Patient consent to receive text messages: how to get and record it

You get patient consent to receive text messages by asking clearly, in writing on the intake form or out loud at the front desk, for a specific purpose, and then saving a record of who agreed, when, how and to what. Keep consent for appointment and care texts separate from consent for marketing, and honor STOP immediately across every message type.

The rest of this post covers the details: wording you can adapt, a front desk script, the fields your record needs, and what happens when a patient opts out. This is not legal advice. TCPA, HIPAA and state rules interact in ways that depend on your practice type and state, so have counsel review your final language. What follows is the operational side, and that is usually where practices actually go wrong.

Why consent matters twice: the law and the carriers

Consent does two separate jobs, and practices often only think about one of them.

The legal job. The TCPA restricts automated texts to mobile numbers without the recipient's consent. Statutory damages run $500 to $1,500 per text. The FCC has carved out some room for certain healthcare messages, such as appointment reminders and similar care-related texts from HIPAA-covered entities, but only under specific conditions about content, frequency and cost to the patient. Marketing texts get no such room. They need prior express written consent, and that consent can't be a condition of receiving care. Our healthcare SMS compliance requirements post goes through how TCPA and HIPAA overlap.

The carrier job. Even where the law gives you some leeway, carriers don't. To send from a standard local number you register an A2P 10DLC brand and campaign, and the campaign registration asks you to describe how recipients opt in. If your description is vague ("patients agree to texts") or doesn't match what you actually send, the campaign can be rejected, or approved and then filtered. The opt-in wording that clears 10DLC registration post covers what reviewers look for.

So a reminder text that might be legally defensible without explicit written consent can still get filtered if you can't describe a real opt-in flow. Asking explicitly fixes both problems.

Writing intake form language that holds up

The intake form is the best place to collect consent. It's written, it's signed or submitted with a timestamp, and every new patient fills one out.

What the wording needs

Good consent language for a practice covers six things:

1. Who is texting. Use the practice name as patients know it, not the legal entity alone.
2. What kind of texts. Appointment reminders, confirmations, care follow-ups, billing notices. Be specific.
3. Roughly how often. "Message frequency varies" is acceptable. "Up to 4 messages per appointment" is better.
4. Costs. "Message and data rates may apply."
5. How to stop. "Reply STOP to opt out, HELP for help."
6. The number being consented. Have the patient write the mobile number on the same line, not pull it from another field.

Example: care and appointment texts

☐ I agree to receive text messages from Lakeside Family Dental at the mobile number below about appointment reminders, confirmations, scheduling changes and billing notices. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Consent is not required to receive care.

Mobile number: ______________

Example: marketing texts, as a separate box

☐ I also agree to receive promotional text messages from Lakeside Family Dental, such as recall specials and new service announcements, at the mobile number above. Up to 4 messages per month. Message and data rates may apply. Reply STOP to opt out. Consent is not a condition of any purchase or treatment.

Use two checkboxes, both unchecked by default. A pre-checked box, or one box covering both care and marketing, is the most common mistake on healthcare intake forms. It also makes your consent record ambiguous later, when a patient says they only agreed to reminders.

Version your wording

Give each version of the language an ID or date ("SMS-consent-v3, March 2026"). When you edit the form, the old version doesn't disappear from your records. You need to be able to show exactly what text a patient saw when they checked the box two years ago.

Verbal consent at the front desk

Plenty of patients never touch a form. They call to book, or they walk in and someone updates their file. Verbal consent can work for care texts, but only if you capture it the same way every time.

A front desk script

"Would you like appointment reminders by text at this number? We'll text about your appointments and billing, and you can reply STOP anytime to stop. Message and data rates may apply."

If the patient says yes, the staff member records it right then. Not at the end of the shift, and not from memory.

Follow verbal consent with a confirmation text

A spoken "sure" is the weakest form of consent you can hold. Strengthen it by sending one confirmation text right away:

"Lakeside Family Dental: You're signed up for appointment texts. Msg frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help."

This gives the patient a written record of what they agreed to, a clear way out, and a timestamped message in your system. If they reply STOP, you've learned that before the first reminder goes out rather than after.

Treat verbal consent as covering care and appointment texts only. For marketing, get written consent. That can be the intake form box, a web form, or a keyword reply that your system logs together with the disclosure the patient saw.

What a consent record should contain

A consent record answers one question months or years later: can you show this patient agreed to this type of message at this number? These are the fields to store per patient, per consent type:

Store this in your practice management system or EHR, in a field your texting tool can read, or in a consent log you export regularly. Many practices keep consent records for at least four years, which matches the general federal limitations period for TCPA claims. Ask counsel whether your state calls for longer.

Our post on how to document SMS consent so it holds up covers storage and retention in more depth.

What your texting platform records, and what it doesn't

We make Ready, so here is exactly what Ready keeps and what stays your job.

Every campaign you send and every API send that attests consent in Ready records the sender's opt-in attestation: who sent, to how many contacts, and when. Over the API, set the consent_attested field on each send; it is your statement that the recipient agreed to receive texts, and a send without it records no attestation. That builds an audit trail of your sending decisions.

It is not a per-patient consent record. Ready doesn't store the date a patient checked the box, the wording they saw, or the form they used, and a keyword reply doesn't create one. That record lives in your intake system. In practice, the practice keeps the "why we're allowed to text this person" record, and the platform keeps the "who sent what, when" record plus the opt-out list. You need both. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)

Keep appointment consent and marketing consent apart

This is the part most practices skip. The two consent types differ in legal basis, carrier treatment and patient expectations.

Separate checkboxes. Covered above. One box per purpose.

Separate lists or tags. In your texting tool, tag contacts by consent type. A recall-special campaign should only be able to reach contacts tagged for marketing. If the list is built by "everyone with a mobile number," you will eventually text marketing to patients who only agreed to reminders.

Separate 10DLC campaigns when the mix calls for it. Carriers register campaigns by use case. If you only send reminders and billing notices, register for that use case. If you also send promotions, that's a different use case with different sample messages and a different opt-in description. Registering reminders as marketing, or slipping promos into a reminder campaign, is a common cause of filtering. Registration on Ready runs $25/mo for registration, and most approvals take 2 to 7 days.

Keep promotions out of reminder texts. "Your cleaning is Tuesday at 9 AM. Ask about 20% off whitening!" turns a care message into a marketing message. The FCC healthcare carve-out depends on the message being about care, not upsells.

Keep PHI out of every message body. Consent to text is not consent to put diagnoses or treatment details in an SMS. "Reminder: appointment Tuesday at 9 AM. Reply C to confirm." is enough. Our healthcare SMS compliance post lists what to leave out.

Worked example: what the opt-out line costs

Assumptions: 3,000 reminder texts a month, standard GSM characters, no emoji.

Suppose your reminder is 145 characters. Adding "Reply STOP to opt out" (22 characters with the leading space) brings it to 167. That is over the 160-character limit for one segment, so the message splits into 2 segments of up to 153 characters each.

• Before: 3,000 × 1 segment = 3,000 segments
• After: 3,000 × 2 segments = 6,000 segments
• Extra cost on Ready Standard: 3,000 extra segments × ($0.0075 + $0.0045)

Ready's all-in prices per segment include the carrier fee but not screening: Scrub lists and Number validation, the two switches in Settings under Compliance, each add $0.003 per segment when switched on, shown as screening on your bill, and both are off by default. Unless you turn the opt-out footer off, the first text to each contact, and one again from time to time, also gets "Reply STOP to opt out" and your business name if the message does not already have them, so a text close to the segment limit can bill one more segment.

That's 3,000 × $0.0075 = $23 a month in rate alone, plus the carrier fee on each extra segment. The fix is to trim the reminder, not drop the opt-out line. "Lakeside Dental: appt Tue 3/10 at 9 AM. Reply C to confirm, R to reschedule. STOP to opt out" fits in one segment. One emoji would switch the message to the 70-character unicode limit and push it to 2 or 3 segments anyway, so leave emoji out of reminders.

Handling STOP and other opt-outs

Consent can be revoked at any time, by any reasonable means. Your system has to keep up with that.

STOP should work instantly and everywhere. On Ready, inbound STOP and UNSUBSCRIBE are honored automatically, and the opt-out applies across every campaign, so a patient who stops reminders can't be pulled back into a recall campaign by someone building a new list. Sends to opted-out numbers are refused before they go out and aren't charged.

Patients don't always type STOP. They write "cancel," "please stop texting me," or "wrong number." Ready opts a patient out on STOP, CANCEL and the other standard keywords, and on phrases such as "please stop texting me." A reply like "wrong number" isn't an opt-out, so it needs a person. Have someone review inbound replies daily and manually opt out anyone asking to stop. The post on opt-out variants carriers don't catch lists the common phrasings.

Send the opt-out back to your records. If a patient opts out by text, your EHR or practice management system should reflect it, or the front desk may re-enroll them at the next visit. Over the API, GET /v1/opt-outs lists the opted-out contacts on this account. It leaves out a STOP from a deleted contact, a dialer do-not-call entry and a STOP held on another account of the same family, so before a send from another tool, check the number with GET /v1/opt-outs/:phone. See the opt-outs API docs.

Front desk opt-outs count too. "Stop texting me" said at checkout is a revocation. Log it with the date and staff initials, and add the number to your opt-out list that same day.

Quiet hours. Unrelated to consent, but closely related to complaints: Ready checks permitted local hours based on the recipient's area. Campaigns, drip campaigns and automations wait up to 24 hours for the recipient's permitted window. A one-to-one, inbox or API text (bulk API included) is held only if the window opens within 6 hours; otherwise it is not sent, and you send it again later. A held text is charged only when it actually sends. A 6 AM reminder from a busy scheduling queue is how a consented patient turns into an annoyed one.

The short version

• Ask explicitly: intake form checkbox, or a scripted verbal ask plus a confirmation text.
• Use two unchecked boxes, one for care texts and one for marketing.
• Record number, type, timestamp, method, wording version and who captured it. Keep those records for years.
• Tag contacts by consent type so marketing can only reach marketing-consented patients.
• Honor STOP and its plain-language variants everywhere, and sync opt-outs back to your records.

If you're setting up texting for a practice, write the consent language first, then register a 10DLC campaign that describes it accurately. Ready includes registration in-app, automatic opt-out handling and quiet hours. Your first 20 one-to-one texts are free, so you can test your confirmation message before you pay for registration. You can sign up here when you're ready.

Frequently asked questions

Do I need written consent to text patients appointment reminders? Not always under the TCPA, but written consent is the safer default. The FCC allows certain healthcare messages under specific conditions, but carriers still expect a documented opt-in for 10DLC registration. A checkbox on the intake form covers both.

Can one checkbox cover appointment reminders and marketing texts? It shouldn't. Marketing texts need prior express written consent that isn't a condition of treatment, and bundling the two makes your record ambiguous. Use two separate, unchecked boxes.

Is verbal consent at the front desk enough to text a patient? It can be enough for care and appointment texts if you record it right away with a date, time, wording and staff initials. Follow it with a confirmation text that explains how to opt out. For marketing texts, get written consent.

How long should a medical practice keep SMS consent records? Many practices keep them at least four years, which matches the general federal limitations period for TCPA claims. Some states may require longer, so confirm with counsel. Keep the wording version alongside each record.

What should happen when a patient replies STOP to an appointment reminder? Stop all texts to that number right away, across every campaign, and send a single confirmation of the opt-out. Then update the patient's record in your EHR or practice management system so staff don't re-enroll them. Treat "cancel" or "stop texting me" the same way.