Birthday and holiday messages to patients: HIPAA, texting consent and email rules

A birthday text or a holiday card feels like the friendliest thing a practice can send. It asks for nothing, it reminds the patient that someone at the front desk knows their name, and a scheduling platform can send it automatically from the date of birth already in the chart. The rules start to matter at three points: when the greeting carries an offer, when it goes out as an automated text or call, and when the message says more about the patient’s health than a greeting should.

This guide covers when a greeting is and is not marketing under HIPAA, what an added offer changes, using the date of birth from the record, the FCC consent rules for greeting texts and calls, how CAN-SPAM treats a birthday email with a coupon, opt-outs, and what to keep out of the message. Recall messages that bring patients back for care are covered in our guide to a patient recall system, and the email rules in more depth in our guide to email marketing for practices. The FCC exemption for appointment texts is explained condition by condition in our guide to text message appointment reminders. Removing patients who have died from greeting lists, and what a condolence note may say, is covered in our guide to practice contact after a patient dies. Recorded greetings left straight in voicemail are covered in our guide to ringless voicemail drops.

The short version

• A greeting that promotes nothing is not marketing under HIPAA. The definition in 45 CFR 164.501 covers a communication about a product or service that encourages the recipient to buy or use it. “Happy birthday from all of us at [Practice name]” does neither.
• An offer changes the analysis. A coupon for your own health-related service fits an exception to the marketing definition if no one pays you to send it. A third party’s offer, or one you are paid to send, is marketing that needs the patient’s written authorization under 45 CFR 164.508(a)(3).
• Birthday texts are not on the FCC’s health care list. The exemption in 47 CFR 64.1200(a)(9)(iv) covers appointment reminders, lab results and similar care messages. A greeting is not one of them, so an automated greeting text to a mobile number needs the patient’s prior express consent, and written consent once it carries an offer.
• A birthday email with a coupon is likely a commercial email. Under 16 CFR 316.3, an email that mixes promotion with other content is commercial if the subject line or the body would lead a reader to conclude the promotion is the point. Then it needs an opt-out and a postal address.
• Keep the patient’s health out of it. No diagnosis, procedure, anniversary of a treatment or specialty detail that tells whoever sees the message why the person is your patient.

When a greeting is not marketing

HIPAA defines marketing in 45 CFR 164.501 as a communication about a product or service that encourages recipients to purchase or use the product or service. A birthday text, a holiday card or a new year note that only wishes the patient well is not about a product or service and does not encourage anyone to buy anything, so it falls outside that definition. The same holds for a holiday message that tells patients when the office is closed and how to reach the on-call line: that is practical information about the practice, not a promotion.

Being outside the marketing definition does not mean the message is outside HIPAA. Sending a greeting still uses protected health information: the patient’s name, contact details and date of birth, held by a health care provider, and the fact that the person is your patient. That use has to fit a permission in the Privacy Rule. The definition of health care operations in 45 CFR 164.501 includes business management and general administrative activities of the entity, including customer service, and 45 CFR 164.506(c)(1) lets a covered entity use protected health information for its own health care operations. We found no HHS guidance that addresses birthday or holiday greetings as such, so write down which permission your practice relies on and confirm that reading with your privacy officer.

When an added offer makes it marketing

The risk sits in one extra line. “Happy birthday! Enjoy 20 percent off your next facial this month” is about a service and encourages the patient to buy it, so it meets the marketing definition. What happens next depends on whose service it is and who pays.

• Your own health-related service, nobody paying you. Paragraph (2)(ii)(B) of the marketing definition excludes a communication that describes a health-related product or service provided by the covered entity making the communication, unless the entity receives financial remuneration in exchange for making it. A birthday reminder that the patient is due for a cleaning at your office fits here. Whether a purely cosmetic service counts as health-related is a question to put to your privacy officer before you rely on the exception.
• Someone else’s product or service. A partner gym’s discount, a product brand’s coupon or a neighboring business’s offer is not described by the own-service exception. That communication is marketing, and 45 CFR 164.508(a)(3) requires the patient’s written authorization unless the communication is face to face or is a promotional gift of nominal value provided by the covered entity.
• Anyone paying you to send it. If the practice receives financial remuneration from a third party for the communication, the exceptions in the marketing definition do not apply, and under 164.508(a)(3)(ii) the authorization has to state that remuneration is involved.

A birthday gift raises a separate federal question for patients covered by Medicare or a state health care program. 42 U.S.C. 1320a-7a(a)(5) provides civil monetary penalties for offering remuneration that the person knows or should know is likely to influence a beneficiary’s choice of provider. The OIG Policy Statement Regarding Gifts of Nominal Value (December 7, 2016) interprets nominal value as a retail value of no more than 15 dollars per item or 75 dollars in the aggregate per patient on an annual basis, and says the items may not be cash or cash equivalents. The annual total counts each gift from the practice, so the birthday item adds to the holiday item and any loyalty reward. Our guide to patient loyalty and rewards programs covers that limit in more detail.

Using the date of birth from the chart

The date of birth in your practice management system was collected to identify the patient and bill for care. Using it to schedule a greeting is a new use of the same information, and two parts of the Privacy Rule shape how far that use should go.

• Minimum necessary. 45 CFR 164.502(b) requires a covered entity to make reasonable efforts to limit protected health information to the minimum necessary for the purpose. A greeting list needs a name, a contact method and a month and day. It does not need the year, diagnoses, the treating clinician or the last visit reason.
• Vendors. If a greeting platform receives the list, it is handling protected health information on your behalf. 45 CFR 164.502(e) allows that disclosure only with satisfactory assurance, in the form of a business associate agreement, that the vendor will safeguard the information. Check the agreement before you upload the list, not after the first send.
• Confidential communications. Under 45 CFR 164.522(b), a covered health care provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations. A patient who asked for mail only, or for a different number, should not get a birthday text at the number on file.

Before each run, check the list against flags you already keep: patients who asked not to be contacted, patients who have left the practice, and patients who have died. A birthday message to a family whose relative died recently is the kind of mistake a greeting program can make on its own if no one reviews the list.

Birthday texts and calls: the FCC consent rules

The FCC’s rules under the Telephone Consumer Protection Act are in 47 CFR 64.1200, and paragraph (a)(9) says the term “call” includes a text message. Paragraph (a)(1)(iii) requires prior express consent for calls to mobile numbers made with an automatic telephone dialing system or an artificial or prerecorded voice. Paragraph (f)(2) defines an autodialer as equipment with the capacity to store or produce numbers using a random or sequential number generator and to dial them, and whether a given texting platform meets that definition is a fact question. We recommend treating greeting texts as if the consent rules apply.

Three FCC sources show why a greeting needs its own consent:

• The health care exemption has a closed list. 47 CFR 64.1200(a)(9)(iv) exempts certain free-to-end-user calls and texts from a health care provider, limited to appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications and home health care instructions. The FCC’s 2015 order (FCC 15-72, paragraph 146) restricted the exemption to calls with exigency and a health care treatment purpose. A birthday or holiday greeting is not on the list.
• Giving your number to the practice has limits. In the same order (paragraph 141), the FCC said that providing a phone number to a health care provider is prior express consent for health care calls subject to HIPAA within the scope of the consent given. Footnote 473 ties “health care” to the HIPAA definition in 45 CFR 160.103, which covers care, services or supplies related to the health of an individual, and footnote 474 says the call must be closely related to the purpose for which the number was provided. In our reading, a birthday greeting is outside that clarification, so we recommend asking for consent that names greetings.
• An offer needs written consent. Paragraph (a)(2) requires prior express written consent for autodialed or prerecorded calls that include or introduce an advertisement or constitute telemarketing, except a call that delivers a “health care” message from a covered entity or its business associate. Paragraph (f)(1) defines an advertisement as material advertising the commercial availability or quality of any property, goods or services. The rule does not define “health care message”, and the FCC’s 2012 order (FCC 12-21, paragraph 63) described the calls it exempted as communicating health care-related information rather than offering property, goods or services. A birthday coupon is an offer, so we recommend written consent for it.

The simplest setup is a line on the intake form or patient portal, separate from the line for appointment texts, where the patient agrees to receive birthday and holiday messages from the practice at a number they give. Keep the record of that consent with the date and the wording. Marketing text programs also need carrier registration and quiet hours planning, covered in our guide to business texting rules for medical practices.

Birthday emails: commercial or not

CAN-SPAM regulates commercial electronic mail messages, defined in 15 U.S.C. 7702 by their primary purpose: the commercial advertisement or promotion of a commercial product or service. A greeting with no promotion has no commercial content, and it is not on the list of transactional or relationship messages either. The FTC’s rule at 16 CFR 316.3 decides the mixed case.

Under 16 CFR 316.3(a)(3), an email that contains both a promotion and other content that is not transactional or relationship content is commercial if a recipient reasonably interpreting the subject line would likely conclude it contains a promotion, or if a recipient reasonably interpreting the body would likely conclude that the primary purpose is the promotion. The rule lists placement of the promotion at the beginning of the body, the proportion of the message given to it, and the use of color, graphics, type size and style to highlight it as relevant factors. A subject line of “A birthday gift: 20 percent off” points one way. A long note of good wishes with one small line about a seasonal service is closer, and we recommend treating it as commercial anyway.

A commercial email needs, under 15 U.S.C. 7704(a)(5), clear and conspicuous identification that it is an advertisement or solicitation (unless the recipient gave prior affirmative consent), clear and conspicuous notice of the opportunity to decline further commercial email, and a valid physical postal address of the sender. Section 7704(a)(4) requires the sender to stop commercial email to a recipient within 10 business days after an opt-out request.

Opt-outs

Each channel has its own opt-out rule, and a patient will not know which one applies. Treat a request to stop greetings as a request to stop greetings everywhere, and record it where your greeting tool and your staff can see it.

• Texts and calls. 47 CFR 64.1200(a)(10) lets a person revoke consent by any reasonable means, says replies such as STOP, quit, end, revoke, opt out, cancel or unsubscribe count, and requires the request to be honored within 10 business days. Paragraph (a)(12) allows one text confirming the opt-out.
• Email. The 10 business day limit under 15 U.S.C. 7704(a)(4) applies to commercial email.
• HIPAA authorization. A patient may revoke an authorization in writing under 45 CFR 164.508(b)(5), except to the extent the practice already acted on it.
• Plain greetings. No federal rule requires an opt-out in a greeting with no promotion. We recommend honoring “please stop” anyway and keeping it separate from appointment reminders, so a patient who declines birthday texts still gets their reminders.

What to keep out of a greeting

A birthday text is read on a lock screen, a holiday card sits on a kitchen counter, and a family member may open either. The HHS FAQ on leaving messages for patients says providers may leave messages and mail reminders but should take care to limit the information disclosed. The FCC made a similar point in FCC 15-72 (paragraph 146) about exempted health care texts, noting that the information must not be of such a personal nature that it would violate the patient’s privacy if another person received the message.

• No diagnosis or treatment. “Happy one year since your surgery” or “Congratulations on six months sober” discloses health information to anyone who sees it. No federal rule names these messages, and we recommend leaving them out of automated greetings.
• No specialty that reveals the reason for care. A return address or sender name that names a fertility, addiction, HIV or mental health service tells the household why the person is a patient. Use the practice’s general name where you can.
• No age milestone tied to screening. “You’re 50! Time for your colonoscopy” mixes a greeting with a care reminder and an age. If a screening is due, send it as a recall message under your recall process.
• No photos or public shout-outs. A birthday post on the practice’s social media that names or shows a patient is a disclosure. Our guide to patient photo consent for marketing covers the authorization it needs.

Questions to ask before a greeting program goes live

• Which HIPAA permission covers using names, contact details and birth dates for greetings, and is it written in our policies?
• Does any greeting carry an offer, and is it our own health-related service, a third party’s, or one we are paid to send?
• For patients with Medicare or a state health care program, does each gift stay within the OIG nominal value limits for the year?
• Does the greeting vendor have a signed business associate agreement, and does it receive only the fields it needs?
• Do we have consent that names greetings for each number we text, and written consent where the text carries an offer?
• Would a reader of the email subject line or body conclude the promotion is the point?
• Are opt-outs from each channel recorded in one place, and kept separate from appointment reminders?
• Is the list checked against confidential communication requests, do-not-contact flags, former patients and deceased patients before each run?

Use and avoid

• Use: “Happy birthday from all of us at [Practice name].” Avoid: “Happy birthday! Your annual skin check is overdue.”
• Use: a separate consent line for greetings at intake. Avoid: relying on the number the patient gave for appointment reminders.
• Use: a coupon only for your own service, in an email with an opt-out and postal address. Avoid: a partner’s coupon in a birthday text without authorization.
• Use: the practice’s general name as sender. Avoid: a sender name that reveals a sensitive specialty.
• Use: a month and day from the chart. Avoid: exporting the full chart to the greeting tool.
• Use: a list check before each run. Avoid: a greeting that reaches the family of a patient who died.

An illustration

This example is invented. [Practice name], a med spa in [Town], turns on its booking platform’s birthday feature. It sends a text on each patient’s birthday: “Happy birthday from [Practice name]! Enjoy [X] percent off any service this month with code BDAY. Reply STOP to opt out.” The numbers come from the booking records, where patients gave them for appointment confirmations.

Before the next month’s run, the owner reviews the setup with their attorney. Three things change. The intake form gets a separate checkbox for birthday and promotional texts with its own written consent wording, and the birthday text goes only to patients who checked it. A partner salon’s offer that was planned for the holiday message is dropped, because it would need each patient’s written HIPAA authorization. The greeting list is limited to first name, mobile number and birth month and day, and is checked against opt-outs and deceased patient flags before each send. Patients who did not consent to texts get a plain birthday email with no coupon instead.

Checklist

• Write down the HIPAA permission the practice relies on for greetings.
• Keep greetings free of offers, or confirm the offer fits the own-service exception with no remuneration.
• Get written HIPAA authorization for third-party offers or paid messages.
• Track gifts to Medicare and state program patients against the OIG nominal value limits.
• Sign a business associate agreement with the greeting vendor and send it only the fields it needs.
• Collect a separate consent for greeting texts, written consent if they carry an offer.
• Add an opt-out and postal address to birthday emails with a promotion.
• Honor opt-outs within 10 business days, and record them in one place.
• Leave diagnoses, treatments, sensitive specialties and screening reminders out of greetings.
• Check the list against confidential communication requests, former patients and deceased patients before each run.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For patient greetings, we set up intake consent wording, keep greeting, reminder and promotional messages in separate flows with their own opt-outs, and limit what each tool receives to the fields it needs. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 45 CFR 164.501: Definitions (marketing, health care operations)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules
• 45 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.522: Rights to request privacy protection (including (b) confidential communications)
• 45 CFR 160.103: Definitions (health care)
• HHS FAQ: May health care providers leave messages for patients at their homes?
• 47 CFR 64.1200: Delivery restrictions
• FCC 15-72: TCPA Omnibus Declaratory Ruling and Order (released July 10, 2015), paragraphs 141 to 147
• FCC 12-21: TCPA Report and Order (February 15, 2012), paragraphs 57 to 64
• 15 U.S.C. 7702: Definitions
• 15 U.S.C. 7704: Other protections for users of commercial electronic mail
• 16 CFR 316.3: Primary purpose
• 42 U.S.C. 1320a-7a: Civil monetary penalties
• OIG Policy Statement Regarding Gifts of Nominal Value (December 7, 2016)

More in Phones, front desk and patient messages