A patient fills out your intake form, checks the box that says "I agree to receive appointment reminders and communications about my care," and books a cleaning. Three weeks later, that same patient gets a text: "🦷 Spring Whitening Special — $99 through Friday! Book now."
The clinic that sent it thinks it's covered. The intake form said "communications," right? That's the exact assumption that puts practices on the wrong side of the TCPA — and it has almost nothing to do with HIPAA, which is the framework most clinics are actually worried about.
Full disclosure: I work for Ready, an SMS platform with 10DLC and opt-out handling built in. I'm going to explain where the consent line sits and how to keep your sends on the right side of it. Some of that involves things Ready automates, and I'll be specific about which. None of it makes you lawsuit-proof — compliance is ultimately on the sender.
Two different laws are watching two different things
The confusion starts because clinics treat "can I text this patient?" as one question. It's two.
HIPAA governs the content — whether the message discloses protected health information, and whether your vendor will sign a BAA. HIPAA does not care whether the patient wanted a promo. It cares that you didn't leak a diagnosis. (If you want the content side, we covered the 4 fields to never put in a message body.)
The TCPA governs the permission to send — specifically, whether you had the right kind of consent before an automated marketing text hit their phone. TCPA doesn't care what's in the message from a privacy standpoint. It cares whether it's marketing and whether the patient agreed to receive marketing.
A whitening promo can be perfectly HIPAA-clean — no PHI, no diagnosis, nothing sensitive — and still be a TCPA violation, because the patient never gave marketing consent. That's the gap. You cleared the wrong hurdle.
Treatment-contact permission ≠ marketing consent
Here's the distinction that intake forms blur.
When a patient books a visit, they've given you permission to contact them about that treatment relationship. Appointment reminders, recall notices, "your results are ready," pre-op instructions, a nudge that they're overdue for a cleaning. These are treatment-related. Under the TCPA these largely fall into a healthcare-message carve-out, and courts have generally treated the act of giving you your number to book care as consent to be contacted about that care.
Marketing is a separate universe. A whitening special, a "refer a friend" promo, a "we now offer Botox" announcement, a flu-shot campaign framed as a limited-time offer — those require prior express written consent for marketing. The patient has to have knowingly agreed to receive promotional messages, not just messages.
We drew this exact line in more detail in A Recall Text and a Promo Text Need Different Consent — worth reading if recalls are a big part of your sends, because recalls sit right on the boundary depending on how you word them.
The one-sentence test I use: would the patient reasonably expect this text as part of getting care, or is it something you're selling? If it's the second one, you need marketing consent, full stop.
Where clinics actually cross the line
Almost nobody sits down and decides to send unconsented marketing. They cross the line by accident, in one of these ways:
- One opt-in, two purposes. The intake checkbox covers reminders. The practice then loads every patient into a marketing blast because "they're already opted in." One consent, two purposes — that's the violation. We wrote a whole piece on why a reminder and a "book your flu shot" text sit on opposite sides of the wall.
- Vague consent language. "I agree to receive communications" is broad enough that it covers nothing cleanly. It doesn't name marketing, doesn't name the sender, doesn't mention frequency or STOP.
- Reactivation campaigns to old patients. A patient from 2019 who hasn't been back is a marketing target, not an active treatment relationship. Texting them a promo is a cold marketing send in everything but your own head.
- Treating a phone field as consent. Collecting a number is not the same as agreeing to be texted marketing. (Same mistake donation forms make — adding a phone field isn't consent.)
Annotating consent language that actually holds
Here's a treatment-only intake line and a marketing line, annotated so you can see what each one does and doesn't cover.
Treatment-contact (intake form):
"I agree to receive text messages from [Practice Name] about my appointments, care, and account. Message and data rates may apply. Reply STOP to opt out."
- ✅ Names the sender.
- ✅ Scopes it to appointments/care/account — treatment, not promotion.
- ✅ Includes STOP.
- ❌ Does not authorize marketing. Don't stretch it.
Marketing consent (separate, unchecked checkbox):
"☐ I'd like to receive promotional offers and health tips from [Practice Name] by text. Consent isn't a condition of treatment. Msg frequency varies. Msg & data rates apply. Reply STOP to cancel, HELP for help."
- ✅ Explicitly says promotional.
- ✅ Separate, pre-unchecked box — it can't be bundled into the treatment agreement or pre-ticked.
- ✅ States consent isn't required to receive care (this line matters legally).
- ✅ Frequency + STOP + HELP.
The structural rule: marketing consent must be its own affirmative action. If unchecking the marketing box would still let the patient book their appointment, you've built it right.
The automation that keeps it clean once consent is split
Splitting consent on paper only works if your sending system respects the split. That's mostly plumbing:
| Control | What it does | Why it matters here |
|---|---|---|
| Separate 10DLC campaigns | Register your reminder traffic and your marketing traffic as distinct use cases | A "marketing" campaign that sends reminders — or the reverse — gets throttled or silently dropped |
| Automatic STOP handling | Inbound STOP/UNSUBSCRIBE is honored and propagated so the contact can't be messaged again | A patient who opts out of marketing shouldn't fall through to another list |
| Quiet-hours enforcement | Sends held outside permitted local hours for the recipient's area | Your 6 PM recall blast is illegal for the patients a timezone over |
| Consent/attestation capture | Records opt-in attestation for bulk sends, building an audit trail | If a patient disputes consent, you can show which box they checked and when |
Ready handles STOP, quiet hours, and consent attestation automatically, and runs 10DLC brand + campaign registration in-app (roughly ~$10/mo per brand, ~$20/mo per campaign in carrier fees, approval typically 1–3 days). For connected GoHighLevel accounts, all of this maps per location, so a multi-location dental group keeps each site's consent and opt-outs isolated.
One honest caveat on STOP: carriers only catch the standard keywords. If a patient replies "cancel" or "no more texts" instead of "STOP," that's a variant your system needs to catch too — we covered the opt-out words carriers miss.
A worked example, because the money is small and the exposure isn't
Say you've got 3,000 active patients and you want to run a whitening promo. Message: "🦷 Spring Whitening — $99 through Friday. Reply BOOK or call us. Text STOP to opt out." The emoji drops you to a 70-char unicode limit, so that ~95-char message is 2 segments.
- 3,000 × 2 segments × ($0.02 + $0.0045 carrier) = ~$147 on Ready's Standard tier.
Now the other side of the ledger. TCPA statutory damages run $500 to $1,500 per text. If even 200 of those 3,000 patients never gave marketing consent — because you sent to your whole active list off a treatment-only intake box — that's $100,000 to $300,000 of theoretical exposure on a $147 send.
That math is why splitting consent isn't paperwork for its own sake. And why the litigator/DNC scrub at $0.005/contact — screening the people most likely to actually file — is one of the cheapest insurance policies in the stack: scrubbing all 3,000 costs $15.
The practical takeaway
- A booked visit gives you treatment-contact permission, not marketing consent. They're governed by different laws for different reasons.
- HIPAA is about the message content; TCPA is about whether you had the right to send it. Clearing one doesn't clear the other.
- Marketing consent has to be a separate, affirmative, pre-unchecked opt-in that says the word promotional and states consent isn't a condition of treatment.
- Register reminder traffic and marketing traffic as separate 10DLC campaigns, and let STOP, quiet hours, and consent capture run automatically so the split you drew on paper is enforced on send.
If you want to see how the two-campaign split and automatic opt-out handling look in practice — or you're moving a multi-location group onto cleaner rails — you can read more about Ready or start with 2,500 free credits, no card required. Either way, split your consent before your next promo goes out. The form change costs nothing; the blast that skips it can cost a lot.