Consent for appointment reminder texts
"Do we need permission to text patients?" is one of the most common front desk questions, and the honest answer is that three different sets of rules each have a say. HIPAA, the TCPA and the wireless carriers all look at consent differently. This guide untangles them and gives you wording you can adapt. It is general information, not legal advice.
- HIPAA does not require a patient's authorization to send appointment reminders, which are part of treatment, but patients can ask to be contacted a different way.
- Under the TCPA, the FCC treats a patient giving a phone number to a provider as consent for healthcare messages within that scope.
- Carriers expect business texting programs to show how recipients opted in, so documented consent protects deliverability as well as legal position.
- Consent covers a purpose. Reminders are one purpose; promotions are another and need their own, written consent.
Three kinds of consent, three different questions
It helps to separate the questions each set of rules asks:
- HIPAA asks: may the practice use the patient's information to send this message, and through this channel?
- The TCPA asks: may the practice send an automated text to this cell phone number at all?
- Carriers ask: did this person agree to receive texts from this sender, and can they easily stop them?
The HIPAA side
Appointment reminders are generally considered part of treatment, which the Privacy Rule defines in 45 CFR 164.501 as the provision, coordination or management of health care. Uses of PHI for treatment do not require a patient's written authorization. The HIPAA definition of marketing also excludes communications made for a patient's treatment, so a reminder is not marketing under HIPAA.
What HIPAA does give patients is a say in how they are contacted. Under 45 CFR 164.522(b), a provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations, and may not require the patient to explain why. A patient who says please call my work phone, not my cell, or please do not text, should be honored.
HHS has also said, in its guidance on email, that providers may communicate electronically with patients as long as they apply reasonable safeguards. For texts, that means confirming the number and keeping the content minimal.
The TCPA side
The TCPA requires prior express consent for automated texts to cell phones. In its 2015 omnibus ruling, the FCC said that a patient's provision of a phone number to a healthcare provider is prior express consent for healthcare calls subject to HIPAA, by the covered entity and its business associates, within the scope of the consent given and absent instructions to the contrary.
That is helpful, but it has limits. The consent belongs to the person who gave the number, so a number supplied by someone else may not carry it. And since the Supreme Court's 2025 decision in McLaughlin Chiropractic Associates v. McKesson, courts are not bound by FCC interpretations. Collecting clear, documented consent at intake removes doubt.
The carrier side
Wireless carriers apply their own rules to business texting, based largely on the CTIA Messaging Principles and Best Practices. Business text programs are registered with the carriers, and registration asks how recipients opted in. Messages sent without a clear opt-in path are more likely to be filtered or blocked.
Carriers also expect standard keywords to work: STOP and similar words to opt out, and HELP to get information about the program. A clean consent record is what keeps your reminders arriving.
Sample intake wording
Add a short, plain section to your registration form, online intake or check-in tablet. Adapt this sample with your counsel:
Text messages about your care. "By providing my mobile number, I agree that [Practice Name] and companies working on its behalf may send me automated text messages about my appointments, including reminders, confirmations, schedule changes and offers of earlier times. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time or HELP for help. Consent is not a condition of receiving care."
Mobile number: a field for the number, and a checkbox the patient ticks themselves.
Preferred contact method: text, call or email, so you capture any request under 45 CFR 164.522(b) on day one.
If you ever want to send promotional messages, such as offers for elective services, use a separate checkbox with its own wording. The FCC's rules require prior express written consent for automated telemarketing, and mixing it into the reminder consent invites dispute.
Documenting consent
Consent is only as good as your ability to show it later. For each patient, you want to be able to answer: which number, collected when, through which form or channel, for what purpose, and has it changed since?
- Store the signed or electronically accepted intake form with a date.
- If consent is collected by phone, have staff note the date, the number and the words used in the patient record.
- Keep opt-outs and opt-ins in the same place, with dates, so the latest status is always clear.
- Re-confirm the mobile number at each check-in. A quick "Is this still your cell?" catches most reassigned and mistyped numbers.
A front desk script
Staff do not need to recite law. A consistent, friendly script covers the essentials:
At check-in: "We text appointment reminders and openings to your cell. Is this still the best number? You can reply STOP anytime."
If the patient hesitates: "No problem. Would you rather we call, or email you instead?" Then record the preference.
If someone gives a family member's number: "Is this number yours? We need the phone of the patient, or the parent or guardian who manages appointments." Note who the number belongs to.
If a patient who opted out wants texts again: have them reply START from their phone, or note their new consent with the date in the record.
Consent is respected on every DocsMD message
Every DocsMD text carries an opt-out, and STOP is honored on every message. Texts stay minimum necessary: the practice name, times and numbered choices, never the patient's name or reason for the visit. DocsMD signs a Business Associate Agreement before any patient data moves. Read more on our HIPAA and BAA page.
Questions
Does HIPAA require written consent for appointment reminder texts?
No. Appointment reminders are generally part of treatment, which does not require a HIPAA authorization. Patients can still ask to be contacted another way, and you must honor reasonable requests.
Is a phone number on the registration form enough consent under the TCPA?
The FCC has said that a patient's provision of a number to a healthcare provider is consent for healthcare messages within that scope. Clear wording on the form that the number will be used for texts makes that consent easier to prove.
Can I use the same consent for recall and reactivation messages?
Care-related messages inviting a patient back for a due visit are closer to reminders than marketing, but anything that promotes a product or a discount is a different purpose. Use separate written consent for promotions.
Do minors need their own consent?
Contact the parent or guardian who manages the minor's care, using the number they provided, unless state law or the minor's consent to their own care requires otherwise. Check your state's rules with counsel. This article is general information, not legal advice.