Health information in a text: what is safe to say

NHS England's guidance on texting patients, last edited on 11 May 2026, sums up the rule with one example. When a test result is back, "it is better to indicate that results are ready and advise the recipient to call you directly or access them via a patient portal, than to refer directly to an individual's health condition in the message." The reason it gives is the lock screen: a text can be read by whoever is holding the phone, so the safest health text is one that would tell a stranger nothing. That holds for a private physio or a pharmacy as much as for a GP surgery.

When does a text count as health information?

UK GDPR defines "data concerning health" in article 4(15) as personal data about a person's physical or mental health, "including the provision of health care services, which reveal information about his or her health status". Article 9 makes it one of the special categories, and processing it "shall be prohibited" unless one of the listed conditions applies. For a clinic the usual one is article 9(2)(h), processing necessary for "medical diagnosis, the provision of health or social care or treatment", and article 9(3) only lets that condition apply where the data is handled by, or under the responsibility of, someone bound by professional secrecy.

The ICO's guidance on special category data (its latest update is dated 9 April 2024) draws the line in a way that maps neatly onto texts. Appointment details, reminders and invoices count as health data when they "tell you something about the health of the individual". A GP or hospital appointment on its own doesn't, "as it may be a check-up or screening appointment". But "you could reasonably infer health data from an individual's list of appointments at an osteopath clinic or from an invoice for a series of physiotherapy sessions". The category is broad, too. Details of someone's mental health are likely to be far more sensitive than a broken leg, the guidance says, "but both are data concerning health".

So the words in a text are only half of it. "Your appointment is on Tuesday at 10:30" from a GP surgery says very little. The same sentence from a clinic whose name says what it treats says a good deal more, and a run of them over six weeks says more again.

What NHS England's guidance says about texting patients

NHS England publishes information governance guidance on texting, emailing and messaging patients in three versions, for patients, for health and care staff and for IG teams. It's practical, and most of it reads across to private practice. The points that matter for anyone writing a template:

• Consent isn't the question for care messages. "You do not need the consent of patients and service users to send them texts, emails or other messages about their individual care." For NHS bodies the lawful bases it names are public task, article 6(1)(e), and article 9(2)(h). A private clinic needs its own article 6 basis, which may well not be public task, but the article 9 condition is the same.
• Send it to the patient. Care messages should generally go only "to people who the services directly relate to", so a reminder goes to the person the appointment is for. The exceptions are narrow: a parent acting as proxy, a best interests decision where the patient lacks capacity, or the patient's explicit consent, each noted on the record.
• Keep the content to what's needed. "Each time you send a message to a patient or service user, there is a risk that the information will be compromised or seen by someone other than the intended recipient," and that matters most "where the content might appear on devices' locked screens". Confidential information is acceptable behind a login, in encrypted email or the NHS App. In an ordinary text it goes in only "where it is necessary to do so", and then at "the minimum amount necessary".
• Record what you sent. Every message belongs in the patient's health or care record, as a copy or a summary, partly so it can be found if the patient makes a subject access request.
• Write like an organisation. Messages should use "professional, neutral language and good grammar", which helps patients tell them apart from scams.

The staff guidance gives an example. A proxy has the patient's explicit consent to receive their messages, and the clinic sends "Your appointment is confirmed for today at 10:30". There's nothing sensitive in it. But the appointment is a hepatitis B vaccine after a sexual assault, or a liver function test that may point to heavy drinking, and the text "may prompt the proxy to ask the individual unwelcome questions about the nature of their appointment". The words are harmless; the fact that the message exists isn't. NHS England's advice is to check with the patient first, and to ask the Caldicott Guardian when unsure.

It goes further where someone could come to harm. If texts "might reveal details of medical treatment to an abuser", the guidance suggests talking to the patient about removing their mobile number from the record altogether.

The Caldicott principles in 160 characters

The Caldicott principles are the eight rules for confidential information in health and social care in England, in the version the National Data Guardian published on 8 December 2020. Three of them could have been written for a reminder template.

Principle 2 says confidential information "should not be included unless it is necessary for the specified purpose". A reminder exists to get the patient there at the right time, and the name of the procedure doesn't help with that.

Principle 3 goes item by item: "each item of information must be justified so that only the minimum amount of confidential information is included". In a text, that means asking of each phrase whether the patient needs it to act. The date, the time, the place and how to rearrange all pass. The clinician's specialty, the test and the reason for a follow-up usually don't.

Principle 8 asks for "no surprises for patients and service users". If you text, say so at registration and in your privacy information, and give people a way to object. NHS England's IG guidance makes the same point and adds that privacy information should tell people about their right to object. The law lines up with all three: UK GDPR article 5(1)(c) requires personal data to be "adequate, relevant and limited to what is necessary".

What a safe health text looks like

Most of the work comes down to a few choices that repeat across every template:

The last row is the one people forget. The sender ID is the first thing on the lock screen, above the message, and for a sexual health service or a fertility clinic it can give away the very thing the careful wording hid. The ICO has dealt with the same problem by email. It reprimanded NHS Highland on 9 March 2023 after the board emailed 37 people likely to be using HIV services with their addresses in the CC field, and one recipient recognised four others, one of them a previous sexual partner. Nothing in the email needed to say HIV for the list itself to say it. A sender name works the same way, so pick one that names the organisation and leave the service out of it.

Wrong numbers, old numbers and shared phones

The ICO's own breach data shows how often health information reaches the wrong person. Its incident-level download, which runs to the end of 2025, has 2,471 personal data breach reports from the health sector that year, more than any other sector, out of 13,456 in all. (The ICO's functions passed to the Information Commission on 30 September 2026, after the period this data covers.)

Within health, the largest named types were unauthorised access, with 415 reports, and data emailed to the wrong recipient, with 405, followed by post or fax to the wrong person at 209. The ICO has no separate category for texts, so the chart can't tell you how many involved one. What it does show is how routine it is for health information to go to the wrong person.

For a text, the wrong person is usually someone who has inherited the patient's old number, a relative who shares the phone, or a stranger whose number was keyed in by mistake. NHS England's IG guidance lists the ways to cut that risk: check contact details "whenever they use your services", make sure they're accurate before sending, and train staff on "the consequences of inattention when entering contact details". A minimal text limits the damage when one of those fails. "Your results are back, please call" sent to the wrong phone tells a stranger very little. Name the result and it tells them something about the patient's health.

Private clinics, pharmacies and the marketing line

NHS England's guidance is written for NHS and care organisations, but nothing in its reasoning depends on who pays for the appointment. A private dental practice, physio clinic or aesthetics clinic handles the same category of data under the same article 9, and the regulated professions add their own duty on top. The HCPC's standards of conduct, performance and ethics, which cover physiotherapists and podiatrists among others and have been in force in their current form since 1 September 2024, open their confidentiality section with "You must treat information about service users as confidential", and allow disclosure only with permission, where the law allows, in the person's best interests or in the public interest.

Then there's marketing. A reminder about someone's care is a service message. A text about teeth whitening or a skincare offer is marketing, which PECR treats separately and which needs consent or the soft opt-in. NHS England's guidance stops at messages about individual care and points elsewhere for anything else. Our post on service and marketing texts works through the borderline cases, and dental recalls by text applies them to one kind of practice.

Putting it into practice

Five habits cover most of it:

1. Write templates with the procedure left out, and have someone other than the author read each one as if they'd found it on a stranger's phone.
2. Choose a sender name that says who you are without saying what you treat, where what you treat is sensitive.
3. Confirm the mobile number at every visit, and note on the record anyone else who may receive messages, and why.
4. Put the detail behind a call or a login: "your results are back, please call" or "please log in to see them".
5. Keep a copy of what went out against the patient's record, and act on objections, including the rare case where the safest number is no number at all.

CaptiFi Connect's two-way inbox lets "please call us" become "reply to this text" for routine questions, sender names are reviewed by staff before they're used, and each text gets a delivery report, with CSV exports to help keep a copy for the record. None of that decides what goes in the message, which is still the clinic's call.

A useful last check before a template goes live: read it as the person who shares the patient's phone would. If the text would tell them anything beyond a time, a place and who to ring, cut it back until it doesn't.