send HIPAA-compliant SMS and voice communications via Twilio with a signed BAA

Steps

1. Ensure your Twilio account is on an eligible plan (HIPAA-eligible products include Programmable SMS, Programmable Voice, and Verify); contact Twilio to execute a Business Associate Agreement (BAA) before transmitting any PHI.
2. Restrict PHI in message content to the minimum necessary; where possible, use tokenized links or appointment references rather than including full names, diagnoses, or dates of birth in message bodies.
3. Enable Twilio's Advanced Opt-Out and Message Delivery Logging features only where permitted by your BAA scope; disable message logging in the Twilio console if logs would store PHI beyond retention limits.
4. Use HTTPS for all webhook callbacks from Twilio to your server and validate the X-Twilio-Signature header on every inbound request to prevent spoofed callbacks.
5. Store Twilio Auth Tokens and API Keys in a secrets manager, not in source code; use API Keys rather than the master Auth Token for application-level access.
6. Implement patient consent tracking for SMS communications: record explicit opt-in consent, honor STOP opt-out replies immediately, and maintain consent audit logs.