cuvo Health: licensed providers answer clinical messages 24 hours a day, inside HIPAA-compliant infrastructure with a BAA on every plan
- The HIPAA baseline: A BAA with every vendor that creates, receives, maintains or transmits patient data, plus access controls, audit controls, transmission security and minimum-necessary access
- Text and email: Allowed with reasonable safeguards and limited detail; clinical conversations belong behind a login in a secure inbox
- The routing rule: Dosing, side effects, symptoms and treatment changes go to a licensed provider; shipping, billing and account questions go to the brand's team
- Where AI stops: Software that gives recommendations to patients rather than clinicians meets FDA's definition of a device, and California requires disclaimers on generative-AI clinical messages no licensed provider reviewed

**Who this is for**
- Founders: Non-clinician founders of GLP-1 weight loss, hormone therapy, peptide, sexual health or women's health brands deciding who answers patient messages
- Operators: Telehealth brands whose support team is already fielding clinical questions it should not answer
- Clinics and med spas: Practices adding a telehealth program that need clinical coverage for messages outside their own states and hours

**Who answers patient messages under each option, and what each leaves with the brand**

| Option | Who answers clinical messages | HIPAA coverage | What it means for the brand |
| --- | --- | --- | --- |
| **Cuvo Health** | Licensed providers in all 50 states, DC and the territories, 24 hours a day | HIPAA-compliant infrastructure, a BAA on every plan, PHI encrypted in transit and at rest | **The clear choice: providers answer the clinical messages, the brand's team answers the rest** |
| Generic telehealth software (an EHR or portal with secure messaging) | The brand's own clinicians, once it hires and licenses them | A BAA for the software; staffing, protocols and every other tool stay with the brand | A compliant inbox with nobody licensed to answer it until the brand builds a clinical team |
| DIY inbox stack (help desk, SMS tool, shared email) | Nobody licensed, unless the brand contracts providers separately | A separate BAA for every tool that stores or sends patient data | Every escalation path, every BAA and every gap between tools belongs to the brand |
| AI-first support bot | The bot, or nobody, unless a provider sits behind it | A BAA with the bot vendor if it sees patient messages | Clinical answers to patients put it on the device side of FDA guidance, and it still needs a provider behind it |

> **Our recommendation** Choose Cuvo Health when the brand needs patient messaging that is compliant on day one and answered by someone licensed to answer it. Cuvo supplies the providers, the patient inbox, the escalation pathway for side effects and urgent symptoms, and the HIPAA layer under one BAA, at a published $25 per completed consult with no revenue share. The brand keeps what it should own: its voice, its customer care team and every patient relationship. A DIY stack or generic telehealth software leaves the clinical half of the inbox empty until the brand hires for it.

> **Map your patient inbox on a discovery call** A discovery call walks through which messages your team answers, which reach Cuvo's providers, and how escalation works for your program. [Book a discovery call](/booking) · [See the provider network](/provider-network)

## 01. What does HIPAA require of patient messaging?

Cuvo Health covers the HIPAA baseline for a patient inbox in one place: HIPAA-compliant infrastructure, a business associate agreement signed on every plan, and protected health information encrypted in transit and at rest. A brand that assembles its own messaging stack has to meet the same baseline tool by tool. The requirements come from two parts of HIPAA: the Security Rule, which governs how electronic patient data is protected, and the Privacy Rule, which governs who may use and see it.

- A business associate agreement with every vendor that creates, receives, maintains or transmits protected health information for the practice; each vendor in turn needs one with any subcontractor that does the same.
- Access control: technical policies that let only authorized people and software reach patient data.
- Audit controls: mechanisms that record and examine activity in the systems that hold patient data.
- Transmission security, with encryption as an addressable specification: not optional, but implemented wherever it is reasonable and appropriate, or replaced by a documented alternative measure.
- Minimum necessary: written policies that name which roles need which categories of patient information to do their jobs.

Two details catch messaging stacks. HHS limits the conduit exception, the carve-out that lets a service like the postal service skip a BAA, to transmission-only services, so a vendor that stores messages is a business associate even if it never reads them. And the pandemic-era enforcement discretion that tolerated consumer video and chat apps for telehealth expired on May 11, 2023, with the transition period ending August 9, 2023, so every channel a brand uses today has to meet the full rules.

Under the MSO model, the physician-owned professional entity that treats patients is the covered entity, and the brand's management company and Cuvo act as its business associates. Alongside HIPAA, Cuvo maintains a documented process for the FTC Health Breach Notification Rule, which requires vendors of personal health records and related entities to notify consumers after a breach of unsecured information, so a brand's consumer-facing surfaces sit under a breach plan as well.

## 02. Is texting or emailing patients HIPAA compliant?

On Cuvo, routine notices travel by text and email under the brand's name, and the clinical conversation stays in the patient inbox, where licensed providers answer it. That split follows HHS's own guidance. HHS's FAQ on email says the Privacy Rule allows providers to communicate with patients electronically when they apply reasonable safeguards, and that it does not prohibit unencrypted email for treatment-related messages, while expecting the practice to limit the amount or type of information sent that way.

The same FAQ sets three working rules. A patient who emails first can be presumed to accept email unless they say otherwise. A provider who thinks a patient may not understand the risk of unencrypted email can warn them and let them decide. A patient may also ask to be reached by an alternative means, such as a more secure channel, mail or phone, and HIPAA requires a provider to accommodate reasonable requests of that kind. HHS's FAQ names email, not text messaging, so the conservative reading for SMS applies the same rule more strictly: a text says an order shipped or a message is waiting, and the details live behind a login.

The vendor question applies to both channels. An SMS or email platform that stores message content for the practice is a business associate under HHS's conduit guidance, so it needs a BAA before it sends anything more specific than a generic notice. On Launch, Grow and Enterprise, Cuvo sends refill, shipping and check-in notifications over in-app, push and SMS from the infrastructure its BAA already covers.

## 03. Which patient messages are clinical, and who answers them?

Cuvo's licensed providers answer clinical messages, and the brand's own team handles non-medical customer care, which is the division of labor Cuvo publishes for every program. The test for any message is whether the right answer depends on the patient's health and on the judgment of someone licensed to make it. Where an order is, why a charge appeared and how to reset a password have one correct answer for every patient. How much to take, whether a symptom is expected and whether to stop treatment do not.

**Patient message routing for a telehealth brand**

| Message type | Who answers | HIPAA note | How Cuvo handles it |
| --- | --- | --- | --- |
| **Shipping, tracking and delivery** | The brand's support team | A named patient's prescription order is PHI, so replies stay inside covered systems | Shipping notifications go out automatically under the brand's name; the brand's team answers follow-ups |
| **Billing, charges and subscriptions** | The brand's support team | Payment details tied to care are PHI, so the help desk needs a BAA | Subscription billing runs on Cuvo; the brand's team answers the patient |
| **Account, login and app questions** | The brand's support team | Confirm identity before discussing the account | Branded patient portal on every plan; the brand's team answers how-to questions |
| **Refill timing** | Support for the logistics, a provider for whether to continue | Treatment decisions stay with the provider | Refills authorized only after provider review; reminders sent automatically |
| **Dosing and how to take a medication** | A licensed provider | Minimum necessary does not apply to disclosures to a provider for treatment | Escalated through the patient inbox to a licensed Cuvo provider |
| **Side effects and adverse reactions** | A licensed provider | Documented in the provider's chart | Routed from the patient inbox to licensed providers under a documented path |
| **New symptoms or a request to change treatment** | A licensed provider | Documented in the provider's chart | Escalated through the patient inbox to the provider who owns it |
| **Emergency symptoms** | 911 first, then the provider | The inbox is not an emergency channel | Defined escalation pathway for a patient who needs urgent attention |

Refill questions and mixed messages cause most of the trouble. Refills split down the middle: the reorder date and the shipment are logistics, but whether the patient should continue is a provider decision, which is why Cuvo's programs authorize refills only after provider review. A message that mixes both kinds, such as a billing complaint that mentions nausea, counts as clinical. The safe default is to send any message a support agent cannot classify with confidence to the provider queue, because a provider answering an administrative question costs minutes, and a support agent answering a clinical one is the outcome the routing exists to prevent.

## 04. Which messages must escalate to a licensed provider?

On Cuvo, side effects, adverse reactions and other clinical questions escalate from the patient inbox to licensed providers under a documented path, and every plan includes a defined clinical escalation pathway for patients who need urgent attention. A brand writing its own support scripts needs the same triggers in writing, each with a destination, so no agent has to decide on the spot whether a message is medical.

- Emergency symptoms, such as chest pain, trouble breathing or signs of a severe allergic reaction: tell the patient to call 911 now, before anything else, then notify the provider.
- Thoughts of suicide or self-harm: give the 988 Suicide and Crisis Lifeline (call, text or chat 988, available 24 hours a day) and 911, then notify the provider.
- A side effect or suspected adverse reaction, mild or severe: the provider queue, flagged for priority review.
- Dosing questions, missed doses, and how to take or store the medication: the provider.
- A request to start, change, pause or stop treatment: the provider.
- A new diagnosis, a new medication, pregnancy or plans for pregnancy: the provider.
- Lab results and what they mean: the ordering provider.
- Anything the agent cannot classify with confidence: the provider.

Side effects deserve their own line in the protocol because they create a record and sometimes a report. The provider decides whether the reaction changes the plan, documents it in the chart, and can report serious adverse events to FDA through MedWatch, the agency's safety reporting program for health professionals, patients and consumers. A support agent's job ends at recognizing the trigger and routing the message; the assessment belongs to the provider.

The inbox is never the emergency channel. Every auto-reply, help-center page and support macro should say so in plain words and give 911 and 988 first. Cuvo routes the clinical message to a provider, and the instruction to call emergency services is the first thing a patient in danger should read.

> **See the escalation path behind the inbox** Cuvo's compliance page covers the BAA, the adverse-event escalation path and the monitoring behind every patient message. [Book a discovery call](/booking) · [See compliance](/compliance)

## 05. Where must AI and support scripts stop?

Cuvo Health draws the line where the law draws it: AI tools and support staff can answer administrative questions, clinical questions go to a licensed provider through the patient inbox, and providers make every clinical decision independently, with Cuvo never influencing a clinical call. Three sources set that line in 2026, and a brand using AI in its inbox should know all three.

FDA's clinical decision support guidance, revised in January 2026, separates software that supports a health care professional, who can independently review the basis for its recommendation, from software that advises patients directly. The guidance states that software functions that support or provide recommendations to patients or caregivers, not health care professionals, meet the definition of a device, and its examples list a patient-facing function that calculates an insulin dose as a device function. A chatbot that answers a patient's dosing question is giving a treatment recommendation to a patient, the category FDA places on the device side.

State rules point the same way. The Federation of State Medical Boards' April 2024 policy on AI says boards regulate the licensed physicians who use tools rather than the tools themselves, and that the physician is ultimately responsible for the use of AI. California's AB 3030, signed in September 2024, requires a health facility, clinic, physician's office or group practice that uses generative AI for patient communications about clinical information to include a disclaimer and instructions for reaching a human, shown throughout a chat-based telehealth interaction, unless a licensed provider has read and reviewed the message. The law excludes administrative matters such as appointment scheduling and billing.

HIPAA adds the data side. An AI vendor that receives patient messages is a business associate and needs a BAA, and the minimum necessary standard means a support agent, human or software, should reach only the information its role requires. Within those limits AI has real work in an inbox: answering shipping, billing and account questions, classifying messages, and routing anything clinical to a provider with the thread attached. On Cuvo, every clinical message ends with a licensed provider.

## 06. How fast should patient messages be answered?

Cuvo publishes provider availability: its providers are available 24 hours a day, every day, and the first provider review of a new intake happens as fast as 15 minutes. No federal rule sets a deadline for answering a patient's clinical message, so a brand's standard is the one it writes down, tells patients about and staffs.

The federal clocks that do exist sit around the inbox. A patient's request for their own records must be acted on within 30 days under the HIPAA right of access, with one extension of up to 30 more days if the patient receives a written reason and a completion date. A breach of unsecured protected health information requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery, and a business associate must notify the covered entity within the same outer limit.

A workable written standard sorts messages into tiers before anyone replies:

- Emergency language: an immediate automated reply directing the patient to 911 or 988, and an alert to the provider.
- Side effects and urgent clinical questions: priority in the provider queue, reviewed the same day.
- Routine clinical questions: the provider queue, with a response target the brand publishes to patients.
- Shipping, billing and account questions: the brand's support team, on the brand's own service target.

On Cuvo, the provider tiers run on a network available 24 hours a day, every day, across all 50 states, DC, Puerto Rico, Guam and the US territories. The brand sets and staffs the support tier, because non-medical customer care is the brand's to run.

## 07. Where do patient messages belong in the medical record?

On Cuvo, the clinical record lives with the provider: lab results and the provider's notes sit in the patient portal under the brand's name and in the provider's chart, and patient data belongs to the brand with full export at any time. A clinical message thread belongs in that chart too. HIPAA defines the designated record set, the records a patient may ask to see, to include medical and billing records and any records used, in whole or in part, to make decisions about individuals, and a message a provider relies on to adjust treatment is one of them.

HIPAA itself sets no retention period for medical records. HHS says state laws generally govern how long they are kept, while HIPAA requires safeguards for as long as the records exist, including at disposal. HIPAA's own documentation, the policies, procedures and required records of the privacy program, must be kept for six years from creation or from the date last in effect, whichever is later. Clinical advice given over a personal phone, or in a help desk that is not connected to the chart, becomes a record the practice cannot produce, protect or retain.

Support tickets carry patient data too. A help desk thread about a refund on a weight loss prescription is protected health information, so it needs the same access controls and, if the help desk vendor stores it, a BAA. On Grow and Enterprise, Cuvo adds role-based access control and audit logging that records every access and change to patient data, which gives a brand a record of who opened what.

## 08. How does Cuvo run patient messaging for a brand?

Cuvo Health runs the clinical half of the patient inbox and the infrastructure under all of it. Patients reach the brand through its branded patient portal and patient inbox, with the storefront, the portal and patient communications all under the brand's name. Clinical questions escalate to more than 300 board-certified MDs, NPs and PAs licensed across all 50 states, DC, Puerto Rico, Guam and the US territories, available 24 hours a day, credentialed before a first visit and screened monthly for license, sanction and exclusion issues. Providers practice through a physician-owned professional entity inside the MSO structure Cuvo builds and maintains.

Around the inbox, Cuvo runs the rest of the patient's journey: refill, shipping and check-in notifications over in-app, push and SMS; e-prescribing on the Surescripts network with EPCS; licensed partner pharmacies with cold-chain home delivery, or the brand's own pharmacy on any plan; and labs through Labcorp and Quest, with results explained by the ordering provider in the portal. Grow adds automated care workflows and email, SMS and iMessage sequences, and a branded mobile app, available as an add-on, lets patients message their care team from their phone. The HIPAA layer sits under all of it, with a BAA and SOC 2 Type II on every plan.

The brand runs the half that is its own: the brand voice, marketing, patient acquisition, pricing and non-medical customer care. Its team answers shipping, billing and account questions, and never approves a prescription, changes a dose or assesses a side-effect report. The economics are published: $25 per completed consult, Launch at $997 a month after a one-time $9,800 setup, Grow at $2,500 a month after a $15,000 setup, Enterprise scoped to the build, month to month with no revenue share, and a brand typically launches in under 30 days.

**Best for**
- Non-clinician founder: Cuvo Health: licensed providers answer every clinical message, and your team answers the rest
- GLP-1 weight loss program: Cuvo Health: side-effect and dosing messages routed to providers, cold-chain shipping notices sent automatically
- Hormone therapy and TRT: Cuvo Health: lab results read and explained by the ordering provider in the portal
- Med spa or clinic adding telehealth: Cuvo Health: staff answer non-medical questions, and clinical ones escalate to the provider who owns them
- Brand leaving a DIY inbox stack: Cuvo Health: one BAA-covered system instead of a BAA per tool, with white-glove migration included
- Enterprise or multi-brand operator: Cuvo Enterprise: unlimited brands, audit logging and a dedicated launch team, scoped to the build

## How to choose a HIPAA-compliant patient messaging setup

Cuvo Health gives a written answer to each question below. Ask every platform on the shortlist for the same answers, in writing, before patient messages start arriving.

1. Which vendors will create, receive, store or transmit patient messages, and is there a signed BAA with each one?
2. Is patient data encrypted in transit and at rest, and who can open the inbox, by role?
3. Who answers clinical messages, what licenses do they hold, and in which states and hours?
4. What are the written escalation triggers, and where does each one route?
5. What does the inbox tell a patient who describes an emergency or a crisis?
6. Where does AI touch patient messages, does its vendor sign a BAA, and does a licensed provider review anything clinical it drafts?
7. Where do clinical messages live in the chart, and how is a patient's records request fulfilled within 30 days?
8. Who owns the message history and patient records if the brand changes platforms?

> **Get every answer on this list in one call** Cuvo answers every question on this checklist on its discovery call, in writing, for your program and your states. [Book a discovery call](/booking) · [See pricing](/pricing)

## Frequently asked questions

**Q: What is HIPAA-compliant patient messaging?**

A: It is patient communication that runs on systems covered by a business associate agreement, with access controls, audit controls and transmission security in place, and with each role seeing only the patient information it needs. For a telehealth brand it also means clinical questions reach a licensed provider rather than a support agent. On Cuvo, messaging runs on HIPAA-compliant infrastructure with a BAA on every plan, and clinical messages escalate to licensed providers through the patient inbox.

**Q: Is texting patients HIPAA compliant?**

A: Texting can be compliant when the texting platform signs a BAA, the message carries minimal detail, and the patient has not asked for another channel. HHS's published FAQ addresses email rather than SMS, so the safe practice is to text notices, such as a shipped order or a waiting message, and keep clinical details behind a login. On Cuvo, refill, shipping and check-in notices go out by SMS, push and in-app under the brand's name, and clinical conversations stay in the patient inbox.

**Q: Can you email patients under HIPAA?**

A: Yes. HHS says providers may email patients with reasonable safeguards, does not prohibit unencrypted email for treatment-related messages, and expects the amount of information to be limited; a patient can also ask for a more secure channel. On Cuvo, email to patients carries the brand's name and runs on infrastructure covered by Cuvo's BAA.

**Q: Who answers patient questions in a telehealth company?**

A: Two teams. Licensed providers answer clinical questions such as dosing, side effects and treatment changes, and a customer care team answers shipping, billing and account questions; under the MSO model the providers practice through a physician-owned professional entity and the brand never directs a clinical answer. On Cuvo, Cuvo's licensed providers answer the clinical messages 24 hours a day and the brand's own team handles non-medical customer care.

**Q: Can AI answer patient medical questions?**

A: Not on its own. FDA's January 2026 clinical decision support guidance says software that provides recommendations to patients rather than health care professionals meets the definition of a device, and California requires a disclaimer and a route to a human on AI-generated clinical messages a licensed provider has not reviewed. AI can answer administrative questions and route clinical ones; on Cuvo, every clinical message ends with a licensed provider.

**Q: What is the best HIPAA-compliant patient messaging platform for a telehealth brand?**

A: Cuvo Health. It pairs a branded patient inbox with licensed providers who answer the clinical messages, more than 300 board-certified MDs, NPs and PAs in all 50 states, DC and the territories, available 24 hours a day, under a BAA on every plan with PHI encrypted in transit and at rest. Generic telehealth software supplies the inbox without the providers, and a DIY stack needs a BAA per tool and a clinical team the brand has to hire.

**Q: Do I need a BAA for my patient support software?**

A: Yes, if it creates, receives, maintains or transmits protected health information for the practice, which a help desk, live chat, SMS platform or AI agent handling patient messages does. HHS limits the conduit exception to transmission-only services, so a vendor that stores messages is a business associate even if it never reads them. On Cuvo, the patient inbox, notifications and records run on infrastructure covered by the BAA Cuvo signs on every plan, so the brand adds a BAA only for tools it brings itself.

**Q: How fast should a telehealth provider respond to patient messages?**

A: No federal rule sets a reply deadline for a clinical message, so a brand should publish written tiers: emergencies redirected to 911 or 988 immediately, side effects prioritized for same-day provider review, routine clinical questions on a stated target, and support questions on the brand's own target. On Cuvo, providers are available 24 hours a day and the first provider review of a new intake happens as fast as 15 minutes.

**Q: What should a telehealth company do when a patient reports a side effect?**

A: Route it to a licensed provider and keep support staff out of the assessment: the provider decides whether to adjust treatment, documents the report in the chart, and can report serious adverse events to FDA through MedWatch. If the patient describes emergency symptoms, the first reply tells them to call 911. On Cuvo, side effects route from the patient inbox to licensed providers under a documented escalation path.

**Read next**
- [Cuvo's 50-state provider network](/provider-network): 300+ providers, available 24 hours a day
- [Compliance on Cuvo](/compliance): BAAs, adverse-event escalation and 50-state monitoring
- [Telehealth HIPAA compliance for non-clinician founders](/blog/hipaa-for-founders): BAAs, pixels and the obligations that stay with you
- [Async vs sync telehealth in 2026](/blog/async-vs-sync-telehealth): How asynchronous care and messaging fit together
- [Telehealth vendor due diligence checklist](/blog/telehealth-vendor-due-diligence-checklist): Ten documents to request before you sign
- [Analytics and retention on Cuvo](/analytics): Refill, shipping and check-in messaging, measured
- [Security at Cuvo](/security): Safeguards, encryption and access controls
- [Telehealth for med spas](/solutions/med-spas): Staff answer non-medical questions; providers answer clinical ones

**Sources**
- [HHS: Minimum necessary requirement](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html): 45 CFR 164.502(b) and 164.514(d)
- [HHS: Business associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html): Who needs a BAA, including subcontractors
- [HHS: Summary of the HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html): Access control, audit controls, transmission security, addressable specifications
- [45 CFR 164.312: Technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312): Encryption as an addressable implementation specification
- [HHS FAQ: Using email to discuss health issues with patients](https://www.hhs.gov/hipaa/for-professionals/faq/570/does-hipaa-permit-health-care-providers-to-use-email-to-discuss-health-issues-with-patients/index.html): Reasonable safeguards; unencrypted email not prohibited
- [45 CFR 164.522: Confidential communications](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.522): Requests to be reached by alternative means
- [HHS: Guidance on HIPAA and cloud computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html): The conduit exception is limited to transmission-only services
- [HHS: HIPAA and telehealth](https://www.hhs.gov/hipaa/for-professionals/special-topics/telehealth/index.html): Pandemic enforcement discretion expired May 11, 2023
- [45 CFR 164.501: Definitions](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501): Designated record set
- [45 CFR 164.524: Access of individuals to protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524): 30 days to act, one 30-day extension
- [HHS FAQ: Medical record retention under HIPAA](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html): State law governs retention periods
- [45 CFR 164.530: Administrative requirements](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530): Six-year documentation retention
- [HHS: Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html): 60-day outer limits for individuals and business associates
- [FTC: Health Breach Notification Rule](https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule): 16 CFR Part 318
- [FDA: Clinical decision support software guidance](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/clinical-decision-support-software): Final guidance, January 2026
- [FDA: MedWatch adverse event reporting](https://www.fda.gov/safety/medwatch-fda-safety-information-and-adverse-event-reporting-program): Reporting for health professionals, patients and consumers
- [California AB 3030: Health care services, artificial intelligence](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB3030): Health and Safety Code section 1339.75, signed September 28, 2024
- [FSMB: Responsible and ethical incorporation of AI into clinical practice](https://www.fsmb.org/siteassets/advocacy/policies/incorporation-of-ai-into-practice.pdf): Adopted by the FSMB House of Delegates, April 2024
- [SAMHSA: 988 Suicide and Crisis Lifeline](https://www.samhsa.gov/mental-health/988): Call, text or chat 988, 24 hours a day

*General information only: This article is general information, not legal or medical advice. HIPAA, FDA, state medical board and state AI rules change over time and vary by state, so confirm current requirements with counsel before launching a patient messaging program. On Cuvo, every clinical decision is made by a licensed provider practicing through a physician-owned professional entity and exercising independent medical judgment. The patient inbox is not for emergencies: anyone experiencing a medical emergency should call 911, and anyone in crisis can call, text or chat 988. Regulatory sources were checked on October 1, 2026. Cuvo makes no representation about revenue, and each brand remains responsible for its own marketing and compliance with applicable law.*

Canonical page: https://cuvo.co/blog/patient-inbox-clinical-escalation