TCPA healthcare SMS marketing compliance deep guide

The statute and why healthcare marketing operators feel it

The Telephone Consumer Protection Act, codified at 47 USC 227, was enacted in 1991 to curb intrusive telephone marketing. Its implementing regulations at 47 CFR 64.1200 have been amended repeatedly. Two features of the statute make it disproportionately consequential for healthcare marketing: it creates a private right of action with statutory damages per violation, and it aggregates across every text and every call.

The regulated activities in the healthcare context are principally three: text messages to mobile numbers using an automatic telephone dialing system (ATDS); voice calls to mobile numbers using an ATDS or an artificial or prerecorded voice; and voice calls to residential lines using an artificial or prerecorded voice. All three are subject to the prior-consent framework, with narrow exemptions.

The 2015 Omnibus Order and subsequent FCC orders have both broadened and narrowed the definition of an ATDS. The 2021 Supreme Court decision in Facebook v. Duguid interpreted the statutory definition narrowly, but the practical effect for a healthcare marketer running a bulk SMS platform is small — most bulk SMS platforms sit within the regulated definition because of their calling functionality, and the FCC's rules on prerecorded voice calls do not depend on ATDS status.

Prior express written consent versus prior express consent

The TCPA framework recognises two consent standards. The higher standard — prior express written consent — is required for autodialed or prerecorded telemarketing messages. The lower standard — prior express consent — is sufficient for autodialed informational messages.

Prior express written consent — 47 CFR 64.1200(f)(9)

Prior express written consent must be an agreement in writing (electronic signature acceptable) that authorises the seller to deliver telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and includes the specific disclosures required by the regulation. The disclosures include: the number to be called, a clear and conspicuous statement that the recipient authorises telemarketing calls using an ATDS or prerecorded voice, and a clear and conspicuous statement that consent is not a condition of purchase.

Prior express consent — for informational

Where the message is strictly informational (not encouraging purchase or use of a product or service), the lower standard applies. Providing a mobile number in the context of a transaction is often sufficient for informational contact by that transaction. Adding a promotional layer to an informational message pushes it into the telemarketing category and triggers the higher standard.

The 2024 FCC "lead generator loophole" rule

The FCC's December 2023 order (codified 2024) tightened consent on multi-seller lead-generation forms. A single consent checkbox that covers multiple companies is no longer sufficient for TCPA-regulated outreach — consent must be given on a one-to-one basis, per seller, to a topic logically and topically related to the seller's business. Healthcare lead-generation programmes that aggregate leads across multiple downstream sellers should re-audit consent flows against the one-to-one standard.

Revocation, the 2024 FCC order and the one-response rule

The FCC's February 2024 order (effective April 2025) clarified and standardised the revocation framework across text and voice. The core points:

• A consumer may revoke consent by any reasonable means.
• A one-word reply of STOP, END, CANCEL, UNSUBSCRIBE, QUIT or REVOKE (in any casing) to a text message is presumed reasonable.
• Voice revocation stated during a call is a reasonable means.
• The seller has ten business days from receipt of a revocation to honour it across all channels.
• Revocation of consent for one type of message (e.g. marketing) can, at the consumer's request, apply to all messages; the consumer can also revoke for a specific type.
• Contract language that limits the manner of revocation is not enforceable — the consumer's chosen reasonable method controls.

The one-response confirmation rule

The FCC has confirmed that a single response confirming a revocation — for example, a text acknowledging the STOP request and stating that no further messages will be sent — is permitted and does not itself violate TCPA. A confirmation that adds any promotional or upsell content is a violation. Keep the confirmation short, factual, and free of any call to action.

A defensible healthcare SMS architecture

A defensible healthcare SMS programme in 2026 has seven components.

1. Opt-in capture that meets the prior-express-written-consent standard, records timestamp, IP, form-text version and consent scope, and stores the record for at least four years.
2. Reassigned Numbers Database integration that checks the number's status before an autodialed campaign and honours the safe harbour under 47 CFR 64.1200(a)(4).
3. Do-not-call and internal-DNC list that is checked before every send and is maintained across every sender ID and every product line.
4. Message-type routing that separates strictly-treatment messages (eligible for the exemption) from telemarketing messages (require higher-tier consent), and never mixes the two in the same message.
5. Revocation handling that accepts STOP, END, CANCEL, UNSUBSCRIBE, QUIT and REVOKE in any casing, propagates across channels within ten business days, sends one confirmation.
6. Sender-ID management that uses 10DLC or short-code registration compliant with the CTIA and carrier best practices, avoids number-recycling within retention windows, and monitors carrier deliverability signals as a leading indicator of consent-quality problems.
7. Audit trail including message content by campaign, consent records, revocation records, DNC-check evidence, and RND-check evidence. Retention aligned with the state statute of limitations (four years federal, longer in some states).