Text message appointment reminders for medical practices: HIPAA, the FCC robotext rules and sample texts

Text reminders are one of the simplest tools a practice has against empty slots. Patients read texts, and a reminder with an easy way to confirm or reschedule gives you time to fill a slot that would otherwise sit empty. The questions practice owners ask before turning them on are always the same: is texting allowed under HIPAA, what can the message say, do we need consent, and what happens when a patient replies STOP.

This guide answers those from the primary sources: HHS guidance on the HIPAA Privacy Rule, the Privacy Rule text itself, and the Federal Communications Commission rules under the Telephone Consumer Protection Act (TCPA) at 47 CFR 64.1200. It ends with sample reminder texts and a setup checklist. Before reminders can go out from a business number, your texting platform will ask you to register it, as our guide to 10DLC, toll-free and short code registration explains. Birthday and holiday texts fall outside the FCC health care exemption, as our guide to birthday and holiday messages to patients explains. Recorded reminders left straight in voicemail follow the same FCC rules, as our guide to ringless voicemail drops explains. If a patient asks for reminders on WhatsApp instead of SMS, see our guide to WhatsApp and messaging apps for medical practices. Reminders sent to shared phones need extra care; see intimate partner violence screening outreach.

Is texting appointment reminders allowed under HIPAA?

Yes, with care about what the text says. HHS answers this directly in its HIPAA FAQs: appointment reminders are considered part of treatment of an individual and can be made without an authorization. A separate HHS FAQ says the Privacy Rule permits providers to communicate with patients about their care at home, by mail, phone or other means, and that the practice should limit the information it discloses, for example to its name and number and what is needed to confirm the appointment.

HHS has also said that the Privacy Rule allows providers to communicate electronically with patients, such as by email, as long as they apply reasonable safeguards (45 CFR 164.530(c)). It does not prohibit unencrypted messages for treatment-related communication with patients, but it expects you to limit the amount or type of information sent that way, and it notes that electronic protected health information must also be handled in line with the HIPAA Security Rule. A text message is an unencrypted channel in practice: it can show on a locked screen, and phones are shared. That is why the content of a reminder matters more than the fact that it is a text.

What a reminder text should and should not say

Write every reminder as if someone other than the patient might read it. The useful parts:

• Your practice name, so the patient knows who it is from. The FCC healthcare exemption below also requires it.
• Date and time of the appointment.
• How to confirm, cancel or reschedule: a reply keyword, a phone number or a link to your scheduling page.
• How to opt out: “Reply STOP to opt out.”

Leave out what is not needed to confirm the visit:

• The reason for the visit, a diagnosis or a procedure name. “Your root canal” or “your follow-up for lab results” tells anyone who sees the screen more than they need to know. For some specialties, such as behavioral health or fertility, even the name of the practice is sensitive; ask patients at intake how they want to be contacted.
• The provider’s specialty when it reveals the care, unless the patient has agreed to it.
• Balances, payments or collection messages. Billing content has its own rules, and the FCC healthcare exemption covered below excludes it entirely.
• Offers and promotions. A reminder that also pushes a discount or a new service turns a treatment message into something else. HIPAA’s marketing rules and the FCC’s telemarketing rules both treat that differently; see our guide to HIPAA marketing rules and, for calls, our guide to marketing calls, Do Not Call and the TSR.

Honor how each patient wants to be contacted

Under 45 CFR 164.522(b), a covered health care provider must permit patients to request, and must accommodate reasonable requests, to receive communications by alternative means or at alternative locations. You may require the request in writing, and you may ask for the alternative address or contact method, but you may not require the patient to explain why. HHS gives an example in its email FAQ: a provider should accommodate a request to receive appointment reminders by email rather than on a postcard, if email is a reasonable option for that provider.

In practice, that means your scheduling system needs a field for contact preferences that the reminder tool actually respects: “no texts”, “text this number only”, “call my work number”, or “no voicemail”. A patient who asks not to be texted should not keep receiving texts because the preference was written on a paper form nobody entered.

The FCC rules: where the TCPA comes in

The TCPA rules at 47 CFR 64.1200 restrict calls made with an automatic telephone dialing system or an artificial or prerecorded voice, and the FCC treats a text message as a call for this purpose. Under 64.1200(a)(1)(iii), such calls to a wireless number generally need the prior express consent of the called party unless they are for emergency purposes or fall under an exemption. For calls that include an advertisement or constitute telemarketing, 64.1200(a)(2) requires prior express written consent, but it excludes a call that delivers a “health care” message made by or on behalf of a HIPAA covered entity or its business associate.

Whether a particular texting system counts as an automatic telephone dialing system is a legal question. The Supreme Court narrowed the definition in Facebook, Inc. v. Duguid (2021). Many reminder platforms are built to work within the FCC healthcare conditions regardless, and those conditions are a sensible standard to design to.

The FCC healthcare exemption, condition by condition

Section 64.1200(a)(9)(iv) exempts calls and texts made by or on behalf of healthcare providers to a wireless number from the consent requirement in (a)(1)(iii), as long as the message is not charged to the patient or counted against their plan limits and all of these conditions are met:

1. Only the number the patient gave you. Messages go only to the wireless number provided by the patient.
2. Identify the practice. Each message states the name and contact information of the healthcare provider. For voice calls, that comes at the beginning of the call.
3. Only listed purposes. Appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications and home healthcare instructions.
4. No selling and no billing. No telemarketing, solicitation or advertising, and no accounting, billing, debt-collection or other financial content. Messages must also comply with the HIPAA privacy rules.
5. Keep it short. Generally 160 characters or less for a text, one minute or less for a voice call.
6. Limit the frequency. No more than one message per day to each patient, and no more than three voice calls or texts combined per week.
7. Offer an opt-out in every message. Texts must tell recipients they can opt out by replying “STOP”. Voice calls need an interactive opt-out, or a toll-free number when they reach voicemail.
8. Honor opt-outs immediately. The healthcare exemption requires opt-out requests to be honored immediately.

Two practical consequences. First, a reminder sequence of “one week before, two days before, the day before and two hours before” can exceed the one-per-day and three-per-week limits; check your tool’s schedule against them. Second, the exemption only covers the listed purposes. A text promoting a new service, a membership plan or a seasonal offer is outside it.

Consent and opt-outs

The simplest protection is to ask for consent at intake. A line on the intake form or patient portal that says which number the patient wants reminders sent to, and that they agree to receive appointment texts from the practice at that number, gives you a record of the number the patient provided and of their consent. Keep it separate from any marketing consent, which is a different question under both HIPAA and the TCPA.

For messages sent on the basis of consent, 64.1200(a)(10) lets a patient revoke consent by any reasonable method. A reply of “stop”, “quit”, “end”, “revoke”, “opt out”, “cancel” or “unsubscribe” is a reasonable method by definition, and other wording counts if a reasonable person would understand it as a request to stop. Those requests must be honored within a reasonable time, not more than ten business days. Under 64.1200(a)(12), one confirmation text is allowed, as long as it only confirms the request and contains nothing promotional.

The workable rule for a practice: treat any reply that clearly says stop as an opt-out, stop sending right away, and log it where your front desk can see it. Then call the patient for their next reminder, or use another channel they have agreed to.

Choosing a reminder vendor

Most practices send reminders through their practice management system or a separate reminder service. That vendor receives patient names, phone numbers and appointment times on your behalf, which is protected health information. HHS says a covered entity needs a business associate agreement with a vendor that creates, receives, maintains or transmits protected health information on its behalf. Questions worth asking before you sign up:

• Will you sign a business associate agreement, and what does it cover?
• Can we set the message text ourselves and keep visit reasons and provider specialty out of it?
• Can the schedule be capped at one message a day and three a week per patient?
• Do STOP replies take effect immediately, and do opt-outs show up in our scheduling system?
• Does the system respect a per-patient “no text” or alternative contact preference?
• Who sees replies from patients, and how fast? Patients will reply with questions, not only keywords.

Sample reminder texts

None of these name the reason for the visit or the provider’s specialty, each one identifies the practice and gives a way to reach it, and each stays near the 160-character guideline once real dates and numbers are filled in.

When patients text back

Reminders start conversations. Patients reply with “Can I come at 3 instead?”, “Running late”, or a question about their care. Decide in advance who answers, how fast, and when to move to a phone call. Questions about symptoms or results should go to a call with clinical staff, not a back and forth by text. If a patient writes something that sounds like an emergency, the reply should direct them to 911 or, for a mental health crisis, the 988 Suicide and Crisis Lifeline.

The calls that reminders trigger are the other half. A reminder that says “call to reschedule” only works if someone answers. Our new patient phone script covers the first call, and our AI front desk answers and books calls after hours and when the line is busy. If you use an AI receptionist for those calls, see our guide to HIPAA and AI receptionists for medical offices before it handles patient details.

Where reminders fit in your no-show policy

Reminders reduce missed visits, but they work best alongside a written policy: how much notice you need for a cancellation, whether you charge a fee, and how you handle repeated no-shows. Our patient no-show policy guide covers the CMS rules on missed-appointment fees for Medicare patients and includes sample policy text. For a map of every rule that touches practice marketing and patient communication, see the healthcare marketing rules hub.

A text that reminds a patient to return a mailed stool kit is a screening outreach message, not an appointment reminder, and it has its own questions about follow-up and HIPAA marketing. See our guide to colorectal cancer screening outreach.

Setup checklist

• Intake: collect the patient’s preferred number and consent to appointment texts, separate from any marketing consent.
• Preferences: record requests for alternative contact methods and make the reminder tool respect them.
• Content: practice name, date, time, how to reschedule, “Reply STOP to opt out”. No visit reason, no billing, no offers.
• Frequency: no more than one message a day and three a week per patient.
• Opt-outs: immediate, logged, visible to the front desk.
• Vendor: business associate agreement in place before any patient data is uploaded.
• Replies: someone owns the inbox, with a rule for moving clinical questions and emergencies off text.

Frequently asked questions

Balance and billing texts follow different consent rules from reminders. See our medical debt collection rules guide.

Marketing texts, such as offers, reactivation messages and review requests, sit outside the reminder exemption. Our guide to marketing texts from your practice covers carrier registration, prior express written consent and the opt-out rule that takes effect on November 25, 2026.

Sources

• HHS FAQ: Are appointment reminders allowed under the HIPAA Privacy Rule without authorizations?
• HHS FAQ: May health care providers leave messages for patients at their homes?
• HHS FAQ: Does HIPAA permit health care providers to use e-mail to discuss health issues with patients?
• 45 CFR 164.522: Rights to request privacy protection (including (b) confidential communications)
• 45 CFR 164.530: Administrative requirements (including (c) safeguards)
• 47 CFR 64.1200: Delivery restrictions (TCPA rules, including (a)(9)(iv) healthcare calls and (a)(10) revocation of consent)
• Supreme Court: Facebook, Inc. v. Duguid, No. 19-511 (2021)
• HHS: Business Associates
• 988 Suicide and Crisis Lifeline

More in Phones, front desk and patient messages