Here's a mistake I've watched a lot of practices make, and almost none of them realize they made it until something goes wrong. A patient books an appointment. Somewhere in the intake form, there's a checkbox: "I agree to receive text messages." They check it. Now the front desk feels free to text them appointment reminders and the "Flu shots are here — book yours today!" blast that goes out every October.
Those two texts are not the same kind of message, and that single checkbox did not authorize both of them.
Full disclosure: I work for Ready, an SMS platform, so I have skin in this game. But the distinction I'm about to walk through isn't a Ready thing — it's a TCPA and HIPAA thing that applies no matter who sends your texts. Getting it wrong is what turns a routine October promo into a demand letter.
The consent wall runs right through your patient list
There are two separate categories of texting consent in healthcare, and they're governed by different rules.
Treatment/operational consent covers the messages a patient reasonably expects because they're getting care from you: appointment reminders, "your lab results are ready," pre-op instructions, a nudge to reschedule a missed visit. Under TCPA, these informational messages tied to an existing relationship carry a lighter consent burden. Under HIPAA, they're treatment/healthcare-operations communications, which don't require separate marketing authorization.
Marketing consent covers messages designed to get the patient to buy something or come in for a service they didn't ask about: the flu shot blast, a Botox promo, "refer a friend and get $50 off," a reactivation campaign for patients you haven't seen in a year. These are promotional. TCPA treats promotional texts as requiring prior express written consent — a higher bar than operational messages. HIPAA layers on top: most marketing communications require the patient's specific authorization.
The wall between them is exactly where practices trip. A patient who agreed to appointment reminders did not agree to marketing. Sending the flu-shot blast to your full reminder list means you're marketing to people who never opted into marketing.
Why one opt-in doesn't stretch to cover both
The logic people use is understandable: "They said yes to texts, so texts are fine." But consent in this world is scoped to what the person actually agreed to.
Think about it from the patient's side. When you confirm an appointment and check "yes, text me reminders," you're consenting to this relationship's logistics. You are not consenting to receive promotional offers on your phone, and courts and regulators have been consistent that promotional intent changes the consent requirement.
The exposure isn't theoretical. TCPA statutory damages run $500 to $1,500 per text. A single "Book your flu shot!" blast to 4,000 patients who only opted into reminders is, in the worst case, 4,000 violations. You don't need to imagine that math to decide it's worth structuring consent correctly.
And here's the part that stings: the fix is nearly free. It's a form-design problem, not a technology problem.
What a compliant two-checkbox opt-in actually looks like
The cleanest pattern I've seen is two distinct, separately-checkable consent statements. Not one combined checkbox. Not a pre-checked box. Two affirmative, granular opt-ins.
Here's the language pattern, adapted to your practice:
Checkbox 1 — Treatment/operational
☐ I agree to receive text messages from [Practice] about my appointments, care instructions, and account. Message and data rates may apply. Reply STOP to opt out.
Checkbox 2 — Marketing
☐ I agree to receive promotional and marketing text messages from [Practice] about services, offers, and health campaigns. Consent is not a condition of treatment. Message and data rates may apply. Reply STOP to opt out.
Three details that matter:
- "Consent is not a condition of treatment" goes on the marketing box. You cannot make care contingent on someone accepting marketing — that line makes it explicit.
- Neither box is pre-checked. Prior express written consent means the patient affirmatively acts. A pre-checked box isn't affirmative.
- You store the two answers separately with a timestamp and the exact language shown. That's your audit trail if anyone ever asks what this patient agreed to and when.
Most patients will check both. That's fine — you now have documented, scoped consent for each stream, and you can text them accordingly.
Map consent to how you actually send
Once you've split consent at intake, you have to keep it split at send time. This is where the platform matters, because a compliant form is useless if your sending tool can't respect the two audiences.
| Message type | Consent required | Sends to | Example |
|---|---|---|---|
| Appointment reminder | Treatment/operational | Everyone who checked box 1 | "Reminder: Dr. Lee, Tue 2pm. Reply C to confirm." |
| Results-ready notice | Treatment/operational | Box 1 | "Your results are in — call us or reply to schedule." |
| Reschedule nudge | Treatment/operational | Box 1 | "We missed you Tuesday. Reply to rebook." |
| Seasonal service promo | Marketing | Only box 2 | "Flu shots are in — book online: [link]" |
| Reactivation campaign | Marketing | Box 2 | "It's been a year — time for your cleaning?" |
| Referral offer | Marketing | Box 2 | "Refer a friend, both get $25 off." |
The two-way reminder messages usually run through your CRM automations. In Ready, inbound replies land in a conversations inbox — and for practices on GoHighLevel, they sync two-way into GHL mapped per location, so a multi-provider group keeps each clinic's patients isolated. If you run multiple sub-accounts and are wrestling with how many 10DLC registrations that implies, this breakdown on consolidating GHL sub-account registrations covers where consolidation helps and where it backfires.
The marketing blasts run as bulk campaigns to the box-2 segment only. The discipline is: never let a bulk promotional campaign target the operational list.
The compliance stack that backs the form up
A good consent form is the foundation. A few automated guardrails keep an honest mistake from becoming a violation.
- Automatic STOP handling. When a patient texts STOP, the opt-out propagates — they can't be messaged again across campaigns, not just the one they replied to. If someone opts out of marketing by replying STOP to a promo, you want that honored everywhere.
- Quiet-hours enforcement. Texts held outside permitted local hours based on the recipient's area. Healthcare sends at 9pm read as careless; the platform just holds them.
- Consent/attestation capture. For bulk and API sends, opt-in attestation is recorded, which builds the audit trail that matters if the two-consent structure is ever questioned.
- Litigator and DNC scrubbing. Known TCPA-litigator and DNC numbers can be screened before a marketing blast goes out. As a standalone product it's $0.005 per contact — a 4,000-contact scrub is $20 to suppress the numbers most likely to sue over an unwanted promo.
None of this makes you lawsuit-proof, and I won't pretend otherwise. Consent is ultimately the sender's responsibility — the platform reduces exposure and enforces the good habits, but you own the form design and the decision about which list gets which message.
A worked example, end to end
Say you're a three-location dental group texting 8,000 active patients. At intake, 8,000 checked box 1 (reminders); 5,200 also checked box 2 (marketing).
Your October flu-shot-equivalent — a cleaning-reminder promo — goes to the 5,200 marketing-consented patients, not all 8,000. Message: "Time for your fall cleaning? Book online: [link]" — about 55 characters, one GSM-7 segment.
- Scrub 5,200 contacts first: 5,200 × $0.005 = $26.
- Say scrubbing suppresses ~150 risky numbers, leaving 5,050 sends.
- 5,050 segments × ($0.02 + $0.0045 carrier) on Standard = 5,050 × $0.0245 = $123.73.
So roughly $150 all-in for a compliant seasonal campaign, sent only to people who agreed to hear from you. The 2,800 patients who wanted reminders but not marketing never got the promo — and that's not lost revenue, it's avoided exposure. If they wanted the cleaning, they'll get their operational reminder anyway.
Your appointment reminders, meanwhile, keep flowing to all 8,000 under operational consent, running as two-way automations so a "C" reply confirms the slot.
The practical takeaway
The gap isn't in your technology. It's in the assumption that one checkbox does the work of two. Appointment reminders and promotional blasts sit on opposite sides of the consent wall — treatment consent versus marketing consent — and TCPA plus HIPAA both treat the difference as real.
Fix it at the form: two separate, unchecked opt-ins, stored with timestamps and the exact language. Then respect the split at send time — operational list gets reminders, marketing list gets promos, and never the two combined. Let STOP handling, quiet hours, and a cheap pre-send scrub carry the rest.
If you're rebuilding your intake flow and want the sending side to keep the two lists honest — separate segments, propagated opt-outs, recorded attestation — that's the part Ready is built to handle. You can start with 2,500 free credits, no card required, and test a properly-scoped campaign against a real segment before you commit to anything.