Appointment reminder texts for medical and therapy practices: what HIPAA and the FCC's rules allow, with templates

An appointment reminder text is allowed under HIPAA, and it does not need to say much. The safe version gives the time, your practice's name and a way to reply, and leaves out what the appointment is for. The FCC's rules then decide how long it can be, how often it can go and how a patient stops it.

What HIPAA allows

HHS's answer is yes: the Privacy Rule lets health care providers contact patients at home, by mail, phone or other means, about appointments, and leave messages on an answering machine or with a family member. It asks providers to limit what a message reveals, for example by leaving only the practice's name and number and what is needed to confirm the appointment, or by asking the patient to call back.¹

Patients also have a say in how you reach them. A covered provider must let patients ask to receive communications by other means or at other places, and must accommodate reasonable requests.² A patient who does not want texts, or wants calls only on a work number, gets that.

HHS has not written separate guidance on texting. Its guidance on email says unencrypted email with patients is allowed with reasonable safeguards, such as limiting the type and amount of information sent, and that a patient who finds it unacceptable should be offered another way.³ Our recommendation is to treat a text the same way: assume anyone holding the phone may read it, and write it so that does not matter.

What the FCC's rules ask

Texts count as calls under the FCC's robocall rules. Two parts matter for reminders.

Consent from the number itself

In its 2015 order, the FCC said that a patient who gives a phone number to a healthcare provider has given prior express consent to healthcare calls from that provider, within the scope of the consent and unless the patient says otherwise.⁴ So the number on the intake form covers reminders. It does not cover marketing.

The healthcare text rule

The FCC's rules also exempt certain healthcare calls and texts to mobile numbers when they are free to the patient. Appointment and exam confirmations and reminders are on the list. The conditions are that each message:⁵

• goes only to the mobile number the patient gave you;
• states your practice's name and contact information;
• has no marketing, advertising, billing, debt collection or other financial content;
• is 160 characters or fewer for a text, and about a minute or less for a call;
• is no more than one a day and three a week, calls and texts together;
• lets the patient opt out by replying STOP, and the opt-out is honored immediately.

Outside that exemption, the general rule still applies: a patient can withdraw consent by replying "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe", and you have at most ten business days to honor it.⁵ Our vet reminders article covers those opt-out rules in more detail. Our recommendation is to write every reminder to the stricter healthcare limits. Then you never need to work out which rule a message falls under. This is a summary, not legal advice.

What to leave out of a reminder

Our recommendation, for the text, the voicemail and the message left with whoever answers:

• What the visit is for. No diagnosis, procedure, test or medication.
• What kind of care it is, where that gives it away. Write "appointment", not "therapy session", "infusion" or "follow-up for your results". Name the clinician only if their name does not reveal the specialty.
• Money. No balance, copay or payment link. Payment reminders are a separate message, and they fall outside the healthcare text rule.
• Anything the patient did not give you. A reminder goes to the number on file, never to a number found elsewhere.

The practice's name has to stay, because the FCC rule requires it. If your name says what you treat, that cannot be helped. Leave everything else out.

Templates you can copy

Each text below stays under 160 characters with a practice name of about 20 characters and a full phone number. Count yours after filling in the brackets.

The one confirmation text after a STOP is allowed as long as it only confirms the opt-out and carries no marketing; sent within five minutes, it is presumed to be fine.⁵ Therapy practices that state a cancellation notice period can add it to the reminder, as in our late-cancellation policy for therapists, as long as the text stays within 160 characters.

Ask once, at intake

Most reminder problems start with a number nobody checked. Add three questions to your intake form, as in our new-patient intake checklist:

• Which mobile number should appointment reminders go to?
• May we text that number about appointments? Yes or no.
• May we leave a voicemail at that number? Yes or no.

Note the answers in the patient's record, and let the reminder system read them, so a "no" is respected without anyone having to remember it.

What can run by itself

• The day-before text, from your scheduler, to the number and channel the patient chose at intake, at most once a day.
• Replies: a "C" marks the appointment confirmed, and an "R" lands with the front desk as a request to reschedule.
• Opt-outs, recorded the moment a patient replies STOP, with the single confirmation text and nothing after it.
• A weekly count per patient, so no one gets more than three reminders in a week, calls and texts together.

Reminders on their own do not end no-shows. What to do when a patient misses anyway is in our no-show policy article, and our front-desk automation guide covers the other jobs that can run by themselves.

What stays with your team

• The wording. Someone decides once what your reminders say, with your privacy officer, and checks it again whenever the scheduler changes.
• Patients with special requests. A patient who asked to be called only at work, or not at all, is handled by a person.
• Anything clinical. Preparation instructions, results and questions about care go through your clinicians, not through a reminder.

More of what we write for practices is on the blog, including how to ask patients for Google reviews without breaking HIPAA.

Questions practices ask