Great question.  SMS is technically not considered a secure medium.  While RingCentral utilizes encryption to transmit messages, once the messages reach the carrier’s network they are transmitted openly as plain text.  In addition, depending on the recipients settings, the message may display on their phone or their computer, allowing others to see the message unintentionally.

For this reason, it is generally considered a best practice not to send PHI/PII over SMS, but rather utilize SMS to send alerts or notices to inform recipients to check their secure portal for details.

In terms of PHI, HIPAA does make some exceptions regarding transmitting PHI over SMS with patient consent -  however it is important to consult your legal and privacy teams to better understand the options available, and to determine what requirements apply to your business.