SMS marketing for medical practices: how to text patients with the right consent and stay within the TCPA
A medical practice can text patients for reminders, recalls, review requests and promotions, as long as it has the right consent for each message type, registers its texting with carriers, respects quiet hours and opt-outs, and keeps health details out of the message. This guide explains the TCPA at a high level, 10DLC registration, HIPAA basics, wording templates you can adapt and how to measure results. It is general information, not legal advice.
- Match consent to the message: informational texts such as reminders need prior express consent; marketing texts generally need prior express written consent.
- Register before you send: business texting from a 10-digit number requires brand and campaign registration through your texting provider.
- Honor opt-outs fast and by any reasonable means, not only the word STOP.
- Keep health details out of texts: name the practice and the time, not the condition, test or treatment.
- Sign a BAA with your texting vendor and keep consent records you can produce later.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What practices use SMS for, and what each message needs
Text messages are read quickly and suit short, practical communication. Most practices use them for a handful of purposes. The consent and compliance requirements depend on the purpose, so sort your messages into types before you write a single one.
| Message type | Example purpose | Usual category | Consent to plan for |
|---|---|---|---|
| Appointment reminder | Confirm or reschedule a booked visit | Informational | Prior express consent (often the patient giving their mobile number for this purpose) |
| Recall or care reminder | Due for an annual visit or follow-up | Usually informational when about the patient's own care | Prior express consent; check with counsel if it promotes new services |
| Intake and forms link | Complete paperwork before a visit | Informational | Prior express consent |
| Review request | Ask for feedback after a visit | Can be treated as marketing | Many practices collect written consent to be safe |
| Promotions and new services | Seasonal offer, new location, event | Marketing | Prior express written consent |
| Lead follow-up | Reply to a web enquiry | Depends on content | Consent checkbox on the form that covers texts |
When in doubt, treat a message as marketing and collect written consent. It costs little extra effort and removes most of the risk. Practices with an agency or texting vendor should confirm who keeps consent records and how they are exported if the relationship ends.
SMS is not the right channel for everything. Test results, diagnoses, billing disputes and anything sensitive belong in the patient portal or a phone call. Texts should point patients to those secure places, not carry the information themselves.
Decide early whether your texting will be one-way or two-way. Two-way texting lets patients reply to confirm, reschedule or ask simple questions, which many prefer to calling. It also means someone must watch the inbox during business hours, reply consistently and move anything clinical to a phone call or the portal. Assign an owner and set expected reply times before launch.
TCPA consent at a high level
The Telephone Consumer Protection Act (TCPA) is a federal law enforced by the Federal Communications Commission (FCC), with a private right of action that lets individuals sue. The statute sets damages of $500 per violation, up to $1,500 if the violation is willful or knowing, so class actions over texts can become expensive quickly. The rules below are a simplified summary.
Two levels of consent
- Prior express consent generally covers informational texts such as appointment reminders sent with automated systems. A patient providing a mobile number for this purpose is commonly treated as consent, but document it.
- Prior express written consent is generally required for marketing or advertising texts sent with automated technology. It is a signed agreement (an electronic signature or checkbox under the E-SIGN Act can count) that clearly authorizes the practice to send marketing texts to a specific number.
What a written consent should include
- The name of the practice that will send texts.
- That messages may be marketing and may be sent using automated technology.
- That consent is not a condition of receiving care or buying anything.
- Message frequency, that message and data rates may apply, and how to opt out (for example, reply STOP).
- A link to your privacy policy and terms.
Never pre-check a consent box. Record the date, time, source, the exact wording shown and the number consented.
Healthcare messages
The FCC has recognized a narrow exemption for certain healthcare messages from HIPAA covered entities, with conditions such as no charge to the recipient, limits on frequency and an easy opt-out. Marketing content does not qualify. Do not rely on the exemption without legal review.
Opt-outs
Under FCC rules, patients may revoke consent by any reasonable means, including replies such as "stop", "quit", "cancel" or "unsubscribe", or a plain-language request. Honor revocations within a reasonable time, and no later than the deadline in current FCC rules (10 business days). A single confirmation text that does not include marketing is generally allowed. Our TCPA healthcare SMS deep guide covers the details.
Quiet hours, Do Not Call and state laws
Federal rules prohibit telephone solicitations before 8 a.m. or after 9 p.m. in the recipient's local time. Use the patient's time zone, not the practice's, and remember that area codes do not always match where someone lives.
Several states have their own telemarketing laws, sometimes called "mini-TCPA" laws. Some set narrower calling and texting hours, limit how many messages can be sent in a period, restrict messages on certain days or holidays, or broaden what counts as an automated system. If you text patients in more than one state, follow the strictest rule that applies or segment by state.
The National Do Not Call Registry applies to telephone solicitations, including texts. Prior express written consent, or an established business relationship in some cases, changes how it applies, but practices should keep an internal do-not-contact list and check it before every marketing send.
Reassigned and wrong numbers
Mobile numbers change hands. A text sent to a number that now belongs to someone else can still create TCPA exposure. The FCC operates a Reassigned Numbers Database that businesses can check to learn whether a number has been permanently disconnected since a given date, and using it properly can provide a safe harbor. Ask patients to confirm their mobile number at each visit, and remove numbers promptly when someone replies that you have the wrong person.
Practical timing rules
- Send marketing texts on weekdays during business hours in the recipient's time zone.
- Send reminders at consistent, reasonable times, such as the day before an appointment.
- Set a frequency cap per patient per month for marketing messages and state it in the consent language.
- Pause marketing texts around major holidays unless you have checked state rules.
Confirm state-specific rules with your compliance or legal team before launching campaigns across state lines.
10DLC registration and carrier requirements
US mobile carriers treat business texting from ordinary 10-digit numbers ("10DLC") as application-to-person (A2P) messaging. They require businesses to register before sending. Unregistered or poorly registered traffic is often filtered or blocked, which means patients never receive the reminder.
What registration involves
- Brand registration: your legal business name, EIN, address and website, submitted through your texting provider to the industry registry carriers use.
- Campaign registration: the use case (for example, account notifications or marketing), a description, sample messages, how patients opt in, and opt-out and help keyword responses.
- Consistency: messages you send must match the registered use case. Sending promotions on a campaign registered only for reminders can lead to filtering.
Toll-free numbers have their own verification process, and short codes have a separate application. Your texting vendor should guide you through whichever route you choose.
Content carriers scrutinize
Carriers apply content rules beyond the law. Messages about certain restricted products, misleading links, public URL shorteners and inconsistent sender identification can trigger filtering. Use your own domain for links, identify the practice in every message and keep wording plain.
Plan for registration to take time before launch, and keep your website's privacy policy and texting terms live, because reviewers check them.
Keep a copy of everything you submitted for registration: the use-case description, sample messages and opt-in wording. When you add a new type of message later, such as promotions after starting with reminders only, update the registration or add a campaign before sending. If messages start failing, check registration status first; it is a more common cause of sudden delivery drops than wording.
HIPAA basics for texting patients
Texting does not require patients to give up privacy, but ordinary SMS is not encrypted. Follow a few principles.
- Minimum necessary: include only what the patient needs to act. Name the practice, date and time. Leave out the condition, test, medication or treatment.
- Watch the sender name: if the practice name itself reveals a sensitive specialty, consider a neutral sender name or a general group name in reminders.
- Business Associate Agreement: a texting vendor that creates, receives, stores or transmits protected health information for you is generally a business associate. Sign a BAA before sending.
- Patient preference: HHS guidance indicates that patients may ask to receive information by unencrypted text after being told of the risks. Document the preference.
- Marketing authorization: communications about your own services for the patient's treatment are generally not "marketing" under HIPAA. Communications paid for by a third party that encourage use of its product or service generally require the patient's written authorization. Check edge cases with counsel.
Train staff not to text from personal phones and not to reply to patient texts with health details. Our HIPAA checklist for front desk staff and guide to what to require from vendors cover the practical side.
Patients will sometimes text back health details, such as symptoms or questions about a prescription. Prepare a standard reply that moves the conversation to a secure channel, for example: "Thanks for your message. For your privacy, please call us at (555) 010-0100 or use the patient portal." Store these replies in the vendor's system covered by the BAA, not on staff phones.
Message templates that avoid health details
Adapt these to your practice and have your compliance team approve the final wording. Keep each message short, identify the practice, give one action and include an opt-out where required.
| Use | Template |
|---|---|
| Opt-in confirmation | Lakeside Family Practice: you're subscribed to appointment and office updates. Up to 4 msgs/mo. Msg & data rates may apply. Reply HELP for help, STOP to opt out. |
| Appointment reminder | Lakeside Family Practice: reminder of your visit on Tue 10/14 at 9:30 AM. Reply C to confirm or call (555) 010-0100 to reschedule. Reply STOP to opt out. |
| Intake forms | Lakeside Family Practice: please complete your forms before your visit at lakesidefp.com/forms. Questions? Call (555) 010-0100. |
| Recall | Lakeside Family Practice: our records show you may be due for a visit. Book at lakesidefp.com/book or call (555) 010-0100. Reply STOP to opt out. |
| Review request | Thanks for visiting Lakeside Family Practice. If you have a moment, we'd value your feedback: lakesidefp.com/review. Reply STOP to opt out. |
| New location (marketing) | Lakeside Family Practice now has a second office on Elm St, open Saturdays. Book at lakesidefp.com/elm. Reply STOP to opt out. |
| Opt-out confirmation | Lakeside Family Practice: you're unsubscribed and won't receive more texts. Call (555) 010-0100 if you need us. |
Notice what is missing: no condition names, no medication names, no test names and no "your results are ready". A review request also must not depend on the patient's experience; send it to everyone eligible. Our guide to getting more Google reviews explains the review routine.
Wording rules to follow
- Start with the practice name so the patient knows who is texting.
- Use one clear action per message: confirm, book, complete forms or leave feedback.
- Link to your own domain, not a public link shortener.
- Avoid urgency language, all capitals and heavy punctuation, which read as spam and can trigger filtering.
- Do not imply a diagnosis or that the patient needs a treatment.
- Keep promotions factual and avoid claims you cannot support.
Set up the workflow before the first send
- Inventory your messages by type and decide the consent level for each.
- Choose a vendor that signs a BAA, supports 10DLC registration, logs consent and processes opt-outs automatically across all campaigns.
- Add consent capture to intake forms, web forms (an unchecked box with the full disclosure) and the front desk script. Keep a text-in keyword option for in-office signage.
- Register the brand and campaigns with sample messages that match what you will send.
- Load only consented numbers, tagged with consent type and date. Do not upload old spreadsheets of numbers without consent records.
- Set quiet hours and frequency caps in the system, using the recipient's time zone.
- Train staff on opt-out handling, including informal replies like "please stop" and requests made by phone.
- Audit monthly: spot-check consent records, opt-out processing time and message wording.
If an agency runs your texting, the same rules apply, and the practice remains responsible. Ask how they store consent and how fast they process opt-outs. Our patient email and SMS marketing page explains how Ichelon Consulting US runs these programs under a BAA.
Finally, write the program down in a one-page policy: message types, consent level for each, sending hours, frequency caps, who approves new wording and how opt-outs are handled. A written policy makes training easier and shows care if a complaint ever arrives.
Measure delivery, response and booked visits
- Delivery rate: a falling rate often signals carrier filtering or registration problems.
- Opt-out rate per campaign: a spike means the message, timing or frequency is off.
- Reply and confirmation rate for reminders.
- No-show rate before and after reminders, by location.
- Bookings from recall and marketing texts, tracked with unique links or codes rather than health data.
- Opt-out processing time, from request to suppression.
- Complaints received by staff or through carriers.
Report these monthly and keep identifiable patient information out of general analytics. A program that books visits with low opt-outs and clean consent records is worth growing; one that raises opt-outs needs fewer, better messages.
Test one change at a time: the send time, the wording or the frequency. Run each test for long enough to see bookings, not just replies, and keep the version that books more visits with fewer opt-outs. Review the consent log in the same meeting so compliance and performance are checked together rather than by different teams on different schedules.
Related pages from the US team
TCPA healthcare SMS deep guide
A detailed look at TCPA rules for healthcare texting.
CAN-SPAM email guide
The email rules that sit alongside texting rules.
HIPAA for agencies and vendors
What to require from texting and marketing vendors.
Patient email and SMS marketing
How Ichelon Consulting US runs patient messaging under a BAA.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Do medical practices need consent to text patients?
Yes. Under the TCPA, informational texts such as appointment reminders sent with automated systems generally need prior express consent, and marketing texts generally need prior express written consent. Practices should document when and how each patient consented and confirm their approach with legal counsel.
What is 10DLC registration for medical practices?
10DLC registration is the process US mobile carriers require for business texting from ordinary 10-digit phone numbers. A practice registers its brand and each campaign's use case, sample messages and opt-in method through its texting provider. Unregistered traffic is often filtered or blocked.
What hours can a medical practice send marketing texts?
Federal rules prohibit telephone solicitations, including marketing texts, before 8 a.m. or after 9 p.m. in the recipient's local time. Some states set narrower hours or other limits, so practices texting across states should follow the strictest applicable rule and check with counsel.
Can appointment reminder texts include health information?
Reminders should include only what the patient needs: the practice name, date, time and how to confirm or reschedule. Leave out conditions, tests, medications and treatment names, because ordinary SMS is not encrypted. The texting vendor should sign a Business Associate Agreement with the practice.
How quickly must a practice honor a STOP request?
FCC rules let consumers revoke consent by any reasonable means, not only by replying STOP, and require revocations to be honored within a reasonable time, no later than 10 business days under current rules. Most texting systems suppress the number immediately, which is the safest practice.
Do review request texts need written consent?
A review request may be treated as marketing rather than an informational message, so many practices collect prior express written consent before sending it. The request should go to every eligible patient, not only happy ones, and must not offer gifts or discounts for reviews.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Want your texting program checked before you scale it?
A 30-minute call with the US team. We'll review your consent capture, registration and message wording and tell you what to fix first. This is a marketing review, not legal advice.