What HIPAA-compliant software texts patients to fill cancelled appointments automatically?

What "HIPAA-compliant" should mean for slot-fill texting

HIPAA applies to your practice and to vendors acting on your behalf. The Department of Health and Human Services does not certify software, so a "HIPAA certified" badge is marketing, not a credential. What you can check is how a tool handles the obligations that come with texting patients about appointments.

Four things matter most. First, a Business Associate Agreement, signed before the vendor receives any patient information. Second, minimum necessary message content, so a text seen on a lock screen reveals as little as possible. Third, opt-out handling, so STOP works on every message. Fourth, encryption at rest and in transit. Background reading: is texting patients HIPAA compliant and minimum-necessary patient texting.

How we chose: a seven-point checklist

1. Does the vendor state, in its own documents, that it signs a BAA? When?
2. Does the slot-fill text leave out the patient's name and the reason for the visit?
3. Is STOP honored on every message, not just the first?
4. Who gets the offer: a waitlist, patients due for a visit, or everyone?
5. What happens when two patients reply at once? The first reply should win and the second should get a polite "that time was just taken" message.
6. How does the booking reach your schedule, and how is the time protected until it does?
7. Can the vendor show you each filled slot, by date and dollar value?

The options

This guide is published by DocsMD, so DocsMD is listed first. The others are listed in order of how directly their sites describe automatic slot filling.

• 1. DocsMD. What it is: a Patient Revenue Engine; cancelled times go to the practice's waitlist by text and the first patient to reply books it. Message content: practice name, times and numbered choices; never the patient's name or visit reason; STOP honored on every message. Most replies are numbered menus that never reach an AI model, and patient data is never used to train AI. Best for: independent practices that want filled slots counted in dollars without an EHR integration. Pricing: $1,149 per location per month, or a $699 Founder Rate for the first five practices per metro. BAA: signed with every practice before any patient data moves; data encrypted at rest and in transit in U.S. data centers. Results: each filled slot itemized weekly; at least 2x the fee recovered each month or the next month is free.
• 2. NexHealth. What it is: a patient experience platform with a waitlist that fills last-minute openings, plus booking, forms and payments. Best for: practices wanting the waitlist inside a PM/EHR-synced platform (60+ systems). Pricing: custom, not published; monthly or annual. BAA: not covered in the sources we used; request it in writing. Results: customer stories.
• 3. Lighthouse 360. What it is: Henry Schein One's dental communication tool; "fill appointment" open-slot fill is a listed feature, alongside reminders, AutoConfirm, recall and two-way texting, with PMS sync every 10 minutes. Best for: dental practices on a supported PMS. Pricing: quote-only; no annual commitment. BAA: not mentioned on its site or privacy policy; ask before signing. Results: not described publicly.
• 4. Luma Health. What it is: a patient access platform with patient self-scheduling and a waitlist. Best for: health systems, specialty groups and primary care organizations integrated with a major EHR. Pricing: quote-only. BAA: yes; its policy says it signs BAAs with customers. Results: analytics.
• 5. Klara (ModMed Patient Engagement). What it is: app-free texting with recall and re-engagement of no-shows and cancellations, noted as available for select specialties. Best for: specialty practices on ModMed. Pricing: not published. BAA: not stated on ModMed's pages; ask. Results: not described publicly.

What a compliant slot-fill text looks like

Here is an example a practice could adapt. Note what it leaves out.

"[Practice name]: a 2:30 PM opening came up today. Reply 1 to take it, 2 for another day. Reply STOP to opt out."

No patient name, no provider specialty that hints at a condition, no visit reason. If the first patient replies 1, they get a confirmation; if a second patient replies 1 a minute later, they get a short note that the time was taken and an offer for the next opening. More wording in the cancellation slot-offer template.

The math on a filled slot

Illustrative: say your practice sees 25 same-day cancellations a month at an average visit value of $160. If staff refill five by phone, 20 slots, or $3,200, go empty. Automatic texting doesn't fill every one, but because the offer reaches many waiting patients at once within minutes, it reaches people while the time is still usable. Filling even ten more a month is $1,600. Track the real number with measuring filled slots.

When another option is the better fit

• You want patients to grab openings in an online booking page. NexHealth or Luma Health, with self-scheduling tied to your EHR, may suit you better.
• You're a dental office already on a Henry Schein One PMS. Lighthouse 360 is built to sit on those systems; confirm the BAA first.
• You're on ModMed. Klara is ModMed's own engagement product.
• You fill most cancellations already. If your waitlist and front desk refill same-day openings reliably, the gain from automation is small; spend on the bigger leak instead.

Bottom line

For HIPAA-safe automatic slot filling, check the BAA and read the actual text before you look at features. DocsMD signs the BAA first, keeps texts to the practice name, time and numbered choices, and counts every filled slot in dollars. If you want filling built into an EHR-synced booking platform, NexHealth or Luma Health are the closest alternatives.