DocsMD™Patient Revenue LibraryFree leak audit
DocsMD › Library › HIPAA & Patient Texting
HIPAA & Patient Texting

State texting laws practices should know

The federal TCPA is not the only law that governs texting patients. A growing number of states have their own telemarketing statutes, often called mini-TCPAs, with private lawsuits and per-message damages. Most target sales messages rather than appointment reminders, but the line matters for any practice that sends promotions or recall offers. This is general information, not legal advice, and state laws change often.

Updated October 8, 2026 · 5 min read · DocsMD Research
Key takeaways
  • Florida, Oklahoma, Maryland and Texas all have telemarketing laws that reach text messages, with consent requirements, calling-hour limits or private lawsuits.
  • These laws generally apply to sales and solicitation messages. Pure appointment reminders usually fall outside them; promotional messages may not.
  • Several require prior express written consent for automated sales texts and limit solicitations to 8 AM to 8 PM and three per 24 hours on the same subject.
  • The safest national policy: separate reminders from promotions, get written consent for promotions, text only between 8 AM and 8 PM in the patient's time zone, and honor STOP immediately.

Why state laws matter even if you follow the TCPA

After the Supreme Court narrowed the federal definition of an autodialer in Facebook v. Duguid (2021), several states passed or amended their own laws with broader or different definitions. Many include a private right of action, meaning individual recipients and class action lawyers can sue directly.

These laws mostly regulate telephone solicitation: calls and texts meant to sell something. That is good news for routine reminders. It also means the classification of each message matters. A text that says your visit is Tuesday at 10 is very different from one that says book this month and save 20 percent on whitening.

Florida: the Florida Telephone Solicitation Act

Florida's law, at section 501.059 of the Florida Statutes, applies to telephonic sales calls, which the statute defines to include a telephone call, text message or voicemail made to solicit a sale of consumer goods or services or to obtain information for that purpose. Key points from the current text:

  • Consent. Under 501.059(8)(a), an unsolicited telephonic sales call that involves an automated system for the selection and dialing of telephone numbers, or a recorded message, requires the called party's prior express written consent. The 2023 amendments (HB 761) changed "selection or dialing" to "selection and dialing," narrowing the technology covered.
  • Exclusions. The definition of an unsolicited telephonic sales call excludes calls made in response to an express request of the person called, and calls to a person with whom the solicitor has a prior or existing business relationship.
  • STOP before suing. Under 501.059(10)(c), before suing over text solicitations, the recipient must reply STOP, and the sender then has 15 days to stop.
  • Damages. Recipients may recover actual damages or $500, whichever is greater, and a court may triple damages for willful or knowing violations.
  • Calling hours. A separate section, 501.616(6), bars commercial telephone solicitation calls before 8 AM or after 8 PM in the called person's time zone, and more than three calls from any number to a person in 24 hours on the same subject.

Oklahoma, Maryland and Texas

Oklahoma. The Oklahoma Telephone Solicitation Act, effective November 1, 2022, largely mirrors Florida's model. It requires prior express written consent for commercial sales calls using an automated system for the selection or dialing of numbers or a recorded message, limits calls to between 8 AM and 8 PM, caps calls at three in 24 hours on the same subject and allows private lawsuits for $500 or actual damages, with trebling for willful violations.

Maryland. The Stop the Spam Calls Act, effective January 1, 2024, requires prior express written consent for telephone solicitations, including texts, that use an automated system for the selection or dialing of numbers or a recorded message. It also bars solicitations between 8 PM and 8 AM in the called party's time zone and more than three in 24 hours on the same subject. Violations are treated as unfair, abusive or deceptive trade practices under the Maryland Consumer Protection Act.

Texas. Senate Bill 140, effective September 1, 2025, expanded the state's telephone solicitation law in the Business and Commerce Code to cover text and image messages, and tied violations to the Texas Deceptive Trade Practices Act, opening the door to private lawsuits. Sellers that solicit by phone or text in Texas may need a registration certificate unless an exemption applies; one commonly cited exemption covers solicitations to current or former customers by a business operating under the same name for at least two years.

Reminder or solicitation? Sorting your messages

Because these laws hinge on whether a message is a sale or solicitation, classify every template before it goes out. A practical sorting guide:

  • Usually outside solicitation laws: appointment reminders and confirmations, schedule changes, offers to move an existing appointment to an earlier opening, follow-up on a call the patient made to you.
  • Gray area: invitations to an overdue patient to schedule a routine visit. They relate to an existing relationship and ongoing care, and several of these statutes exclude existing business relationships, but wording matters. Keep them plain and free of pricing.
  • Likely solicitation: discounts, specials, new elective services, product promotions, referral offers and anything with a price or a deadline to buy.

Don't forget state privacy laws

Telemarketing laws are not the only state rules in play. Some states have health privacy laws that go beyond HIPAA in specific areas, and nearly every state has its own data breach notification law. HIPAA sets a federal floor; it does not override state laws that are more protective.

If you operate in more than one state, or see patients who live across a border, ask counsel which state laws apply to your messaging and how they interact with HIPAA.

A single national policy that covers the common rules

Rather than tracking every statute, many practices adopt one policy strict enough for the toughest common rules:

  1. Keep care-related messages and promotions in separate templates and separate consent buckets.
  2. Get prior express written consent, with clear wording and a signature or electronic agreement, before any promotional text.
  3. Send automated texts only between 8 AM and 8 PM in the patient's local time zone, using the address on file rather than the area code, since people keep numbers when they move.
  4. Limit messages on the same subject to no more than three in 24 hours, and stay within the FCC's one-per-day, three-per-week cap for exempt healthcare reminders.
  5. Honor STOP immediately, not in 15 days or 10 business days.
  6. Identify your practice by name in every message.
  7. Review state law changes at least once a year. This area moves quickly.
How DocsMD handles this

DocsMD keeps patient texts about the visit

DocsMD texts are about recovering visits: confirming, rescheduling, offering an opened time or inviting an overdue patient back. Messages carry the practice name, times and numbered choices, never the patient's name or the reason for the visit, and STOP is honored on every message. A Business Associate Agreement is signed before any data moves. See how DocsMD works.

Questions

Do state mini-TCPA laws apply to appointment reminders?

Generally, these laws target telephone solicitations, meaning messages meant to sell goods or services. A plain appointment reminder is usually not a solicitation, but promotional content added to a reminder can change that. Review your templates with counsel.

Which state's law applies, mine or the patient's?

Many of these laws protect residents of the state or people called in the state, so the patient's location can matter even if your practice is elsewhere. That is one reason a single strict national policy is simpler.

Does Florida's 15-day rule mean we have 15 days to process a STOP?

The 15 days is a condition before a recipient can sue over text solicitations, not a target. The FCC's federal rules require opt-outs to be honored within ten business days at most, and the FCC's healthcare exemption expects immediate action.

Are there other states with similar laws?

Yes, and the list grows. Several states regulate telephone solicitation, calling hours or commercial text messages. Check current law in the states where your patients live. This article is general information, not legal advice.

Sources: Florida Statutes, section 501.059 (Florida Telephone Solicitation Act), 2026 version · Florida Statutes, section 501.616(6) (calling hours and frequency) · Florida HB 761 (2023 amendments to the Florida Telephone Solicitation Act) · Oklahoma Telephone Solicitation Act of 2022, 15 O.S. 775C.1 et seq. · Maryland Stop the Spam Calls Act of 2023 (SB 90 / HB 37), Maryland Commercial Law Article, Title 14, Subtitle 45 · Texas Senate Bill 140 (2025), Texas Business and Commerce Code chapters 302 and 304 · U.S. Supreme Court, Facebook, Inc. v. Duguid (2021) · FCC, 47 CFR 64.1200(a)(9)(iv) and (a)(10) · HHS, 45 CFR 160.203 (HIPAA preemption and more stringent state laws)
© 2026 DocsMD™ · Patient Revenue Engine for Healthcare · Practice smarter.docsmd.comLibraryFree leak auditPricingHIPAA BAAPrivacy