Most clinics that text patients don't run into trouble because they texted. They run into trouble because of what the text said. Sending "Reminder: your appointment Tuesday at 2:30 PM" is very different from sending "Reminder: your follow-up on your biopsy results Tuesday at 2:30 PM." The phone number, the consent and the carrier registration can all be in order, and the second message still puts protected health information on a lock screen that anyone in the room can read.
This post covers three things for practices that send reminders and handle replies: what belongs in a patient text and what doesn't, how consent works in practice, and which platform safeguards reduce your risk. It is not legal advice. HIPAA and the TCPA both turn on facts specific to your practice, so have your privacy officer or healthcare counsel review your templates and workflow before you go live.
The short version: design texts that carry almost no PHI
The safest HIPAA strategy for SMS is to keep the message body boring. Standard SMS is not end-to-end encrypted. Messages sit on carrier infrastructure and on the patient's phone, and they show up in notification previews. Plan as if anyone holding the phone can read every word.
Under HIPAA, PHI is health information combined with something that identifies the person. A phone number plus "your appointment" already ties a person to a provider. That linkage is unavoidable, so the job is to keep everything else minimal.
| Message element | Risk level | Guidance |
|---|---|---|
| Date and time of appointment | Low | Generally fine |
| Practice name (general practice, dental, family medicine) | Low | Usually fine |
| Practice name that reveals a condition (oncology, fertility, addiction treatment, HIV clinic) | High | Use a neutral sender name or a generic "your provider" |
| Provider's first name | Low to medium | Fine for most; avoid for sensitive specialties |
| Reason for visit, procedure name, test name | High | Leave it out |
| Diagnosis, lab values, medication names | High | Never in the body |
| Patient's full name plus date of birth | High | Not needed for a reminder |
| Link to a secure portal | Low | Preferred way to share anything clinical |
We cover the four fields that cause the most trouble in more depth in you can text a patient legally and still breach HIPAA in the message body. The rule of thumb: if the text would embarrass the patient when read aloud by a coworker, rewrite it.
A reminder template that passes the read-aloud test
Hi Dana, this is Northside Family Dental. Reminder: your appointment is Thu 3/12 at 2:30 PM. Reply C to confirm or R to reschedule. Reply STOP to opt out.
That is about 150 characters of plain GSM-7 text, so it is one segment. It contains no procedure, no provider specialty and no clinical detail. A specialty clinic would swap "Northside Family Dental" for a neutral name the patient will recognize, or for "your care team."
Two-way replies are where PHI leaks in
Outbound templates are easy to control. Inbound replies are not. Once you invite patients to reply, some of them will write "Can I still come in if my rash is worse?" or "Do I need to stop my blood thinner before the procedure?"
You can't stop a patient from typing PHI. What you control is how your staff responds:
- Keep the reply short and move clinical content to a safer channel. For example: "Thanks for letting us know. A nurse will call you shortly." Then make the call.
- Don't repeat or expand on what the patient wrote. If they name a medication, your reply shouldn't name it back.
- Limit inbox access. Only staff who would see that information in the chart should see the Inbox.
- Write an internal policy covering who answers texts, how fast, and when to switch to a phone call or the patient portal.
On Ready, inbound replies land in the Inbox next to the outbound thread. Replies are billed like a sent text: the $0.0075 per-segment rate plus the $0.0045 carrier fee. Include them in your budget, which we work through below.
Consent: two separate questions
Clinics often treat consent as one checkbox. It is really two questions under two different laws.
TCPA consent (can you text this number at all?) The TCPA governs automated texts to cell phones. Appointment reminders to patients who gave you their number are generally treated more favorably than marketing. Still, the clean approach is an explicit opt-in at intake that names text messages, gives a rough idea of frequency, and explains how to opt out. Penalties for TCPA violations run roughly $500 to $1,500 per text, so a sloppy intake form gets expensive when multiplied across a patient list.
HIPAA communication preference (does the patient accept the risk of unencrypted texts?) HHS guidance has generally allowed providers to communicate with patients over unencrypted channels when the patient prefers it and has been told about the risks. Many practices add a line to intake such as: "Text messages are not encrypted and may be seen by others with access to your phone." Have counsel confirm the exact wording for your practice.
Where the consent record lives
You need to know which system stores what. Ready records the sender's opt-in attestation on each bulk send and each API send that sets consent_attested: who sent it, to how many recipients, and when. That creates an audit trail showing your practice attested to consent at send time. It is not a per-contact consent record. Ready does not store each patient's opt-in date, wording or form URL, and a keyword reply does not create one. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)
The per-patient record belongs in your EHR or intake system: the signed form, the timestamp and the exact language. We walk through the mechanics in patient consent to receive text messages.
Platform safeguards that reduce risk
No texting platform makes a practice "HIPAA compliant" by itself. Compliance depends on your policies, your templates and your agreements. If your workflow requires any PHI in message bodies, you need a business associate agreement (BAA) with every vendor that handles it, and your counsel should review it. Don't assume any SMS vendor signs one, us included. Email support@tryready.com and ask before you design a workflow around PHI in texts.
The safeguards below are the ones Ready runs at the sending layer. They reduce the most common ways clinic texting goes wrong.
Automatic STOP handling
When a patient replies STOP or UNSUBSCRIBE, Ready honors it and the opt-out applies across every campaign on the account. A patient who opts out of recall texts won't get the next reminder by mistake. Opted-out numbers are refused before sending and you aren't charged for them. You can check status through GET /v1/opt-outs/:phone (opt-out docs).
Quiet hours
Sends are held outside permitted local hours based on the recipient's area. If a reminder batch fires at 10 PM because of a scheduling mistake, a reminder sent from a Ready campaign or drip waits until morning instead of waking patients. A one-to-one or API text is held only if sending reopens within 6 hours; otherwise it is refused and you send it again. You're charged only when a text actually sends.
Landline validation and DNC scrubbing
Older patient lists contain a lot of home phones. Texting a landline wastes money and tells you nothing about delivery. Ready refuses numbers it already knows are landlines on every account, at no charge. Landline validation, which looks up the rest, and DNC/litigator scrubbing each cost $0.003 extra per segment when switched on, and both are off by default. Turn them on deliberately. We cover this in validating numbers before a recall run. A standalone scrub of a list before a send is also available at $0.005 per contact.
10DLC registration matched to what you send
Unregistered business texting gets filtered by carriers. Ready handles brand and campaign registration in-app, and most approvals take 2 to 7 days. There's no setup fee. You pay $25 at submit for the first month, then $25/mo for registration and $2 per number.
Register for the use case you actually run. Reminders and confirmations are not marketing, and picking the wrong category causes problems later. See matching use-case to what you actually send.
What an API reminder looks like
If your scheduling system triggers reminders itself, a single send is one request:
POST https://api.tryready.com/v1/messages
X-API-Key: <your key>
Idempotency-Key: 6f1c2a9e-3b7d-4e1a-9c55-2d8f0b4a7e13
{
"to": "+12125550199",
"body": "Hi Dana, this is Northside Family Dental. Reminder: your appointment is Thu 3/12 at 2:30 PM. Reply C to confirm or R to reschedule. Reply STOP to opt out.",
"consent_attested": true
}The Idempotency-Key header prevents a retried request from sending the reminder twice. A duplicate reminder annoys patients and costs you a second segment. consent_attested: true is your promise that this patient agreed to receive texts, so set it only when your intake record backs it up. For daily batches, POST /v1/messages/bulk takes up to 100 recipients per call (docs).
Worked example: what reminders cost
Assumptions (an example, not a benchmark): a practice with 2,000 appointments a month, one reminder each, written in plain text at under 160 characters, so one segment. We assume about 60% of patients reply C or R. That's an assumption for the example, not a measured rate.
- Outbound: 2,000 × 1 segment × $0.0075 = $15 in per-segment charges plus 2,000 × $0.0045 in carrier fees
- Inbound replies: 1,200 × 1 segment × $0.0075 = $9 plus 1,200 × $0.0045
- Registration: $25/mo for registration and $2/mo per number
Ready's all-in prices per segment include the carrier fee but not screening: Scrub lists and Number validation, the two switches in Settings under Compliance, each add $0.003 per segment when switched on, shown as screening on your bill, and both are off by default. Unless you turn the opt-out footer off, the first text to each contact, and one again from time to time, also gets "Reply STOP to opt out" and your business name if the message does not already have them, so a text close to the segment limit can bill one more segment.
The emoji tax. Suppose someone adds a 🦷 to that 150-character reminder. Any emoji switches the whole message to unicode, which caps segments at 70 characters (67 when the message splits). The reminder becomes 3 segments, and 2,000 reminders become 6,000 billable segments. Leave emojis out of reminder templates.
Raw carrier APIs such as Twilio, and GoHighLevel's LeadConnector, charge less per message than Ready Standard. If you have engineers and only need a send pipe, they're a reasonable choice. What Ready adds is the registration flow, STOP propagation, quiet hours, the scrub and validation options, and the two-way inbox in one place.
Before your first send: a checklist
- Intake form names text messages, frequency and opt-out, and includes an unencrypted-channel risk notice approved by counsel
- Per-patient consent stored in your EHR or intake system
- Templates pass the read-aloud test, with no procedures, diagnoses, medications or condition-revealing sender names
- Staff policy for answering replies and moving clinical questions to the phone or portal
- BAA question settled with counsel and vendors if any PHI will appear in texts
- 10DLC campaign registered for reminders, not marketing
- Landline validation switched on (or not) as a deliberate choice
Texting reminders works well for clinics when the messages are deliberately plain and the consent records live where your auditors expect them. If you want to try the workflow, sign up and use your first 20 free one-to-one texts to test your templates on staff phones before you register. Then bring the finished templates to your compliance review.