Healthcare SMS compliance requirements: TCPA, HIPAA and consent

Healthcare SMS compliance requirements come down to four things: the right kind of consent for the kind of message, as little patient information in the text as the message needs, opt-outs honored every time, and a registered 10DLC campaign that matches what you send. Get those four right and most practices are in good shape. Get any one wrong and you can face carrier filtering, a TCPA claim or a HIPAA problem, sometimes from a single text.

This post is a working checklist for practices, clinics and the software teams that text on their behalf. It is not legal advice. TCPA and HIPAA both have edge cases that depend on your setup, so treat this as the list of questions to bring to your counsel, not the final answer. We make Ready, a texting platform, and we'll say where it helps and where it doesn't.

The healthcare SMS compliance requirements in one checklist

Here is the short version. Each item gets its own section below.

1. Classify every message as treatment and operations (reminders, prescription-ready notices, care instructions) or marketing (promotions, new services, "it's been a year, book a cleaning").
2. Collect consent that matches the class. Marketing needs prior express written consent. Reminders need consent too, just a different kind.
3. Store your own consent record per patient: when, how, the exact wording and where it was collected.
4. Keep PHI out of the message body. Use the minimum the patient needs to act on.
5. Honor STOP and its variants immediately, across every campaign and drip campaign.
6. Respect quiet hours in the patient's local time.
7. Register your brand and a 10DLC campaign whose use case matches what you actually send.
8. Scrub lists you didn't build yourself against DNC and known-litigator lists before sending.

TCPA consent: reminders and marketing are different animals

The TCPA treats automated texts to cell phones as calls. The rule that matters most for practices is that the level of consent depends on what the message does.

Treatment and operational messages

Appointment reminders, "your prescription is ready" notices, pre-visit instructions and lab-results-are-available alerts are generally treated more leniently than marketing. The FCC has carved out some room for healthcare messages, but the conditions are narrow. They cover things like what the message may say, how often you send, and whether the patient pays anything to receive it. Most practices meet the bar by getting the patient's mobile number at intake, along with a clear statement that the practice will text them about appointments and care. Because the exemption's details are specific, have counsel confirm your intake wording covers what you send.

Marketing messages

Anything that promotes a service, a discount, a new provider or a "come back in" recall that reads like a sales pitch is marketing. Marketing needs prior express written consent: a signed agreement (an e-signature or a checkbox works) that names your practice, says the patient agrees to receive marketing texts, says consent isn't a condition of treatment, and discloses message frequency and "msg & data rates may apply."

Where practices get caught

The common failure isn't sending marketing with no consent at all. It's mixing the two. A patient gives you a number for reminders, and six months later that number lands in a "spring teeth-whitening special" campaign. The reminder consent doesn't stretch to cover the promotion.

The per-text exposure is the reason this matters. A 2,000-patient promo sent on the wrong consent puts thousands of texts' worth of statutory damages on the table. Consent records are what decide whether that risk is theoretical or real.

Keep the record yourself

Your intake system or patient portal has to store the per-patient record: the timestamp, the exact consent wording shown, the form or page URL, and the method. Ready records the sender's opt-in attestation on each campaign you send and each API send that attests consent: who sent, to how many, and when. That gives you an audit trail of your sends. It is not a per-patient consent record, though, and a keyword reply doesn't create one. Your store has to keep that. Our guide on how to document SMS consent covers which fields hold up.

HIPAA: the minimum necessary rule in a 160-character box

The TCPA governs whether you may text. HIPAA governs what you may say. A fully consented text can still be a HIPAA problem if the body carries more protected health information (PHI) than it needs to.

What the minimum looks like

A reminder needs to tell the patient where to be and when. It rarely needs to say why.

• Too much: "Hi Maria, reminder of your follow-up for your HIV viral load test with Dr. Patel, Sat 3/14 at 2 PM."
• Enough: "Hi Maria, reminder of your appointment with Bright Family Health on Sat 3/14 at 2 PM. Reply C to confirm. Reply STOP to opt out."

Leave out diagnoses, test names, medications, procedure types and specialty department names that imply a condition. Our post on the four fields to never include in a message body goes through each field with rewrites.

Unencrypted SMS and patient preference

Standard SMS isn't encrypted end to end. HIPAA generally lets patients ask to be contacted by text, and practices commonly warn patients about the risk and record their preference. That's part of why the minimum-necessary habit matters: a text that carries no PHI is much less of a problem if it lands on a shared family phone.

BAAs and certifications

Some practices will want a business associate agreement with any vendor that touches PHI. Ready doesn't advertise HIPAA certification or a BAA, so don't assume one. Design your messages to stay PHI-free. If your counsel says your workflow needs a BAA, ask us in writing before you send anything, and choose your vendor based on the answer.

Opt-out handling: STOP is the floor, not the ceiling

Carriers and the TCPA both expect an opt-out to stop texts promptly. For a practice, that means every message stream: reminders, recalls and any marketing campaign.

What should happen when a patient replies STOP

• The opt-out takes effect right away, with no human in the loop.
• It carries across every campaign and drip campaign, not just the one the patient replied to.
• The patient gets one confirmation, then silence.

On Ready, inbound STOP and UNSUBSCRIBE are honored automatically, and the opt-out follows the contact so no other campaign can reach them. Sends to opted-out numbers are refused up front and aren't charged. GET /v1/opt-outs lists this account's opted-out contacts only, so before any other tool texts a number, check it with GET /v1/opt-outs/:phone (see the opt-out API docs).

The variants that slip through

Patients don't always type STOP. "Cancel," "quit," "please stop texting me" and "wrong number" all express intent. "Cancel" is especially tricky in healthcare because it can mean "cancel my appointment" or "cancel these texts." Route ambiguous replies to a person rather than guessing. We cover the patterns in opt-out variants carriers don't catch.

Opt-out is per channel unless you sync it

An SMS opt-out doesn't automatically stop your phone reminders or emails. Decide on a policy and sync it in your practice management system.

Quiet hours and timing

The TCPA and many state laws restrict when you can text, typically to daytime hours in the recipient's local time, and several states are stricter than federal rules. A practice with patients across time zones, or a telehealth group, can easily send at 9 AM Eastern and reach a California patient at 6 AM.

Ready checks permitted local hours based on the recipient's area. Campaigns, drip campaigns and automations wait up to 24 hours for the recipient's permitted window. A one-to-one, inbox or API text (bulk API included) is held only if the window opens within 6 hours; otherwise it is not sent, and you send it again later. A held text is charged only when it sends. That's a risk reducer, not a substitute for checking your state's rules.

10DLC registration for healthcare use cases

Carriers filter unregistered business texting on standard 10-digit numbers, so registration isn't optional. You register a brand (your practice's legal entity and EIN) and a campaign (what you send, with sample messages and your opt-in flow). Our 10DLC explainer covers the basics.

Match the use case to what you send

Healthcare practices usually need a notification or customer-care style campaign for reminders. A separate marketing campaign only makes sense if you actually send promotions. Registering "marketing" for reminders, or the reverse, can lead to rejection or throttling. Our use-case picking guide walks through the choice.

What reviewers look at in a healthcare submission

• Sample messages with no PHI. A sample that names a condition invites rejection and signals the wrong habit.
• An opt-in description that matches reality. "Patients provide their mobile number on the intake form and check a box agreeing to appointment texts."
• Opt-out and help language in at least one sample.
• A website that shows the practice and, ideally, the SMS terms.

What it costs on Ready

Registration runs in-app with no setup fee. The charge at submit is $25, which covers the first month. After that the monthly cost is $25 for registration + $2 per number. Most approvals take 2 to 7 days. Optional brand vetting ($79 Standard or $179 Enhanced, one-time) raises trust score and daily limits, but a single practice sending reminders rarely needs it.

A worked example: what a reminder program costs

Assumptions: a practice with 1,500 appointments a month sends one reminder per appointment, and about 40% of patients reply "C" to confirm. These are example numbers, not benchmarks.

The message: "Hi Maria, reminder of your appointment with Bright Family Health on Sat 3/14 at 2 PM. Reply C to confirm, STOP to opt out." That's about 125 plain characters, so it's 1 segment.

On Ready Standard ($0.0075/segment plus a $0.0045 carrier fee per segment):

• Outbound: 1,500 × 1 segment × $0.0075 = $11, plus 1,500 × $0.0045 in carrier fees
• Replies (billed like sent texts): 600 × $0.0075 = $5, plus 600 × $0.0045
• Registration: $25/mo for registration and $2/mo per number

That all-in figure excludes the compliance surcharge. DNC scrubbing and landline validation are each $0.003 extra per segment when switched on, and both are off by default.

The emoji trap: add a 📅 to that same reminder and the whole message switches to unicode, where a segment holds 70 characters (67 when split). At about 127 characters it becomes 2 segments, which doubles the outbound text cost to $23 plus carrier fees, for a calendar icon. Ready swaps curly quotes and long dashes for plain ones before sending, but it can't remove an emoji you chose to add.

To be honest about price: raw carrier APIs like Twilio, and GoHighLevel's LeadConnector, cost less per message. What you get with Ready is self-serve registration, built-in opt-out and quiet-hours handling, scrubbing, and an inbox in one place. Current numbers are on the pricing page.

Scrubbing: when a practice needs it

If every number came from your own intake forms, with consent, a litigator scrub matters less. It becomes worth it when a list came from somewhere else: an acquired practice, a merged patient database or a marketing list. Ready's standalone TCPA & DNC Litigator Scrub costs $0.005 per contact. It checks each number against known TCPA-litigator and DNC-complainer lists and flags matches. On 3,000 contacts that's $15, set against $500 to $1,500 of exposure per text. It reduces risk. It doesn't make anyone lawsuit-proof, and consent is still the real defense.

Frequently asked questions

Do appointment reminder texts need patient consent? Yes, though not the same written consent marketing needs. Reminders generally require that the patient provided their number for care communication. The FCC's healthcare carve-outs have specific conditions, so confirm your intake wording with counsel.

Can a medical practice send marketing texts to patients? Yes, with prior express written consent that's separate from treatment consent. The consent has to name your practice, cover marketing texts and say agreeing isn't a condition of care. Reminder consent doesn't carry over to promotions.

Is texting patients HIPAA compliant? Texting can be done in a HIPAA-conscious way, but no text is compliant on its own. Keep PHI out of the body, record the patient's preference to be texted and follow your counsel on whether your vendor setup needs a BAA.

What information should never be in a patient text message? Diagnoses, test or procedure names, medication names and anything that reveals a condition by implication. Stick to the practice name, date, time and a reply option. That's usually enough for the patient to act.

Does a healthcare practice need 10DLC registration? Yes, if you text from a standard 10-digit number, because carriers filter unregistered business traffic. Register your brand and a campaign whose use case matches what you send. Most approvals take 2 to 7 days.

The practical takeaway

Most of the risk sits in three habits: separating reminder consent from marketing consent, keeping PHI out of the text, and making opt-outs stick everywhere. Registration and quiet hours are mostly setup work you do once. Write your intake consent language first, then your message templates, then register the campaign so that its samples match both.

If you want to try this on Ready, sign up, send your first one-to-one test texts before you register, then submit your brand and campaign from the app. Have your counsel review the consent wording before the first campaign goes out.