One opt-out process for email, text and calls at a practice

A patient replies “stop” to a recall text, clicks unsubscribe on the monthly newsletter, and tells the front desk on the phone to stop calling about the whitening special. Three channels, three systems, often three different vendors. If any one of those requests is lost, the next message is the one that causes the complaint.

Each channel has its own federal opt-out rule, with its own deadline and its own list of what counts as a request. This guide puts the three side by side: CAN-SPAM for commercial email, the FCC’s TCPA rules for robocalls, robotexts and telemarketing calls, and the FTC’s Telemarketing Sales Rule. Then it shows how one practice-wide stop list can meet all of them. For the channel rules in depth, see healthcare email marketing, telemarketing rules for practice calls, marketing texts from your practice and 10DLC registration for practices. For opt-outs from the email and text sequences that follow a download or webinar sign-up, see our guide to lead magnets and gated content. One-click unsubscribe also depends on how your email domain is set up; see SPF, DKIM and DMARC for practices.

The short version

• Email: 10 business days. Under 15 U.S.C. 7704(a)(4), a sender may not send commercial email within the scope of an opt-out request more than 10 business days after receiving it. The opt-out mechanism must keep working for at least 30 days after each message.
• Email: no hoops. 16 CFR 316.5 bars charging a fee, asking for anything beyond the email address and opt-out preferences, or requiring more than a reply email or a visit to a single web page.
• Texts and robocalls: any reasonable method. 47 CFR 64.1200(a)(10) lets a person revoke consent by any reasonable method, names reply words such as “stop” and “unsubscribe” as reasonable per se, bars an exclusive opt-out method, and requires honoring the request within a reasonable time not over 10 business days.
• Calls: a written do-not-call policy. 47 CFR 64.1200(d) requires telemarketers, and callers using certain prerecorded-message exemptions including the health care one, to keep a written policy, train staff, record requests when made, honor them within 10 business days and keep them for 5 years.
• Telemarketing: the seller’s own list. 16 CFR 310.4(b)(1)(iii)(A) bars outbound telemarketing calls to a person who has said they do not want calls from that seller.
• One list, shortest deadline. A practice that records every request in one place and applies it everywhere it should apply, within days rather than the maximum, meets each rule’s clock.

Email: what CAN-SPAM requires

Section 7704(a)(3) of the CAN-SPAM Act requires every commercial email to contain a functioning return email address or other internet-based mechanism, clearly and conspicuously displayed, that the recipient can use to ask not to receive future commercial email from the sender. It must keep working for no less than 30 days after the message is sent. The sender may offer a menu of message types, as long as the menu includes an option to stop all commercial email from the sender.

Section 7704(a)(4) sets the deadline: more than 10 business days after receiving the request, the sender may not send a commercial message within its scope, and nobody acting for the sender may either. The sender also may not sell, lease, exchange or otherwise transfer the address of someone who opted out, except to comply with the law. A later affirmative consent from the recipient lifts the prohibition.

The FTC rule at 16 CFR 316.5 closes the usual loopholes. The sender may not require the recipient to pay a fee, provide any information other than their email address and opt-out preferences, or take any step other than sending a reply email or visiting a single web page. In a practice, that rules out an unsubscribe page that asks for a date of birth or a patient login before it works.

CAN-SPAM covers commercial messages. Whether an appointment confirmation or a billing message with a promotion added counts as commercial depends on its primary purpose, which is covered in our healthcare email marketing guide.

Texts and robocalls: revoking consent under the TCPA rules

The FCC’s rules at 47 CFR 64.1200(a)(1) to (a)(3) require consent for certain autodialed and prerecorded-voice calls and texts. Paragraph (a)(10) then says how that consent can be taken back, and it applies to calls and texts made under those paragraphs and under (c)(2). The main points, quoted closely:

• A called party may revoke prior express consent, including prior express written consent, by using any reasonable method to clearly express a desire not to receive further calls or texts.
• An automated, interactive voice or key-press opt-out on a call; the words “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel” or “unsubscribe” sent in reply to a text; or a website or phone number the caller designated for opt-outs are each a reasonable means per se.
• If a reply text uses other words, the sender must treat it as a revocation if a reasonable person would understand it that way. “Please don’t text me anymore” counts.
• A sender whose texting protocol does not allow replies must say so clearly on each text and give reasonable alternative ways to revoke consent.
• Requests must be honored within a reasonable time not to exceed ten business days. The caller may not designate an exclusive means to revoke consent.

Paragraph (a)(11) adds that other methods, such as a voicemail or an email to a number or address meant to reach the caller, create a rebuttable presumption that consent was revoked once the consumer shows the request was made. So an email to the front desk saying “take me off your texts” is a request the practice should treat as real.

Paragraph (a)(12) allows one confirmation text that only confirms the revocation, with no marketing, and is the only message sent after the request. Sent within five minutes, it is presumed to fall within the consumer’s prior consent; later than that, the sender has to show the delay was reasonable. If the person had agreed to several kinds of texts, the confirmation may ask whether the opt-out was meant to cover all of them, and absent clarification the sender must stop all further texts for which consent is required.

Calls: the do-not-call list a practice must keep

Under 47 CFR 64.1200(d), nobody may make a telemarketing call to a residential subscriber, or a prerecorded-voice call relying on the exemptions in (a)(3)(ii) to (v), without procedures for keeping a list of people who asked not to be called. Paragraph (a)(3)(v) is the exemption for a prerecorded health care message made by or for a HIPAA covered entity or business associate, limited to one call a day and three a week to each patient’s residential line, and it expressly requires honoring opt-out requests under paragraphs (b) and (d). Paragraph (a)(2) contains a similar health care carve-out for certain calls to wireless numbers.

The minimum standards in (d) are:

1. Written policy. A written policy for maintaining the do-not-call list, available on demand.
2. Training. Staff who make these calls, or work on any aspect of telemarketing, are informed and trained on the list.
3. Record at once. The request is recorded, and the name if given and the number placed on the list, at the time the request is made, and honored within a reasonable time not over 10 business days. If someone else keeps the list for you, you are liable for their failures.
4. No sharing without permission. The consumer’s prior express permission is needed to share the request with anyone other than the practice or an affiliate.
5. Identify the caller. Give the caller’s name, the practice’s name and a number or address where it can be reached.
6. Keep it 5 years. A do-not-call request must be honored for 5 years from when it is made.

Paragraph (d)(5) says a request applies to the entity that made the call, and not to affiliated entities unless the consumer would reasonably expect them to be included. For a group with several locations under one name, the safer reading is that a patient expects the whole practice to stop.

Telemarketing calls: the Telemarketing Sales Rule

The FTC’s Telemarketing Sales Rule adds its own entity-specific list. 16 CFR 310.4(b)(1)(iii)(A) makes it an abusive practice to start an outbound telemarketing call to a person who has previously stated that they do not wish to receive calls made by or for the seller. Part (B) covers numbers on the national Do Not Call Registry, with exceptions for express written agreement and an established business relationship, but only if the person has not made a request under (A).

Section 310.4(b)(3) gives a safe harbor for calls that slip through by error, if the seller can show written procedures, trained staff, a maintained list of numbers it may not contact, a process to prevent calls to listed numbers using a registry copy no more than 31 days old with records of the process, and monitoring and enforcement. Which practice calls are covered by the TSR, and its exemptions, are in our telemarketing rules guide.

Side by side

• Commercial email. Rule: 15 U.S.C. 7704(a)(3) and (4), 16 CFR 316.5. How a patient opts out: the reply address or link in the message. Deadline: 10 business days. Mechanism must work for 30 days after each message.
• Autodialed or prerecorded calls and texts that need consent. Rule: 47 CFR 64.1200(a)(10) to (12). How: any reasonable method, including listed reply words and designated numbers or pages; other methods create a presumption. Deadline: a reasonable time, not over 10 business days.
• Telemarketing calls and exempt prerecorded calls, including health care messages. Rule: 47 CFR 64.1200(d). How: a request to the caller. Deadline: recorded when made, honored within 10 business days, kept 5 years.
• Telemarketing under the TSR. Rule: 16 CFR 310.4(b)(1)(iii)(A). How: the person states they do not want calls from the seller. The safe harbor depends on written procedures and a maintained list.

Building one stop list for the whole practice

The rules differ in detail, but they point at the same process. A practice that builds it once can meet every channel’s rule:

1. Name an owner. One person, usually the practice manager, owns the list and the written policy that 64.1200(d)(1) and the TSR safe harbor both expect.
2. Accept requests everywhere. Reply words on texts, unsubscribe links in email, the phone, the front desk, the website contact form, the patient portal and email to any staff address. Under (a)(10), the practice may not insist on one method.
3. Record when made. Log the date, channel, contact details, the exact words used and what the request covers, the day it arrives. Paper notes at the front desk get entered the same day.
4. Push to every system. The email platform, texting platform, recall and reminder tools, call lists and any agency or vendor sending for you. 64.1200(d)(3) makes the practice liable for a list kept by someone else.
5. Set an internal deadline well inside 10 business days. Same day or next business day is a realistic target and leaves room for error.
6. Ask scope only when needed. If a patient opts out of marketing texts but may still want appointment reminders, one confirmation text under (a)(12) may ask. If they do not answer, stop all texts that need consent.
7. Keep records 5 years. The (d)(6) period for call requests is 5 years; keeping all opt-out records that long is simplest.
8. Check before every campaign. Scrub each send against the list, and for telemarketing calls against a registry copy no more than 31 days old.
9. Train and test. Train staff on the policy, and send a test “stop” and unsubscribe now and then to confirm they still work.

A patient who opts out of marketing has not necessarily opted out of care. Lab results, appointment logistics and billing questions may still need to reach them; ask how they want those, and record the answer. Our guides to text message appointment reminders and the patient recall system cover those messages, and patient data in a practice CRM covers where the list usually lives.

Use and avoid

• Use: “Reply STOP to opt out” on marketing texts, and treat “no more texts please” the same way. Avoid: “To opt out, call our office during business hours.”
• Use: a one-click unsubscribe page that asks only for the email address and preferences. Avoid: an unsubscribe page behind a patient portal login.
• Use: a front desk script that says “I will take you off our call list today.” Avoid: “You need to email us to be removed.”
• Use: one list shared with every vendor that sends for the practice. Avoid: separate lists in the email tool, the texting tool and the agency’s dialer that never sync.
• Use: one plain confirmation text with no offer. Avoid: “You are unsubscribed. Before you go, here is 20 percent off.”

An illustration

This is a made-up example, not a client. A dental office sends recall texts through its reminder tool, a monthly newsletter through an email platform, and has an agency running a whitening promotion by text from a separate number. A patient replies “please stop these” to the agency text, and a week later emails the office asking to be taken off “all your marketing.”

Under 64.1200(a)(10), “please stop these” is a revocation a reasonable person would understand, even though it is not one of the listed words, and it must be honored within 10 business days. The email to the office creates a presumption of revocation under (a)(11) for texts and calls, and the practice should apply it to the newsletter as well. With one list that the agency and both platforms read from, both requests are recorded the day they arrive and every system stops. Without it, the agency’s tool honors the first request and the newsletter keeps going.

How we help

We set up email, text and call campaigns for independent practices with one opt-out list behind them, including lead generation follow-up, Google Ads call flows and an AI front desk that records opt-out requests made by phone. We also build websites with working unsubscribe and contact pages and handle local search. We are not a law firm and we do not give legal or medical advice. Related guides: ringless voicemail, HIPAA marketing rules and our guide to healthcare marketing rules.

Sources

• 15 U.S.C. 7704: Other protections for users of commercial electronic mail
• 16 CFR 316.5: Prohibition on charging a fee or imposing other requirements on recipients who wish to opt out
• 47 CFR 64.1200: Delivery restrictions
• 16 CFR 310.4: Abusive telemarketing acts or practices

More in Healthcare marketing rules