FWIW, healthcare compliance is a solved problem (disclaimer: I work for the company that solved it - Datica.com). The larger problem is that young companies do

FWIW, healthcare compliance is a solved problem (disclaimer: I work for the company that solved it - Datica.com). The larger problem is that young companies don't understand what it takes to be compliant, nor the resources to do it themselves. Remember, compliance is all about proving what you say you do. If you can prove it, you're golden. So it's not that SMS or email isn't HIPAA compliant, it's that the work, controls, and monitoring you'd need to put in place to prove compliance is a massive burden. This is where risk management comes into play. If risk isn't a core tenant of your offering, you're better off building the preferred UX (like using email over fax) and assuming no risk.