EZ Texting Review: Marketing Says Encrypted, Contract Says Not

1. HIPAA, and the sentence in the contract

If you are a covered entity — a clinician, a practice, a clinic — HIPAA governs what you may do with protected health information, and it governs the vendors you hand it to. The mechanism is the Business Associate Agreement: before a supplier creates, receives, maintains or transmits PHI on your behalf, you need a signed BAA setting out their obligations. No BAA, no lawful disclosure. It is not a formality that can be inferred from a vendor's general security posture.

We looked for one. Across the homepage, the pricing page, the healthcare industry page, the text-marketing compliance page and a Terms of Service document running past 72,000 characters, the terms BAA and business associate returned zero matches each. HIPAA appears seven times, all on the healthcare page, and not once in the Terms. It is possible a BAA is available on request through sales; we can only report that the company does not mention one in any material we could read.

Then there is the encryption question, where the marketing and the contract point in opposite directions. The healthcare page tells you to use a platform like EZ Texting offering end-to-end encryption. The Terms tell you that messages are transmitted unencrypted and that eavesdropping by third parties is possible, and recommend that you send sensitive information by some other protected method. Those cannot both be true. The Terms are the document you agree to, and their version is also the technically accurate one — ordinary SMS traverses carrier infrastructure without end-to-end encryption regardless of what any platform does at its own edge.

2. TCPA, where the real financial risk lives

Most people worrying about texting patients worry about HIPAA. The larger practical exposure for a small practice is the Telephone Consumer Protection Act, because its damages are statutory, per message, and do not require anyone to prove harm. EZ Texting's own compliance page states the range correctly: $500 to $1,500 for every message sent to someone who has not properly opted in.

Run that arithmetic against a patient list. Two thousand contacts imported from a practice management system, one promotional campaign about a new weight-management programme, and no documented prior express written consent for marketing messages — the theoretical exposure runs into seven figures. This is among the most litigated areas of US consumer law precisely because the maths is so unforgiving, and clinics are not exempt from it.

This is where EZ Texting earns most of its score. Double opt-in, automated opt-out handling, SafeSTOP removing contacts when they text stop, and A2P 10DLC brand and campaign registration are the infrastructure that keeps a sender on the right side of both the statute and the carriers. Building that yourself is expensive and getting it wrong is worse. If you are going to send bulk SMS at all, doing it through a platform with real consent plumbing is the correct decision.

3. Pricing, and what is not in the headline number

Plans begin around $25 a month. Per-message rates tier by plan and volume: $0.04 on the entry tier, then $0.035, then $0.03, reaching $0.01 on an enterprise plan quoted at $500 or more per month. The lower rates require a volume commitment, with messages above the commitment charged at $0.04.

Two costs sit outside the plan price and are easy to miss. Telecom fees are charged on the entry tier and waived on higher ones, and carrier pass-through fees are billed separately based on actual usage. Setup is same-day on standard plans but quoted at four to twelve weeks for enterprise, which matters if you were planning around a launch date. Model your real monthly send volume before comparing headline prices, because the per-message line will dominate the subscription line quickly.

Why is this on a GLP-1 site?

It arrived in our affiliate queue and there is no consumer health angle to it — EZ Texting is business software. We have reviewed it for the slice of readers who are on the other side of the consultation: clinicians, dietitians, coaches and clinic managers who are considering texting patients about appointments and adherence. If that is not you, this page will not be useful and we would rather say so than pretend.

What is the contradiction you found?

EZ Texting's healthcare page advises readers to choose a HIPAA-compliant SMS platform and to use one like EZ Texting offering end-to-end encryption and secure data storage. Its Terms of Service state that you acknowledge that text messages and voice broadcasts are transmitted unencrypted and that eavesdropping of communications by third parties is possible. Both statements were live when we checked. The Terms are the binding document.

Can I use it for patient communication under HIPAA?

Not for protected health information, on the evidence available. Under HIPAA a covered entity must have a Business Associate Agreement with any vendor that creates, receives, maintains or transmits PHI on its behalf. We searched five EZ Texting pages including a 72,000-character Terms of Service for BAA and business associate. Both returned zero on every page. Without a signed BAA, routing PHI through the platform is not something a covered entity can do compliantly.

So can healthcare providers use SMS at all?

Yes, within limits, and EZ Texting's own healthcare page states them correctly. Its direct answer to whether SMS is HIPAA compliant is a plain no, and it advises that medical professionals should refrain from texting medical information that is personal, sensitive and specific from a platform that is not HIPAA compliant, avoid sensitive patient identifiers, and not share detailed medical information by SMS. Appointment reminders without clinical detail are the standard low-risk use. That guidance is sound — it just sits on the same page as the encryption claim.

What about TCPA?

This is where the platform is genuinely strong, and the exposure is real: their own compliance page correctly states that the TCPA carries penalties of $500 to $1,500 for every message sent to someone who has not properly opted in. Per message, and a patient list can be thousands of people. EZ Texting provides double opt-in, automated opt-out, a SafeSTOP feature that removes contacts automatically, and A2P 10DLC registration support. For a small practice, that tooling is worth more than the software itself.

What does it cost?

Plans start around $25 a month, with per-message rates tiering from $0.04 down through $0.035 and $0.03 to $0.01 on the enterprise tier, which is quoted at $500+ per month. Telecom fees are waived on higher tiers and charged on the entry plan, carrier pass-through fees are billed separately based on usage, and lower per-message rates require a volume commitment with overages at $0.04. Setup is same-day on standard plans and four to twelve weeks on enterprise.

Anything else that undermines confidence?

A small thing that says something. The live pricing page carries the line Promotional Pricing Until December 5, 2022. We read it in August 2026 — a promotional deadline nearly four years past, still published on the page where customers choose a plan. It is not harmful in itself, but a compliance-sensitive product with a four-year-stale pricing page invites questions about what else is not being reviewed.

What should a clinic actually do?

Decide first whether your messages will contain PHI. If they will not — appointment reminders with no clinical detail, no diagnosis, no medication named — a mainstream SMS platform with strong consent tooling is a reasonable choice, and this is one. If they might, you need a vendor that will sign a BAA and will say so in writing, and you should ask EZ Texting directly whether they will before you commit. Get the answer in writing, and do not rely on a marketing page's description of encryption when the contract says the opposite.