TCPA healthcare SMS marketing compliance deep guide
A working field guide for healthcare marketing operators, growth heads and CRM leads running SMS, voice and RCS outreach into US mobile numbers. Covers the Telephone Consumer Protection Act at 47 USC 227, the FCC's implementing regulations at 47 CFR 64.1200, the healthcare treatment exemption, the 2024 revocation rulemaking, and state mini-TCPA overlays.
- Statutory damages are the reason TCPA is a boardroom-level topic. USD 500 per negligent violation and USD 1,500 per willful or knowing violation, aggregated across texts or calls, produce class-action exposures in the tens of millions.
- Every autodialed or prerecorded telemarketing message to a mobile number needs prior express written consent under 47 CFR 64.1200(a)(2). Every autodialed informational call to a mobile number needs prior express consent. The two standards are not interchangeable.
- The FCC's healthcare treatment exemption applies to a narrow set of informational messages strictly for the recipient's own treatment — appointment reminders, prescription refill reminders, pre-op instructions, care coordination — and only when specified conditions on frequency, content and revocation are met.
- Consumers may revoke consent by any reasonable means. A one-word STOP, END, CANCEL, UNSUBSCRIBE, QUIT or REVOKE reply is presumed reasonable. Sellers have ten business days to honor the revocation.
- Not legal advice. Consult a TCPA-focused attorney and your state consumer-protection statute before scaling any healthcare SMS or voice program.
On this page
- The statute and why healthcare marketing operators feel it
- Statutory damages and the class-action structure
- Prior express written consent versus prior express consent
- The healthcare treatment exemption — scope and edges
- Revocation, the 2024 FCC order and the one-response rule
- State mini-TCPA overlays
- A defensible healthcare SMS architecture
- Working compliance checklist
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
The statute and why healthcare marketing operators feel it
The Telephone Consumer Protection Act, codified at 47 USC 227, was enacted in 1991 to curb intrusive telephone marketing. Its implementing regulations at 47 CFR 64.1200 have been amended repeatedly. Two features of the statute make it disproportionately consequential for healthcare marketing: it creates a private right of action with statutory damages per violation, and it aggregates across every text and every call.
The regulated activities in the healthcare context are principally three: text messages to mobile numbers using an automatic telephone dialing system (ATDS); voice calls to mobile numbers using an ATDS or an artificial or prerecorded voice; and voice calls to residential lines using an artificial or prerecorded voice. All three are subject to the prior-consent framework, with narrow exemptions.
The 2015 Omnibus Order and subsequent FCC orders have both broadened and narrowed the definition of an ATDS. The 2021 Supreme Court decision in Facebook v. Duguid interpreted the statutory definition narrowly, but the practical effect for a healthcare marketer running a bulk SMS platform is small — most bulk SMS platforms sit within the regulated definition because of their calling functionality, and the FCC's rules on prerecorded voice calls do not depend on ATDS status.
Statutory damages and the class-action structure
Under 47 USC 227(b)(3), private plaintiffs may recover the greater of actual monetary loss or USD 500 for each negligent violation, and treble damages (up to USD 1,500 per violation) for willful or knowing violations. There is no statutory cap on aggregate damages in a class action.
The class-action mechanics amplify exposure. A single misconfigured campaign that sends a message to a class of 200,000 recipients without valid consent, at USD 500 per violation, represents USD 100 million in nominal exposure before any wilfulness enhancement. Even at typical class-action settlement discounts, the settled value is often in the tens of millions.
Enforcement patterns in healthcare
Recent TCPA settlements in the healthcare space have concentrated on:
- Appointment-reminder platforms sending texts to numbers ported to different consumers, with no re-verification of consent at porting.
- Health-plan or telehealth marketing campaigns sending texts to leads acquired from a third-party lead-generation platform, with consent language on the lead form that did not meet the prior-express-written-consent standard.
- Refill-reminder programs that included promotional content beyond the strict scope of the treatment exemption.
- Voicemail drops using prerecorded voice, sent to mobile numbers, without valid consent.
- Wrong-number and reassigned-number liability, where consent existed for the original subscriber but not for the reassigned subscriber.
Prior express written consent versus prior express consent
The TCPA framework recognizes two consent standards. The higher standard — prior express written consent — is required for autodialed or prerecorded telemarketing messages. The lower standard — prior express consent — is sufficient for autodialed informational messages.
Prior express written consent — 47 CFR 64.1200(f)(9)
Prior express written consent must be an agreement in writing (electronic signature acceptable) that authorizes the seller to deliver telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and includes the specific disclosures required by the regulation. The disclosures include: the number to be called, a clear and conspicuous statement that the recipient authorizes telemarketing calls using an ATDS or prerecorded voice, and a clear and conspicuous statement that consent is not a condition of purchase.
Prior express consent — for informational
Where the message is strictly informational (not encouraging purchase or use of a product or service), the lower standard applies. Providing a mobile number in the context of a transaction is often sufficient for informational contact by that transaction. Adding a promotional layer to an informational message pushes it into the telemarketing category and triggers the higher standard.
The FCC "lead generator loophole" rule — vacated before it took effect
The FCC's 2023 one-to-one consent rule (FCC 23-107) would have required consent on multi-seller lead-generation forms to name a single seller, and limited outreach to topics "logically and topically associated" with the interaction that prompted the consent. The Eleventh Circuit vacated it on January 24, 2025, in Insurance Marketing Coalition v. FCC, before its January 27, 2025 effective date, and the FCC restored the prior text of 47 CFR 64.1200(f)(9) in an order (DA 25-621) effective August 29, 2025. Prior express written consent still has to be specific and documented, and many practices keep single-seller consent as a best practice. Healthcare lead-generation programs that aggregate leads across multiple downstream sellers should still be able to show that each consent record clearly covers the practice that is texting.
The healthcare treatment exemption — scope and edges
The FCC has recognized a narrow exemption for certain healthcare messages that are strictly for the recipient's own treatment. The exemption, articulated in the 2015 Omnibus Order and subsequent guidance, applies only to specified message types and only when a set of conditions is satisfied.
Message types the exemption reaches
- Appointment reminders and confirmations for the recipient's own scheduled care.
- Prescription refill reminders where the recipient is the prescribed patient.
- Pre-op and post-op instructions and preparation reminders.
- Care coordination and lab-result notifications.
- Wellness check-ins linked to a specific treatment plan.
Conditions the exemption requires
- Messages are sent by or on behalf of a covered entity or its business associate.
- The message content is strictly limited to the covered treatment purpose. No promotional layer.
- The recipient is not charged for the message (the sender absorbs any carrier cost).
- Frequency is limited (the FCC's earlier articulation has been at "one message per day, up to three per week per patient").
- Every message includes an easy opt-out method and is followed by an immediate opt-out honoring.
Revocation, the 2024 FCC order and the one-response rule
The FCC's February 2024 order (effective April 2025) clarified and standardized the revocation framework across text and voice. The core points:
- A consumer may revoke consent by any reasonable means.
- A one-word reply of STOP, END, CANCEL, UNSUBSCRIBE, QUIT or REVOKE (in any casing) to a text message is presumed reasonable.
- Voice revocation stated during a call is a reasonable means.
- The seller has ten business days from receipt of a revocation to honor it across all channels.
- Revocation of consent for one type of message (e.g. marketing) can, at the consumer's request, apply to all messages; the consumer can also revoke for a specific type.
- The order's separate "revoke-all" requirement — treating an opt-out from one type of message as covering all robocalls and robotexts on unrelated matters — did not start in April 2025. The FCC delayed it to April 11, 2026 (DA 25-312) and then to January 31, 2027 (DA 26-12).
- Contract language that limits the manner of revocation is not enforceable — the consumer's chosen reasonable method controls.
The one-response confirmation rule
The FCC has confirmed that a single response confirming a revocation — for example, a text acknowledging the STOP request and stating that no further messages will be sent — is permitted and does not itself violate TCPA. A confirmation that adds any promotional or upsell content is a violation. Keep the confirmation short, factual, and free of any call to action.
State mini-TCPA overlays
Several states have enacted mini-TCPA statutes with stricter requirements or higher damages than the federal framework. Multi-state healthcare SMS operators need a state-by-state posture.
Common state overlays to scope
- Florida — Florida Telephone Solicitation Act (FTSA). Extends consent requirements to text messages sent using selected equipment, with a private right of action and statutory damages parallel to federal TCPA.
- Washington — Commercial Electronic Mail Act (CEMA) and RCW 80.36.400. State-level restrictions on commercial texts and unsolicited calls.
- Oklahoma — Telemarketer Restriction Act. Post-2023 legislation with a private right of action.
- Maryland — Maryland Telephone Consumer Protection Act. Additional state-level restrictions with private enforcement.
- New York, New Jersey, Massachusetts. State attorneys general active on consumer-protection enforcement against SMS abuses.
The scoping approach: identify the states the program reaches, layer state-specific consent language on top of the federal TCPA baseline, run periodic geographic-audit reports to confirm the program is not leaking messages into states with stricter rules under a national default consent.
A defensible healthcare SMS architecture
A defensible healthcare SMS program in 2026 has seven components.
- Opt-in capture that meets the prior-express-written-consent standard, records timestamp, IP, form-text version and consent scope, and stores the record for at least four years.
- Reassigned Numbers Database integration that checks the number's status before an autodialed campaign and honors the safe harbor under 47 CFR 64.1200(a)(4).
- Do-not-call and internal-DNC list that is checked before every send and is maintained across every sender ID and every product line.
- Message-type routing that separates strictly-treatment messages (eligible for the exemption) from telemarketing messages (require higher-tier consent), and never mixes the two in the same message.
- Revocation handling that accepts STOP, END, CANCEL, UNSUBSCRIBE, QUIT and REVOKE in any casing, propagates across channels within ten business days, sends one confirmation.
- Sender-ID management that uses 10DLC or short-code registration compliant with the CTIA and carrier best practices, avoids number-recycling within retention windows, and monitors carrier deliverability signals as a leading indicator of consent-quality problems.
- Audit trail including message content by campaign, consent records, revocation records, DNC-check evidence, and RND-check evidence. Retention aligned with the state statute of limitations (four years federal, longer in some states).
Working compliance checklist
Consent capture
Prior-express-written-consent language for marketing. Prior-express-consent for informational. Records stored with timestamp, IP, form-text version.
Reassigned Numbers Database
RND check before every autodialed campaign to mobile. Safe-harbor documentation retained.
DNC lists
Internal DNC and National DNC checks. Cross-sender-ID and cross-product propagation.
Healthcare exemption discipline
Strictly-treatment messages carry no promotional content. Frequency limits observed. Recipient not charged.
Revocation
STOP/END/CANCEL/UNSUBSCRIBE/QUIT/REVOKE recognized. Confirmation is single, factual, no CTA. Ten-business-day cross-channel propagation.
State overlay
State-by-state consent posture. FTSA, CEMA, OK and MD state statutes scoped where the program reaches those states.
TCPA healthcare SMS — common questions
What are the statutory damages for a TCPA violation?
Under 47 USC 227(b)(3), private plaintiffs may recover USD 500 per negligent violation and up to USD 1,500 per willful or knowing violation. Each text or call is a separate violation, and class actions in healthcare routinely allege exposure in the tens of millions.
Is a healthcare appointment reminder text a TCPA-regulated communication?
Yes. Any text sent to a mobile number using an ATDS or prerecorded voice is regulated under 47 USC 227(b)(1)(A). The FCC has granted a narrow exemption for treatment-only messages that meet specified conditions on scope, frequency and revocation.
What is prior express written consent versus prior express consent?
Prior express written consent under 47 CFR 64.1200(f)(9) is required for autodialed or prerecorded telemarketing. It must be in writing, bear the consumer's signature (electronic acceptable), and include specified disclosures. Prior express consent applies to non-telemarketing informational messages.
How does the recipient revoke consent under TCPA?
The FCC's 2024 order clarified that consumers may revoke by any reasonable means. STOP, END, CANCEL, UNSUBSCRIBE, QUIT or REVOKE replies are presumed reasonable. Sellers have ten business days to honor across channels.
What is the one-call safe harbor or one-text rule?
The FCC has confirmed that a single confirmatory response to a revocation — a text acknowledging STOP — is permitted and does not itself violate TCPA. Any subsequent message after that confirmation is a violation.
Does state law layer on top of TCPA?
Yes. Florida (FTSA), Washington (CEMA), Oklahoma, Maryland and others have mini-TCPA statutes with stricter rules and private rights of action. Multi-state healthcare SMS programs need a state-by-state consent posture.
Are text-message templates from a business-associate SMS vendor safer?
The vendor being a business associate under HIPAA does not by itself provide TCPA safe harbor. TCPA and HIPAA are independent regimes. The safer construction is a vendor that is both a HIPAA business associate and demonstrably TCPA-compliant on consent capture, RND checks, DNC lists, revocation handling and audit trails.
Scope your healthcare SMS compliance engagement
Book a 30-minute call with the US practice lead, email us, or WhatsApp us in your time zone. Retainers custom-scoped per engagement · from $499/month.
Common questions
What are the TCPA requirements for texting patients?
Appointment reminders and other treatment texts can rely on the TCPA's healthcare exemption when they stay limited and easy to stop, but marketing texts sent with an autodialer need prior express written consent. Identify your practice, honor opt-outs sent by any reasonable means (STOP, END, CANCEL) within ten business days, and respect state quiet hours and mini-TCPA laws.
Is it a HIPAA violation to text patients?
No, texting patients is allowed. HIPAA permits texts about appointments and care, and HHS guidance lets providers send unencrypted messages if the patient is warned of the risk and still prefers them. Keep messages minimal, leave out diagnoses and results, use a vendor that signs a BAA for anything containing PHI, and follow TCPA consent rules for marketing texts.
Is RCS messaging HIPAA compliant?
No messaging channel is HIPAA compliant by itself. RCS can be acceptable for appointment reminders when the vendor signs a BAA, messages carry minimal health detail and patients agree to the channel. End-to-end encryption depends on devices and apps, so do not assume it. RCS messages are also treated like texts under the TCPA, so the same consent rules apply.
Can a practice get sued for SMS texting under the TCPA?
Yes. The TCPA lets individuals sue for $500 per unlawful text, or up to $1,500 if the violation was willful, and cases are often filed as class actions, so one campaign can create large exposure. Common triggers are marketing texts without written consent, ignored opt-outs and texts to reassigned numbers. Some states, such as Florida and Oklahoma, add their own mini-TCPA laws.
Is the FCC one-to-one consent rule still coming?
No. The FCC's 2023 one-to-one consent rule (FCC 23-107) would have required consent to name a single seller, but the Eleventh Circuit vacated it on January 24, 2025, in Insurance Marketing Coalition v. FCC, before it took effect, and the FCC restored the prior rule text effective August 29, 2025. Prior express written consent for marketing calls and texts using an autodialer or prerecorded voice still has to be specific and documented, and many practices keep single-seller consent as a best practice.
Are ringless voicemails TCPA-safe?
The FCC and multiple courts have treated ringless-voicemail delivery to mobile numbers as calls subject to the TCPA. Marketing use requires prior express written consent equivalent to any other marketing call. There is no free pass for the ringless-voicemail delivery mechanism.
Can HIPAA authorization cover TCPA?
A HIPAA marketing authorization and TCPA prior express written consent are distinct legal instruments. A single well-designed consent form can satisfy both simultaneously, but the drafting must expressly address both surfaces. A stand-alone HIPAA authorization without TCPA-required elements (identification of the seller, statement that consent is not a condition of care, express consent to receive autodialed or prerecorded calls or texts at the number provided) does not satisfy TCPA.