The TCPA and patient texting
HIPAA decides what a practice may say in a text. A different federal law, the Telephone Consumer Protection Act, decides whether the practice may send the text at all. This guide walks through how the TCPA and the FCC's rules treat appointment reminders and other healthcare messages. It is general information, not legal advice; talk to counsel about your specific program.
- The FCC treats text messages as calls under the TCPA, so automated texts to cell phones generally need the recipient's prior express consent.
- According to the FCC, a patient who gives a phone number to a healthcare provider has consented to healthcare calls and texts within the scope of that consent.
- A separate FCC exemption covers certain exigent healthcare messages, such as appointment reminders, if strict conditions are met: one message a day, three a week, 160 characters, no marketing or billing, and an opt-out in every message.
- Since April 11, 2025, opt-out requests made by any reasonable means must be honored within 10 business days, and a STOP reply is a valid revocation.
What the TCPA covers
The TCPA, at 47 U.S.C. 227(b)(1)(A), prohibits calls to a cell phone made with an automatic telephone dialing system or an artificial or prerecorded voice unless the call is for emergency purposes or made with the called party's prior express consent. The FCC has long held that text messages are calls for this purpose, and in a 2016 decision the Supreme Court described it as undisputed that a text message to a cell phone qualifies as a call.
The stakes are why practices pay attention. The statute lets a person sue for $500 per violation, and a court may triple that for willful or knowing violations (47 U.S.C. 227(b)(3)). Because every text is a separate potential violation, a reminder program that sends thousands of messages a month carries real exposure if consent is mishandled.
In 2021 the Supreme Court narrowed the definition of an autodialer in Facebook v. Duguid, holding that equipment qualifies only if it stores or produces numbers using a random or sequential number generator. Many reminder systems fall outside that definition. Practices should not rely on that alone: several states have their own laws with broader definitions, and the FCC's consent and opt-out rules are the safer baseline.
Consent: what the FCC says about patients
In its 2015 omnibus TCPA ruling, the FCC stated that a patient's provision of a phone number to a healthcare provider constitutes prior express consent for healthcare calls subject to HIPAA by a HIPAA-covered entity and business associates acting on its behalf, within the scope of the consent given and absent instructions to the contrary.
Two phrases in that sentence matter. Within the scope means the consent covers messages related to the patient's care, such as appointment reminders and scheduling. It does not stretch to promotions. Absent instructions to the contrary means a patient who says do not text me has narrowed or ended that consent.
Marketing is treated differently. Under 47 CFR 64.1200(a)(2), autodialed or prerecorded telemarketing messages require prior express written consent. The same rule exempts calls that deliver a health care message made by or on behalf of a HIPAA covered entity, but a message whose purpose is selling something is unlikely to qualify.
The FCC's healthcare exemption and its conditions
The 2015 ruling also created an exemption, now in 47 CFR 64.1200(a)(9)(iv), for free-to-the-patient calls and texts to cell phones that have an exigent healthcare treatment purpose. The FCC listed the qualifying purposes: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications and home healthcare instructions.
The exemption comes with conditions. As the rule describes them:
- Messages go only to the wireless number the patient provided.
- Each message states the name and contact information of the healthcare provider.
- Messages are limited to the listed purposes and include no telemarketing, solicitation or advertising, and no accounting, billing, debt-collection or other financial content.
- Messages comply with HIPAA privacy rules.
- Messages are concise: generally 160 characters or less for a text, one minute or less for a voice call.
- No more than one message per day to each patient, and no more than three combined calls or texts per week.
- Each message offers an easy way to opt out, and opt-out requests are honored immediately.
Opt-outs under the 2024 revocation rules
The FCC's 2024 revocation order, effective April 11, 2025, made the opt-out rules more specific. Under 47 CFR 64.1200(a)(10), a person may revoke consent by any reasonable means. A reply of "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe" is treated as a valid revocation. Callers must honor a revocation within a reasonable time, not to exceed ten business days.
One confirmation text is permitted. Under 64.1200(a)(12), a single message confirming the opt-out, with no marketing in it, does not violate the rules, and one sent within five minutes is presumed to fall within the patient's prior consent.
The FCC also adopted a "revoke-all" rule that would make an opt-out from one type of message apply to all of a caller's robocalls and robotexts on unrelated matters. The FCC delayed that provision, and its effective date has been pushed to January 31, 2027 while the Commission considers changes. Plan for it anyway: the simplest approach is to treat STOP as stopping everything automated.
Why the courts matter more now
In June 2025, in McLaughlin Chiropractic Associates v. McKesson, the Supreme Court held that federal district courts are not bound by the FCC's interpretations of the TCPA in enforcement cases. Courts must interpret the statute themselves, giving the agency's view appropriate respect.
For practices, that cuts both ways. FCC rulings that helped healthcare, such as the 2015 consent statement, may not control every court. The practical answer is to build a program that would hold up under a strict reading: clear consent at intake, care-related messages only, conservative frequency and fast, reliable opt-outs.
A TCPA-ready texting checklist
- Collect the patient's mobile number directly from the patient, and note at intake that it will be used for appointment texts.
- Keep care-related texts separate from anything promotional. If you ever send promotions, get prior express written consent for those first.
- Keep reminder texts short, branded with your practice name and free of billing or financial content.
- Cap automated messages at one per day and three per week per patient unless you have clear consent for more.
- Put an opt-out line in every message and make STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE all work.
- Record opt-outs received by phone, email or at the front desk, not just by text, and apply them within ten business days at most, ideally immediately.
- Keep records of when and how each patient's number and consent were collected.
DocsMD texts are built for the strict reading
DocsMD patient texts are short and minimum necessary: practice name, times and numbered choices, never the patient's name or the reason for the visit. STOP is honored on every message, and a Business Associate Agreement is signed with every practice before any data moves. See how DocsMD works.
Questions
Do I need written consent to send appointment reminder texts?
Under the FCC's 2015 ruling, a patient who gives a phone number to a healthcare provider has given prior express consent for healthcare messages within that scope, and health care messages from HIPAA covered entities are exempt from the written-consent rule for telemarketing. Many practices still collect clear consent at intake because courts are no longer bound by FCC interpretations.
Does the TCPA apply to texts a staff member sends by hand?
The autodialer and prerecorded-voice restrictions target automated calls. A message typed and sent individually by a person is generally treated differently, though other rules, including state laws and opt-out expectations, can still apply.
Can a reminder text include a balance due?
Not under the FCC's healthcare exemption, which excludes accounting, billing, debt-collection and other financial content. Keep billing messages separate and confirm you have consent for them.
How fast must I stop texting after a patient opts out?
Within a reasonable time not to exceed ten business days under the FCC rule, and immediately under the conditions of the healthcare exemption. In practice, aim for immediately. This article is general information, not legal advice.