WhatsApp with patients: convenient but risky

The 9:30 p.m. message

Your phone buzzes. It’s a WhatsApp message: “Doctor, the area you treated today really hurts. Is that normal? Should I take something?”. It’s 9:30 p.m. and you’re having dinner with your family. The message is on your personal WhatsApp, between the school parents’ group and your friends, and it contains a patient’s health data.

It happens every day in physical therapy, dental and psychology practices. WhatsApp is convenient and everyone has it. What’s rare is stopping to think about what using WhatsApp with patients means legally.

The point isn’t to demonize a useful tool, but to look at its problems, the alternatives and a protocol for when there’s no other option.

Why WhatsApp is a problem in healthcare

1. You lose control of the data

Once you send a message on WhatsApp, it’s no longer up to you:

• It stays on the patient’s phone, and you don’t know whether that phone is locked.
• The patient can forward it, screenshot it or lose their phone.
• Meta has access to the metadata: who you talk to and when.
• Backups go to Google Drive or iCloud, and they’re only end-to-end encrypted if that option is turned on.

From a GDPR standpoint, health data is a special category and you are the data controller. With WhatsApp, much of the security the law requires of you is out of your reach. Review the minimum a clinic must do to comply with the GDPR.

2. The line between personal and professional blurs

Same number, same WhatsApp. The patient sees your profile photo, your status and when you were last online. You see theirs. Professional distance fades.

The risks:

• Patients who take advantage of the closeness, with messages at odd hours or about things that have nothing to do with their care.
• The feeling of always being on call.
• Personal and work chats mixed together, with the risk of writing in the wrong one.

3. Nothing ends up in the medical record

Whatever is discussed on WhatsApp stays outside the medical record. If there’s a complaint, how do you retrieve those messages? Are they complete? Can you prove no one has altered them?

4. Encryption doesn’t cover everything

WhatsApp encrypts messages end to end. That’s a good foundation, but:

• It doesn’t help if the phone is lost or stolen while unlocked.
• It doesn’t stop the patient from sharing the conversation.
• It doesn’t hide the metadata from Meta.
• It doesn’t cover WhatsApp Web left open on the front desk computer.

5. International data transfers

In Europe the service is provided by WhatsApp Ireland, but it’s part of Meta, a US company, and some of the processing may take place outside the EU. There are legal mechanisms that cover this, such as the EU-US Data Privacy Framework, but for health data it’s not ideal. It’s worth knowing where your patients’ data is actually stored.

6. Truly deleting is almost impossible

The GDPR recognizes the right to erasure. In healthcare it’s limited by the retention period for medical records, but a WhatsApp chat isn’t part of the record. If a patient asks you to delete those messages, you can do it on your phone, but not on theirs or in the backups.

WhatsApp Business: is it better?

Advantages:

• A business profile with hours, address and website.
• Automatic greeting and away messages.
• Labels to organize conversations.
• It can run on a number separate from your personal one.

Limitations that remain:

• The same security issues on the patient’s side.
• No integration with the medical record.
• Messages are still stored on devices.
• Meta still sees the metadata.

There’s also the WhatsApp Business Platform (the API), which you sign up for through a provider and which allows multiple users, integration with your software and a data processing agreement. It has usage-based costs and, for the patient, it’s still WhatsApp.

Verdict: better than personal WhatsApp, but it doesn’t solve the core problem.

Safer alternatives

Option 1: a patient portal

A web platform or app for communication between patient and practitioner:

• Login with username and password.
• Messaging in an environment you control.
• Communications linked to the patient’s file.
• A space to share documents.

Many practice management systems include one. The downside: the patient has to log in to another platform.

Option 2: encrypted email

• You keep control of the account.
• Communications are logged in your work email.
• Messages are encrypted in transit and at rest.

Proton Mail, Tuta (formerly Tutanota) or the encryption included in some business plans of Microsoft 365 and Google Workspace all work. It’s less immediate than WhatsApp.

Option 3: messaging built into your practice management software

• Automatic text messages or emails for reminders, not for conversations.
• The system’s internal messaging.
• Automatic notifications about appointments and documents.

Everything stays linked to the record. Reminders are the first thing worth moving off WhatsApp: you can automate appointment reminders instead of writing them one by one.

Option 4: a separate business number

If you’re going to use WhatsApp, at least keep it separate:

• A line used only for work.
• WhatsApp Business on that line.
• A dedicated phone, or one with dual SIM or eSIM.
• No personal use on that line.

If you use WhatsApp: a responsible use protocol

When there’s no practical alternative, these are the minimums.

1. WhatsApp Business, never your personal account

A separate business profile. And never create groups with patients: everyone can see everyone else’s number.

2. Limited, deliberate use

What it’s for:

• Appointment reminders and confirmations.
• Logistics: address, delays, schedule changes.
• A general follow-up along the lines of “how are you feeling after the session?”.

What it’s not for:

• Diagnoses or interpreting results.
• Detailed health data.
• Medication instructions.
• New or urgent symptoms, which should be redirected to an appointment or the emergency room.

3. Set hours

Set up an automatic away message:

“Thank you for your message. We’ll reply during office hours, from [time] to [time]. If this is an emergency, call 112.”

And stick to it. If you reply once at 11 p.m., the patient will assume they can message you at that time.

4. Anything clinical goes into the record

• Note anything relevant: “Patient contacted via WhatsApp on [date] about [topic]. Advised [response]”.
• If you need a screenshot, save it to the patient’s file and delete it from the phone.

5. Inform the patient and keep a record

At the first visit, inform the patient in writing and record that they accept the channel:

“The patient agrees to the use of WhatsApp for administrative communications and general follow-up. The patient has been informed that it is not an appropriate channel for sensitive medical data and that, for clinical questions, they should use [alternative channel] or come in for an appointment.”

This acceptance isn’t the legal basis for processing their health data, which already exists because you’re providing care, but it shows that you informed them and sets the rules.

6. Regular deletion

A monthly routine: anything relevant goes into the record and old chats are deleted from the phone.

7. Device security

• PIN or biometrics, with a short auto-lock.
• 2-step verification turned on in WhatsApp.
• A work phone you don’t lend to anyone.
• End-to-end encrypted backup, if you back up at all.
• Remote wipe enabled in case of theft or loss.

If other people have access, go over the basics of passwords and 2FA with them.

Specific cases: what to do

Case 1: “Can you send me my results on WhatsApp?”

Not recommended: sending reports or results with sensitive data. Alternatives:

• “We’ll go over them at your next visit. If it’s urgent, give us a call”.
• The patient portal, if you have one.
• Encrypted email.
• A short phone or video call.

Case 2: “It really hurts, is that normal after the treatment?”

A short reply that doesn’t diagnose and redirects:

“Some discomfort can be normal. If the pain is severe or you notice [warning sign], go to the emergency room. Otherwise, come in for a check-up tomorrow at [time].”

Case 3: the patient who abuses the channel

“Just a reminder that this channel is for brief communications. For medical questions, please book an appointment. If it’s an emergency, call [number].”

If it continues, offer another channel and stop answering clinical questions on WhatsApp with that patient.

Train your team

If you have front desk staff or assistants, the protocol belongs to everyone:

• What the risks of WhatsApp are and why there are rules.
• What can and can’t be said on this channel.
• Which hours are respected.
• How relevant conversations are documented.

Conclusion: mindful pragmatism

WhatsApp isn’t going away. Banning it outright probably won’t work and can hurt the therapeutic relationship, but using it blindly is professionally reckless.

The practical recommendation: WhatsApp for admin, a secure channel for anything clinical, a separate number if possible, relevant information in the record and the patient informed. Someone who trusts you with their health data deserves to have that trust respected, even when the tool isn’t perfect.

If you want to sort out how your practice communicates with patients (which channel to use for what, automatic reminders, secure forms on your website), tell us about your case and we’ll look at it with you.