A patient hasn't been in for 14 months. Your hygienist flags the chart, your front desk queues a recall, and a text goes out: "Hi Dana, it's been a while since your last cleaning, want to get back on the schedule?" That message is treatment communication. You can send it under the consent a patient already gave when they became a patient.
Now add one more sentence: "Book this month and we'll waive the $89 exam fee." You just turned that same text into a marketing message, and marketing messages sit under a stricter consent standard than treatment reminders. Most clinics never notice the switch happened, because the two texts look almost identical on the screen.
Full disclosure: I work for Ready, an SMS platform a lot of clinics and dental groups use to run exactly these recalls. I'm going to show you where the line actually sits, with annotated examples, and what to do operationally so a batch doesn't quietly cross it.
Why treatment and marketing live under different rules
Two frameworks govern a text to a patient, and they're not the same signature.
HIPAA governs the content, whether you can say anything protected in the message body. TCPA governs the channel and intent, whether you were allowed to text that person at all, and whether the message counts as an advertisement. A clinic can clear HIPAA and still trip TCPA, and the reverse. (We pulled those two apart in detail in TCPA consent and HIPAA authorization are two different signatures.)
For the recall-vs-marketing problem, TCPA is the one doing the work. Under TCPA, a message whose purpose is to care for an existing patient (a reminder, a recall, a result-ready notice) generally rides on the consent implied by the treatment relationship. A message whose purpose is to promote a product or service is an advertisement, and advertisements to cell phones generally need prior express written consent: a specific, affirmative opt-in to receive marketing texts.
That's the whole game. Same patient, same phone, two different permission slips.
The sentence that flips it
The trigger isn't the topic. It's whether you're selling something. Here's the test I give clinic staff: read the text and ask "is there an offer, a price, a discount, or a cross-sell in here?" If yes, it's marketing.
| Message | What it is | Consent needed |
|---|---|---|
| "Your 6-month cleaning is due. Reply to schedule." | Treatment / recall | Treatment relationship |
| "You're overdue for a visit, we'd love to see you." | Treatment / recall | Treatment relationship |
| "Overdue for a cleaning? Book in June and save $50." | Marketing | Express written marketing consent |
| "Schedule your checkup, and ask about our new whitening special!" | Marketing | Express written marketing consent |
| "New patient special: $99 exam + x-rays, this week only." | Marketing | Express written marketing consent |
Notice rows three and four start as legitimate recalls and get flipped by a tacked-on clause. That's the accidental crossing. The hygienist writes a clean recall, then someone in marketing "improves" it with a promo line to lift the response rate, and the whole send now needs a consent your lapsed-patient list may not have.
The gray zone, honestly
I won't pretend every message sorts cleanly. A few genuinely sit on the fence:
- "Flu shots are now available, book yours." Preventive care, or a service you're promoting? Regulators have generally treated healthcare messages about a patient's own care more leniently than retail ads, but the moment you add "walk-ins welcome, $0 with most insurance" you're leaning promotional. We dug into exactly this one in a reminder text and a 'book your flu shot' text.
- "We've added Saturday hours." Informational about the practice. Fine on treatment consent. Add ", book your overdue cleaning now and get a free electric toothbrush" and it's marketing.
- "Your balance of $120 is past due." Billing, not marketing. Treatment-adjacent, generally safe.
When you're unsure, the conservative call is cheap: treat it as marketing and send only to patients who opted into marketing. The expensive call is assuming treatment consent covers a promo and getting it wrong: TCPA statutory damages run $500 to $1,500 per text, and recall batches go out by the thousand.
The scope problem most clinics miss
Even a clean recall isn't a blank check. Consent is scoped to a relationship, and relationships lapse. A patient who hasn't engaged in three years may no longer have a current treatment relationship that a recall can lean on, which is a different failure mode than the marketing line, and one we covered in the consent a patient gave in 2022 may not cover your 2026 recall text.
So there are really two gates on a recall batch:
- Is the relationship still live enough to support treatment consent? (Scope / recency.)
- Does the message contain an offer that bumps it into marketing? (This post.)
A text can pass gate one and fail gate two, or vice versa. You need both green before a segment goes out.
How to keep the two lists from mixing
The operational fix is almost boring: maintain two consent states per patient and segment on them.
- Treatment consent, established at intake, covers reminders, recalls, results, scheduling.
- Marketing consent, a separate, affirmative opt-in to promotional texts.
Then your offer-bearing recalls only go to patients in the second bucket, and your plain recalls can go to the first. The temptation is to run everything off one opt-in because it's simpler. That one shortcut is the violation.
A few things I'd wire up regardless of platform:
- Record the attestation. When someone opts into marketing, capture when, how, and what they agreed to. In Ready, opt-in attestation is recorded for bulk and API sends, so you have an audit trail rather than a verbal "they said it was fine." Securing that consent cleanly is its own skill, proven tips for securing SMS consent covers the wording.
- Let STOP mean STOP, everywhere. Automatic opt-out handling should propagate across campaigns so a patient who opts out of promos can't be re-added to the next blast. Ready honors inbound STOP/UNSUBSCRIBE and carries it across campaigns.
- Enforce quiet hours. A recall that's perfectly consented and sent at 7:10 a.m. in the patient's timezone is still a problem. Ready holds sends outside permitted local hours based on the recipient's area, which matters more than people expect once a list spans timezones. (The multi-timezone version of this trap is its own headache: your 6 PM recall blast is illegal for a third of the list.)
A worked example on the money side
Say you've got 8,000 lapsed patients and you want to send a two-segment reactivation message. If you write it as a clean recall, no offer, you can send to everyone with live treatment consent. If you add "$50 off this month," you can only legally send to the marketing-opted-in subset, which for most clinics is far smaller, maybe 2,500.
On Ready Standard, a 2-segment message to 8,000 is 8,000 × 2 × ($0.02 + $0.0045), versus the same math on 2,500 for the promo version. The point isn't the dollar difference. It's that the offer doesn't just change the message, it shrinks your legal audience by 70%. Writing the promo line as reflex, then blasting the full list, is how a clinic texts 5,500 people who never consented to marketing.
The practical takeaway
Before a recall batch goes out, run the one-sentence test: is there an offer, a price, a discount, or a cross-sell in the body?
- No → treatment communication, send to patients with a live treatment relationship, mind quiet hours and scope.
- Yes → marketing, send only to patients who affirmatively opted into marketing, with the attestation on file.
Keep two consent states, segment on them, let opt-outs propagate, and let the platform enforce quiet hours so a timing slip doesn't undo a clean consent record. If you want annotated starting points, our 11 patient recall SMS templates are marked up for exactly this line.
If you're setting this up and want the consent-handling, STOP propagation, and quiet-hours enforcement to be the platform's job instead of yours, that's what Ready is built for, see how the pieces fit, or start sending when you're ready to wire it up. None of it makes you lawsuit-proof; compliance is still the sender's responsibility. It just removes the easy ways to trip.