10DLC, toll-free and short code registration for practice texting

A practice signs up for a texting platform, loads its patient list and finds that its first reminders never arrive, or that the platform will not send anything until a registration form is approved. That form is the wireless industry’s gate for business texting. It asks who you are, what you will send and how patients agreed to receive it, and a thin or careless answer can mean rejected campaigns, filtered messages or a suspended number. This guide is for owners and front desk leads at independent medical, dental, med spa, chiropractic and integrative practices.

It explains why providers require registration, the three kinds of sending numbers (standard 10-digit numbers, toll-free numbers and short codes), what reviewers look for in your business details, use cases, sample messages and opt-in proof, and how to keep patient information out of the process. The consent and opt-out law behind marketing texts is in our guide to marketing texts from your practice, and reminder wording is in text message appointment reminders. How to honor “stop” replies alongside email unsubscribes and call requests is in patient opt-outs for email, text and calls. Messaging apps raise separate questions; see WhatsApp and messaging apps for practices.

The short version

• Registration is a provider rule, not a statute. Wireless providers decide what business traffic they carry. CTIA’s principles say they may require campaign preapproval, vetting, audits and filtering.
• A practice is a business sender. CTIA names medical practices as Non-Consumer senders, so texts from a practice follow the business rules even when a staff member sends them.
• Pick the number type for the job. A standard 10-digit number, a text-enabled toll-free number and a short code each have their own review path.
• Register what you will actually send. List reminders and marketing as separate uses, with sample texts that match your real messages.
• Prove the opt-in. Keep a record of when, where and how each patient agreed, and for which kind of message.
• No patient information in the paperwork. Sample messages and screenshots use placeholders, never a real patient’s name, visit or condition.

Why wireless providers require registration

Texting is a service wireless providers have kept relatively free of spam, and they treat that as a reason to screen business senders. In FCC 18-178, adopted December 12, 2018, the FCC classified SMS and MMS as information services and said this would empower providers to continue protecting consumers from unwanted text messages. The CTIA Messaging Principles and Best Practices (May 2023), the voluntary guidelines written by the wireless industry’s trade association, say individual providers may add protections for business senders, including campaign preapproval, vetting of service providers, in-market audits and filtering of unwanted messages.

The FCC also requires blocking of certain texts. Under 47 CFR 64.1200(p), adopted in FCC 23-21 on March 16, 2023, a mobile wireless provider must block texts that claim to come from numbers on a reasonable do-not-originate list: numbers whose subscriber asked for the block, invalid numbers, numbers not allocated to a provider, and allocated numbers that are unused. Section 64.1200(s) requires a terminating mobile provider to act on an FCC Enforcement Bureau Notification of Illegal Texts, including blocking texts from the numbers it names when required. These rules aim at illegal traffic, but they explain why a practice texting from a number it does not control, or a number that was never set up for texting, can see its messages disappear.

You are a business sender, even from a staff phone

CTIA’s principles split texting into Consumer traffic, between individual people, and Non-Consumer traffic, sent by or to a business. They list medical practices by name as Non-Consumer senders, along with agents and representatives acting for them. They also say automation used by a business to send messages falls outside consumer operation, and they list illustrative attributes of consumer texting, such as 100 distinct recipients per message and 25 repetitive messages, beyond which traffic looks like a business.

For a practice, this means a front desk cell phone used to send reminders to a list, or a personal number used for promotions, is still business texting. It is not registered, it does not carry your practice’s verified identity, and providers can filter it. It also puts patient messages on a device and account the practice may not control. Move patient texting to a business number on a platform that supports registration, and keep personal phones for personal use.

Three kinds of sending numbers

Standard 10-digit numbers. The industry calls business texting on a local 10-digit number 10DLC, short for 10-digit long code. CTIA’s principles describe this two-way business traffic from 10-digit numbers and say providers deploy filters and other tools on traffic with the signs of unwanted messages. Before you send, your texting platform registers your business and each kind of message you plan to send, which the industry calls a campaign. Patients see a local number they can call, which suits a single-location practice texting reminders and replies.

Text-enabled toll-free numbers. CTIA’s principles list the toll-free area codes 800, 888, 877, 866, 855 and 844, and say that only the holder of record of the toll-free number for voice service has the authority to enable texting on it. They also say the process for enabling texting should synchronize with a registry of text-enabled toll-free numbers. Platforms run a review before a toll-free number can send business texts, which platforms call toll-free verification, which asks for business details, the use case, sample messages and the opt-in method. A toll-free number can suit a multi-location practice with one central number.

Short codes. A short code is a five- or six-digit number. CTIA says short codes were built for higher-volume messaging, with upfront vetting and ongoing auditing, and that a central short code administrator runs the cross-carrier short code registry in the United States. Short code programs follow CTIA’s Short Code Monitoring Program Handbook (version 1.9, effective August 2, 2023), and the handbook says each wireless provider makes the final decision on which messages it carries and may set its own requirements. A short code is a larger commitment. A local 10-digit number is the simpler fit for a single office sending reminders.

What the registration asks for

The exact form belongs to your platform and the providers, and it changes. The CTIA principles describe what reviewers look for, and the questions follow from them.

• Business identity. The practice’s legal name as it appears on tax records, its address, website and a contact. Register under the entity that sends the texts. If an agency or a group sends for more than one practice from one number, CTIA says shared numbers among multiple businesses may require special arrangements with providers, and those senders should be documented.
• Use case. What the messages do: appointment reminders, account notices, two-way customer care or marketing. Register reminders and marketing as separate uses so a reviewer can match each one to its consent.
• Sample messages. Two or more texts that look like what you will send, with the practice name, the purpose and the opt-out wording. Use bracketed placeholders, not real patient details.
• Call to action and opt-in proof. Where and how patients agree: the intake form, a website checkbox, a keyword or a verbal opt-in at the front desk. CTIA says a call to action should tell patients the program, the number they will hear from, who is sending, any fees and how to opt out and get help, with a link to your privacy policy.
• Opt-out and help handling. How a STOP reply ends messages and how a HELP reply gets an answer. For short codes, the handbook requires a response to HELP with the program name and how to reach the sender.

A reviewer compares these answers with your website. A missing privacy policy, a website that does not name the practice, or sample texts that differ from the stated use are reasons a registration can be sent back. Fix the website before you submit, and keep a copy of what you submitted.

Healthcare messages versus marketing

CTIA’s principles sort texts into conversational, informational and promotional messages. Conversational texts answer a patient who wrote first. Informational texts go to a patient who gave the number and asked to be contacted, and appointment reminders fit here. Promotional texts, such as specials and new service offers, call for express written permission under CTIA’s principles, which describe it as signing a form, checking a box online or a similar step.

Federal law draws its own lines. Under 47 CFR 64.1200, marketing texts sent with an automated system need prior express written consent, and the FCC’s healthcare exemption covers certain messages, such as reminders, under conditions our reminder guide walks through. The opt-out rules change on November 25, 2026, as our marketing texts guide explains. Registration does not replace any of this. A registered campaign that sends without valid consent is still unlawful, and the provider can still suspend it.

Keep the uses apart. CTIA says one opt-in applies only to the campaign it was given for, and the short code handbook prohibits enrolling a person in more than one program from a single opt-in, even on the same short code. A patient who agreed to reminders has not agreed to promotions.

Opt-out and help keywords

CTIA’s principles say senders should state in the message how to opt out, use standard STOP wording, and also act on plain-language requests such as stop, end, unsubscribe, cancel, quit and “please opt me out”, without regard to capitalization or punctuation. After an opt-out, the sender should send one final confirmation and nothing more. Senders should also support opt-outs by phone call and email, and keep records of opt-ins and opt-outs so no message goes to a number that opted out.

For recurring messages, CTIA says the first text after opt-in should confirm the enrollment and include the program name, a customer care contact or HELP instructions, how to opt out, the message frequency, and any fees. Use: “[Practice name]: you are signed up for appointment texts, up to [number] a month. Msg and data rates may apply. Reply HELP for help, STOP to opt out.” Avoid: a confirmation that also promotes a service, or one with no way to opt out.

Content that draws extra review

CTIA’s principles ask senders to keep marketing content truthful and consistent with the FTC’s truth-in-advertising rules, and to avoid content that deceives or invades privacy. Links in texts should not hide who is sending. Where a link shortener is used, CTIA says it should be one dedicated to the sender, and the linked page should name the business and give contact information such as a postal address. Phone numbers in a text should not forward to an unlisted number unless the text clearly names who owns it.

The short code handbook lists advertising of controlled substances among the topics providers set their own onboarding rules for, and it requires age gating for controlled substances and adult content. Practices that offer treatments involving controlled substances should expect more questions and should not promote those treatments by text without checking the provider rules and their own legal obligations first.

Keeping patient information out of the process

A registration form goes to your platform and, through it, to the industry’s review partners. It is not a place for protected health information, which 45 CFR 160.103 defines as individually identifiable health information held or sent by a covered entity or its business associate. Use placeholders such as [Patient first name] and [date] in sample messages, and crop or replace any screenshot of a form or inbox that shows a real patient.

The platform that sends your reminders handles patient phone numbers and appointment details, so ask in writing whether it will act as your business associate and what its agreement covers before you load a patient list. Our HIPAA website contact forms guide covers the same question for web forms.

When texts are blocked or a campaign is rejected

Section 64.1200(r) requires a mobile wireless provider to provide a point of contact, or make sure its aggregators or blocking contractors provide one, for senders who can document that their texts were wrongly blocked. Your texting platform is the first stop: ask for the rejection reason or delivery error codes, fix the cause, and ask the platform to use the provider’s process if you believe the block is an error.

Do not work around a block. CTIA’s principles say senders should not spread messages across a large set of numbers to avoid filters, which they call snowshoe messaging, and should not use routes providers have not authorized for business texts, which they call grey routes. Both make a later registration harder.

Questions to ask before you register

• Which number type fits our practice: a local 10-digit number, a toll-free number or a short code?
• Is the legal business name on the registration the one on our tax records and website?
• Have we listed reminders, two-way care and marketing as separate uses?
• Do our sample messages match what we will send, with placeholders instead of patient details?
• Does our website show the practice name, address, privacy policy and texting terms?
• Can we show when, where and how each patient opted in, and for which use?
• Does our platform answer STOP and HELP correctly and log opt-outs where staff can see them?
• Will the platform act as our business associate, and what does its agreement cover?

Use and avoid

• Use: “[Practice name]: reminder of your visit on [date] at [time]. Reply C to confirm. Reply STOP to opt out.” Avoid: “Reminder for your [condition] follow-up” in a sample or a live text.
• Use: one registered business number for patient texts. Avoid: reminders sent in bulk from a staff member’s personal phone.
• Use: a separate, unticked marketing box on the intake form. Avoid: counting reminder consent as consent to promotions.
• Use: a link to your own domain that names the practice. Avoid: a generic shared link shortener that hides the sender.
• Use: the platform’s appeal process after a rejection. Avoid: adding numbers to get around filtering.

An illustration

This example is invented. [Practice name], a two-location chiropractic practice, buys a texting plan and starts sending reminders and a monthly offer from the front desk number before registration is approved. Patients at [Town] report that they never got reminders, and the platform holds the campaign because the website has no privacy policy and the sample message mentions a back pain treatment.

The practice adds a privacy policy and texting terms to its website, splits the intake consent into a reminder box and an unticked marketing box, and resubmits two uses with placeholder samples and the opt-out wording. It stops the monthly offer until the marketing use is approved and the patients who checked the new box are on a separate list. The reminders go out from the registered number, and the front desk logs STOP replies in the scheduling system.

Checklist

• Choose the number type and register under the practice’s legal name.
• Publish a privacy policy and texting terms on the website before you submit.
• Register reminders and marketing as separate uses with matching sample texts.
• Use placeholders in samples and screenshots, never patient details.
• Record each opt-in: date and time, method, wording shown, use and phone number.
• Send an opt-in confirmation with program name, frequency, HELP and STOP.
• Honor STOP and plain-language opt-outs, send one confirmation, then stop.
• Get the platform’s business associate terms in writing before loading patient data.
• Keep a copy of the registration and update it when your texts change.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For practices that text patients, we set up the website pages a registration review checks, such as the privacy policy, texting terms and opt-in forms, and keep reminders and marketing on separate consent tracks. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• CTIA Messaging Principles and Best Practices (May 2023)
• CTIA Short Code Monitoring Program Handbook, version 1.9 (effective August 2, 2023)
• 47 CFR 64.1200: Delivery restrictions (including text blocking in 64.1200(p), (r) and (s))
• FCC 23-21: Targeting and Eliminating Unlawful Text Messages, Report and Order (adopted March 16, 2023)
• FCC 18-178: Declaratory Ruling on the Regulatory Status of Wireless Messaging Service (adopted December 12, 2018)
• 45 CFR 160.103: Definitions (protected health information, business associate)
• HHS: Business associates

More in Phones, front desk and patient messages