TCPA Compliance for US Healthcare Texting and Calling · 2026 Playbook

By Santosh Reddy · Director, Ichelon Consulting US

Reviewed by Hanuman Sihag, Head of Innovation Chamber — SEO & AIO

LinkedIn

TCPA basics — 47 USC §227 and the FCC implementing rules

The Telephone Consumer Protection Act is codified at 47 USC §227 and is implemented by the Federal Communications Commission at 47 CFR 64.1200. The statute prohibits, without prior consent from the called party, the use of an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice to call or text a mobile number, and prohibits certain calls to residential lines. The statute also prohibits sending unsolicited advertisements to fax machines and imposes rules on abandoned calls.

For healthcare marketers, the two operational regimes are marketing calls-and-texts (which require prior express written consent) and non-marketing informational calls-and-texts (which require prior express consent — a lower standard — or fit inside a healthcare-treatment exemption that avoids the consent requirement entirely for specific message types). The distinction between "marketing" and "informational" tracks closely with HIPAA's marketing distinction but is not identical, and the operational default is to treat any communication that has any promotional element as marketing and to secure the higher-standard consent for it.

Express written consent for marketing SMS and calls

Prior express written consent under TCPA is defined at 47 CFR 64.1200(f)(9). The consent must be in writing (electronic signature satisfies), must clearly authorise the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, must identify the specific telephone number to which the consent applies, must include a clear and conspicuous disclosure that the consumer is not required to agree to receive the messages as a condition of purchasing any property, goods or services, and must be signed by the consumer.

Consent captured through a website form must be tied to a specific opt-in checkbox (not a pre-ticked box) with the required disclosure language visible at the point of consent. Consent captured through a paper form must carry the same disclosures and a signature. Consent captured through a call must be an audible verbal consent that is recorded and archived with the required disclosures having been read to the consumer in advance.

The consent record must be retained — typically for the duration of the messaging relationship plus a period after — because in TCPA litigation the burden of proving consent is on the sender. A defendant clinic that cannot produce the specific consent record for a specific called party is likely to be treated as having no consent for that called party's damages count.

Appointment-reminder and treatment-message exemptions

The FCC exempted certain healthcare messages made for a HIPAA treatment purpose from the prior-express-written-consent requirement, under 47 CFR 64.1200(a)(3)(v). The exemption covers appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab and test results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions. To qualify for the exemption, the message must be sent by or on behalf of a HIPAA-covered entity, must be for a treatment purpose as defined by HIPAA, must not include any telemarketing, advertising, solicitation, debt-collection, or accounting content, and must comply with specific content-and-frequency limits.

The frequency limits under the exemption cap the number of exempt messages a healthcare provider may send to a given number and specify time-of-day windows outside which the messages should not be sent. Messages that exceed the frequency cap, or that mix a treatment reminder with a promotional element (a coupon for a related aesthetic service, a cross-sell to a specialty product), lose the exemption and become subject to the full express-written-consent standard.

Recall messages sit in a grey zone. A pure recall reminder for an overdue routine appointment tied to standard-of-care intervals typically fits inside the treatment exemption; a recall message that pitches a promotional discount or a limited-time offer does not. Ichelon Consulting US's clinic SMS design keeps recall and reminder messages inside the treatment-exemption scope and pushes any promotional content through a separate opt-in and consent stream.

Revocation and the FCC 2024 clarification

Prior to 2024, the interpretation of what constitutes valid revocation of consent under TCPA varied by circuit and by fact pattern. Some courts had accepted narrow interpretations where a consumer had to use specific keywords or specific channels to revoke effectively. In February 2024, the FCC issued a Second Report and Order (FCC 24-24) clarifying that a consumer may revoke consent to receive robocalls or robotexts through any reasonable means that clearly expresses a desire not to receive further calls or texts. The order was implemented with effect from April 2025 with staggered implementation through 2025.

The practical implications are meaningful. A patient who replies to a marketing SMS with "please stop", "no thanks", "unsubscribe", "opt out", or similar expressions must be treated as having revoked consent. A patient who tells the reception desk over the phone that they no longer want to receive text or call communications from the practice must be treated as having revoked consent — even though the revocation channel differs from the consent channel. The clinic's opt-out handling must extend across channels (SMS platform, CRM, dialer, email marketing tool) so that a revocation in one channel propagates to all channels within a reasonable time (the FCC specified a maximum of ten business days for the revocation to take full effect across systems).

The 2024 clarification substantially raised the operational bar for US healthcare marketers. A single missed revocation across a large patient list is a per-message TCPA violation for every subsequent message. Ichelon Consulting US's clinic SMS-and-call operations run a cross-channel opt-out synchronisation as a standard part of the CRM configuration.

STOP, HELP, and frequency disclosures

Beyond the FCC regulations, the wireless carriers and the CTIA (Cellular Telecommunications Industry Association) enforce their own SMS best-practice standards that shape practical deliverability. Every marketing SMS should include the "Reply STOP to unsubscribe" language at least on the first message and periodically thereafter. Every marketing SMS programme should honour STOP replies immediately and confirm the opt-out with a final "You have been unsubscribed" message. Every marketing SMS programme should honour HELP replies with a message that identifies the sender, describes the messaging programme, and provides support contact information.

Frequency disclosure at the point of consent must state the expected message frequency ("up to 4 messages per month", "up to 2 messages per week") and message-and-data-rates-may-apply language. Message frequency that materially exceeds the disclosed frequency creates both a TCPA argument and a carrier-side deliverability problem — the wireless carriers may throttle or block the sender's short code or long code if the volume outpaces the disclosure.

The Campaign Registry (TCR) requirements added a further layer in 2023-2024 — 10-digit long codes used for A2P messaging must be registered with brand and campaign details, and unregistered or misclassified traffic faces meaningfully higher failure rates and carrier-side surcharges. Ichelon Consulting US's clinic deployments handle TCR registration as part of the SMS-platform onboarding.

Class-action risk and statutory damages

TCPA statutory damages are $500 per violation and up to $1,500 per violation for wilful or knowing violations. Each call or text is a separate violation. The private right of action and the class-action posture create the meaningful risk — a clinic that sends 20,000 non-compliant marketing texts across a patient list has $10 million of pure-statutory exposure before wilfulness enhancement.

Multiple healthcare-adjacent TCPA class-action settlements have exceeded $50 million in aggregate. The most common fact patterns are: marketing SMS to numbers where the consent record cannot be produced, marketing SMS to numbers after a revocation was received in a different channel and not propagated, marketing SMS from a call-tracking or CRM vendor that used a broader "consent" definition than TCPA allows, and marketing SMS pushed to opt-in lists purchased or acquired from third-party sources where the consent chain cannot be verified.

The defendant clinic's exposure is not limited to the direct sender. A clinic that engages a marketing agency to send SMS on its behalf remains a party in the class action even if the agency handled the day-to-day operations. The consent record, the revocation propagation, and the frequency compliance are all clinic-side responsibilities that the agency executes on the clinic's behalf. Ichelon Consulting US's clinic SMS operations are scoped as an extension of the clinic's compliance perimeter rather than as a stand-alone agency operation.

HIPAA overlap

TCPA and HIPAA operate on parallel tracks and both apply to healthcare SMS-and-call operations. HIPAA governs the use and disclosure of PHI including in SMS content and call transmissions. TCPA governs the consent and channel-use rules for the SMS or call itself, independent of content.

A single well-designed consent form can satisfy both simultaneously, but the drafting must expressly address both surfaces. The consent must state, in plain language, that the individual authorises the practice to use their PHI for the specific marketing purpose (HIPAA marketing authorisation), and separately authorises the practice to deliver telemarketing calls or texts using an automatic dialing system or prerecorded voice at the specified number, with the disclosure that consent is not a condition of care (TCPA express written consent). The consent should also include the STOP-HELP language and the frequency disclosure so that the operational SMS programme runs cleanly from day one.

Where the healthcare message fits inside the TCPA treatment-message exemption at 64.1200(a)(3)(v), the corresponding HIPAA analysis often puts it inside the treatment carve-out from HIPAA's marketing definition — but the two do not always align. A recall reminder for a routine screening is treatment for HIPAA and treatment for TCPA. A message about a new specialty service the practice has added and thinks the patient might be interested in is marketing for HIPAA and marketing for TCPA. Ichelon Consulting US's clinic SMS design maps every message class to both surfaces and separates the consent-and-channel handling accordingly.

TCPA-safe SMS funnel design for clinics

A TCPA-safe US clinic SMS funnel has a small number of moving parts and each one has to be right. The first is the consent capture — a website or paper form with the express-written-consent language, the not-a-condition-of-care disclosure, the frequency expectation, and the STOP-HELP notice. The second is the consent record retention — the specific consent tied to the specific number, retained for the duration of the messaging relationship plus a buffer. The third is the segmentation between exempt treatment messages (running to a broader recipient pool under the healthcare-treatment exemption at applicable frequency limits) and non-exempt marketing messages (running only to consented numbers). The fourth is the STOP-and-HELP handling — immediate opt-out on STOP with confirmation message, sender-identification response on HELP. The fifth is the cross-channel revocation propagation — a revocation in any channel updates the CRM and every downstream sending system inside the required window. The sixth is the frequency governance — the actual send frequency stays inside the disclosed frequency for each recipient.

These are not optional in 2026. The FCC 2024 revocation clarification and the sustained class-action activity mean that a clinic operating a marketing SMS programme without this discipline is running a live risk. Ichelon Consulting US's clinic SMS-and-call operations run every one of these gates by default as part of the standard engagement scope.

Related insights

The adjacent compliance pillars are at HIPAA Marketing Compliance for US Clinics 2026 for the parallel HIPAA rulebook, HHS OCR Settlements Healthcare Marketing Playbook 2026 for enforcement fact-pattern analysis, and ADA Digital Accessibility for US Healthcare Websites 2026 for the third compliance surface US clinic websites are subject to. The state pillar most tied to strict enforcement is Healthcare Marketing Agency in California.