HIPAA-Compliant Phone Service for Therapists: 2026 Options & Costs

Most therapists start out using their personal cell for client calls and texts — and most don't realize what that means for HIPAA. Here's the problem, the fix, and an honest look at the options.

Video gets all the telehealth attention, but the phone is still where private practice happens: intake calls, reschedules, voicemails, the "running 10 minutes late" text. If those calls and messages touch client information — and they do — HIPAA applies to them just as much as it applies to your video sessions. This guide covers what makes a phone setup compliant, what the popular services cost in 2026, and the texting rules every therapist should know.

This is general educational information, not legal advice. Your obligations depend on your practice and state; confirm specifics with a healthcare attorney or your liability carrier.

Why your personal cell is a problem

Standard SMS is not secure. Ordinary text messages travel and sit unencrypted, and HIPAA's security expectations aren't met by the texting app that came with your phone.
Your carrier won't sign a BAA. The same one-question test from our video tools guide applies here: no Business Associate Agreement, no compliance.
Client data mingles with your life. Client names in your personal contacts, session voicemails next to family messages, iCloud backing it all up — none of it access-controlled or auditable.
No boundaries. Beyond compliance, giving clients your personal number means clients can reach you anywhere, forever. A separate practice line is as much a wellbeing decision as a legal one.

What makes a phone service HIPAA-compliant

Three things, in order: the vendor signs a BAA; calls, texts, and voicemails are encrypted and access-controlled in their system; and you're on the specific plan the BAA covers (several providers only sign on their business or professional tiers, not their cheapest one). Everything else — second-line apps, voicemail transcription, auto-replies — is convenience on top of that foundation.

The options, honestly compared (2026)

iPlum

A second-line app popular with solo practitioners: separate practice number on your existing phone, secure texting, voicemail transcription, and a BAA on its professional plans. Typically runs roughly $9–26/user/month depending on tier — one of the cheapest true-BAA options.

Spruce Health

Built specifically for healthcare communication — phone, secure texting, even video — with a BAA standard. Around $24–49/user/month. The most healthcare-native option on this list; overkill for some solo practices, exactly right for others.

Google Voice (via Google Workspace)

Compliant only in one specific configuration: a paid Google Workspace subscription plus a Google Voice license, with Google's BAA accepted in the Admin console — the same BAA that covers Google Meet. Personal free Google Voice is not compliant. Expect roughly $10–30/user/month for Voice on top of the Workspace plan.

Dialpad / RingCentral / RingRX

Full business VoIP systems that will sign BAAs (RingCentral upon request; RingRX is healthcare-focused). Typically $15–35/user/month. More phone system than a solo practice needs, but a fit if you're growing into a group.

Whatever you pick, verify two things before porting your number: that the BAA covers the exact plan you're buying, and that secure texting is included in that plan rather than an upsell.

The texting rules that trip therapists up

Even with a compliant service, what you text matters. Appointment reminders are allowed with sensible safeguards — but keep them to the minimum: a time, a link, nothing clinical. "Reminder: you have an appointment Tuesday at 3pm" is fine. "Reminder: therapy session for your anxiety Tuesday" is not. Never discuss clinical content over standard SMS, and honor a client's preference if they ask not to be texted at all. Document their consent to receive texts at intake, alongside telehealth consent.

The part a phone service can't solve

A compliant line fixes the transport — it doesn't decide what goes into each message, or connect calls and texts to the client's record. That's why Theraflow's appointment reminders are deliberately PHI-minimized out of the box (a time and a link, never a diagnosis), and clinical conversation stays in the client portal rather than SMS. Pair a modest phone service for calls with a practice platform that handles reminders and client messaging safely, and you've covered the whole surface for well under the cost of one session a month — Theraflow's side of it is a flat $29.99/month, BAA included.

Bottom line

Your personal cell and standard SMS don't meet HIPAA's bar for client communication. A dedicated service with a BAA — iPlum or Google Voice with Workspace at the budget end, Spruce if you want healthcare-native — closes the gap for $10–50/month. Keep reminders PHI-free, keep clinical content off SMS entirely, and get texting consent at intake.

HIPAA-Compliant Phone Service for Therapists: What Actually Works