Following up on abandoned appointment requests: HIPAA, TCPA and ad rules

Someone starts an appointment request on your website, types a name, a phone number and a line about knee pain, then closes the tab. Or they press send, and nobody books them. Both look like lost patients, and a quick call or text can win them back. The way you follow up decides whether that is good front desk work or a privacy problem: a script that records unsent typing, a text sent without the right consent, a voicemail that names a condition, or an ad audience built from the form. This guide is for owners and office managers at independent medical, dental, med spa, chiropractic and integrative practices.

It covers when a partial request is protected health information, what the HHS Office for Civil Rights bulletin on online tracking says and what a federal court removed from it in 2024, the FCC consent rules for calls and texts, email and voicemail, why Google does not let health advertisers target people from their own lists, and a follow-up script you can adapt. How to secure the form itself is in website contact and appointment forms under HIPAA. The lawsuits over scripts that record what visitors type are in website chat, session replay and wiretap laws, and the tracking rules in depth are in tracking pixels and Google Analytics on a practice website. Testing your form callbacks with a shopper is covered in our guide to mystery shopping your practice. Recorded follow-up messages left straight in voicemail are covered in our guide to ringless voicemail drops.

The short version

• A partial request can be health information. A name or phone number plus a reason for the visit, held by a practice, fits the HIPAA definition whether or not the person pressed send.
• Do not let scripts collect what visitors type. Session replay, form analytics and ad pixels on the appointment page can send unsent entries to vendors with no BAA.
• Match the channel to the consent. Autodialed or prerecorded calls and texts to a cell phone need prior express consent, and marketing needs prior express written consent.
• Keep messages bare. Your practice name, a call back number and an offer to help book. No condition, no service name, no reason for the visit.
• Never build ad audiences from form data. Google does not allow customer lists or your own data segments for health ads, and HHS calls marketing disclosures of PHI without authorization impermissible.

Three kinds of abandoned request

Before you plan follow-up, sort what you are calling abandoned. The rules differ for each:

• Submitted but not booked. The person pressed send and the request reached your inbox or scheduling system, but nobody confirmed a time. This is an inquiry you received, and following it up is ordinary front desk work.
• Started but never sent. The person typed into the form and left. The practice only has these entries if the form tool saves drafts or a script captures fields as they are typed. The person did not choose to send anything.
• Visited but never started. Someone looked at the booking page and left without typing. You have no contact details unless a tracking tool has tied the visit to an identity, and you should not try to make it do so.

The first group is where follow-up belongs. The second group is chiefly a question of what your tools collect without the person knowing, and the safest answer is to stop collecting it. The third group is a matter for page design, not outreach.

When a half-filled form is protected health information

Under 45 CFR 160.103, health information includes information created or received by a health care provider that relates to a person’s past, present or future physical or mental health, or to the provision of health care. It is individually identifiable when it identifies the person or there is a reasonable basis to believe it could. Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate, in any form.

The HHS tracking bulletin applies that to booking pages. It says tracking technologies on an unauthenticated page that lets people schedule appointments may collect an individual’s email address, or the reason for seeking health care typed or selected by the individual, and that a practice disclosing this to a tracking vendor is disclosing PHI, so the HIPAA Rules apply. The bulletin also describes the information involved as what an individual types or selects on the site. Nothing in that wording depends on the person pressing send.

So treat each field on an appointment form as if the request had been sent. If a partial entry reaches your systems or a vendor’s, a name or phone number together with a reason for the visit is protected health information in the hands of a practice. Even a name and phone number alone, on a page that books a particular specialty, says something about the person’s care.

Scripts that capture what visitors type

Partial capture is a feature in form builders, marketing platforms and session replay tools. It records each field as the visitor fills it in, or sends the page’s input to an analytics server, so the owner can see where people stop. On an appointment or intake page that means health information leaves the browser before the person has decided to send it.

The bulletin says a practice may disclose PHI to a tracking vendor only as the Privacy Rule permits, and that the vendor is then a business associate that needs a business associate agreement. It also says disclosures of PHI to tracking vendors for marketing purposes, without the individual’s authorization, are impermissible. A vendor that keeps partial entries to improve its own product or to build audiences is the problem case.

There is a second risk outside HIPAA. Lawsuits in California and Pennsylvania argue that a third party reading what a visitor types, while it is being sent, is an interception under state wiretap laws that require the consent of all parties. Our wiretap guide covers California Penal Code 631, the Pennsylvania act and the federal rule. Whether a claim succeeds depends on the facts and the court, but a visitor who never pressed send has a stronger argument that they did not agree to share anything.

The practical step is plain. Turn off partial capture, draft saving and field level analytics on appointment, intake and symptom pages, keep session replay and ad pixels off those pages, and count drop-off with a measure that does not record what was typed, such as a count of form starts and sends.

What the 2024 court ruling changed, and what it did not

On June 20, 2024, the U.S. District Court for the Northern District of Texas declared unlawful and vacated part of the bulletin in American Hospital Association v. Becerra, No. 4:23-cv-1110. The note HHS placed at the top of the bulletin says the court vacated the guidance to the extent it provides that HIPAA obligations are triggered where an online technology connects an individual’s IP address with a visit to an unauthenticated public page addressing specific health conditions or health care providers. The AHA reported on August 29, 2024 that HHS would not appeal.

That ruling is about a visitor’s IP address and a page visit. It does not reach a person who types their name, phone number or reason for the visit into a booking form. The bulletin’s example of an appointment page that collects an email address and the reason for seeking care was not part of what the court vacated, and the bulletin remains on the HHS site with the note. For abandoned forms, the part that matters still stands.

Is a follow-up message marketing under HIPAA?

Under 45 CFR 164.506(c)(1), a covered entity may use or disclose protected health information for its own treatment, payment or health care operations. Calling back someone who asked for an appointment, to finish booking it, fits that.

The definition of marketing in 45 CFR 164.501 covers a communication about a product or service that encourages the recipient to purchase or use it. It excludes communications for the treatment of an individual by a health care provider, and communications describing a health related product or service the covered entity itself provides, unless the covered entity is paid by a third party to make them. A follow-up about the visit the person asked for, from your own staff, is a weak fit for marketing.

The picture changes when the follow-up turns into a campaign: a sequence pushing a different service, a discount on something the person did not ask about, or a message paid for by a device or product company. Those are closer calls under HIPAA and are also marketing under the phone and email rules below. Keep follow-up about the request the person made.

Calls and texts: consent under the TCPA rules

The FCC rules at 47 CFR 64.1200 treat a text as a call. Section 64.1200(a)(1) bars a call to a cell phone using an automatic telephone dialing system or an artificial or prerecorded voice unless it is made for emergency purposes or with the prior express consent of the called party. Section 64.1200(a)(2) requires prior express written consent for such a call that includes an advertisement or constitutes telemarketing, with an exclusion for a call that delivers a health care message made by or on behalf of a HIPAA covered entity or its business associate.

What that means for an abandoned request:

• A staff member dialing by hand is outside 64.1200(a)(1) and (a)(2), which apply to autodialers and artificial or prerecorded voices. Do-not-call and calling hour rules can still apply to telephone solicitations, and state laws can be stricter.
• An automated text or call needs consent. A person who typed a phone number into a request they never sent did not give it to you for any purpose. Do not send automated messages to numbers from unsent forms.
• A submitted request should carry its own consent line next to the phone field, stating how the practice will use the number, such as a call or text about this appointment request. Keep marketing consent as a separate, unchecked box with the disclosures 64.1200(f)(9) requires.
• A promotional sequence, such as a new patient discount after a request went quiet, is advertising. Treat it as marketing and get prior express written consent first.

Whether a particular system is an automatic telephone dialing system is a legal question, so ask counsel before you rely on manual dialing. Our guide to marketing texts from your practice covers written consent, opt-outs and the state laws in Florida and Maryland that set stricter limits. A practical calling window of 8 a.m. to 8 p.m. local time meets both the federal hours and those two states.

Email follow-up

Under 15 U.S.C. 7702, CAN-SPAM covers commercial electronic mail messages, whose primary purpose is the commercial advertisement or promotion of a product or service. A transactional or relationship message, such as one that facilitates, completes or confirms a commercial transaction the recipient has previously agreed to enter into, is excluded. A request someone started and abandoned is not an agreed transaction, so a follow-up email that promotes your services is safest treated as commercial: include an opt-out and your postal address and honor opt-outs under 15 U.S.C. 7704.

Keep the subject line and body free of health details. “Your appointment request with [Practice name]” says enough. If the person needs to share symptoms or history, send them to your secure form or ask them to call. Our healthcare email marketing guide covers the rest of CAN-SPAM.

Voicemail and people who answer for the patient

The HHS FAQ on leaving messages says the Privacy Rule permits providers to communicate with patients at home by mail or phone and does not prohibit leaving messages on answering machines. It says providers should take care to limit the information disclosed, for example leaving only the provider’s name and number and other information necessary to confirm an appointment, or asking the person to call back. The FAQ also allows a message with a family member who answers, with professional judgment and limited information.

For a person who has never been your patient, be stricter still. Leave the practice name, your first name and a call back number. Do not name the specialty if your practice name does not already say it, the condition, or the reason in the request.

No retargeting ads built from form data

A request that went quiet can look like a perfect audience: upload the phone numbers and email addresses, or build a list of people who reached the booking page, and show them ads. For a practice this runs into two sets of rules.

Google’s Health in personalized advertising page lists physical or mental health conditions, invasive medical procedures including cosmetic surgery and injections, and products, services or procedures to treat chronic conditions as sensitive interest content. For ads in a sensitive interest category, it says advertisers can use predefined Google audiences but cannot use advertiser-curated audiences, which include Customer Match, your data segments, audience expansion and lookalike segments. Customer Match is the upload of your own contact lists, and your data segments were previously called remarketing.

On the HIPAA side, the bulletin says disclosures of PHI to tracking vendors for marketing purposes without authorization are impermissible. Uploading the contact details from appointment requests to an ad platform, or letting a pixel on the booking page build an audience, is that kind of disclosure. The 2024 ruling does not change this, because the data here is what people typed, not only an IP address and a page visit.

If you want ads to reach people again, target by location, keywords and predefined audiences, and send the click to a page that offers to book. Our tracking pixels guide covers how to keep ad conversion tags off pages that collect health information.

A safe follow-up script

These are templates to adapt. Replace the bracketed parts, and have your attorney review the final wording. Use them only for requests the person submitted.

Phone call by a staff member

“Hi, this is [first name] from [Practice name] in [Town]. We received an appointment request from this number and wanted to help you finish booking. Is now a good time? Before we go on, may I confirm your full name and date of birth?” Confirm identity before you mention anything from the request. If someone else answers, ask for the person by first name only and leave a call back number.

Voicemail

“Hi, this is [first name] from [Practice name]. We are calling about a request you sent us. Please call us back at [main number] when you have a moment. Thank you.”

Text, where the person consented to texts about their request

“[Practice name]: We got your appointment request and can help you book. Reply with a good time to call, or call [main number]. Reply STOP to opt out.”

Email

Subject: “Your appointment request with [Practice name]”. Body: “Thank you for contacting [Practice name]. We would like to help you finish booking. Call us at [main number] or reply with times that suit you. Please do not send health details by email; we can go over them by phone or on our secure form.” Add your postal address and an unsubscribe link at the bottom.

When to stop

Set a limit before you start. One call and one voicemail, then one text or email if the person consented to it, is a reasonable ceiling for a request that went quiet. Then close it. Record each attempt in your scheduling system, not in a personal phone or a spreadsheet on a laptop.

Stop at once if the person asks you to, whatever the wording. The FCC rules treat replies such as “stop” or “unsubscribe” as a revocation of consent for texts, and a plain request on a call should end calls too. Add the number to your internal do-not-call list.

Questions to ask your form and scheduling vendors

• Does the form save drafts or capture fields before the visitor presses send? Can we turn that off?
• Do you keep form entries, partial or complete, for any purpose of your own, such as training or product analytics?
• Will you sign a business associate agreement, and does it cover the form, the inbox, notifications and backups?
• Which scripts load on the appointment page, and which of them can read form fields?
• Can the form show a separate consent line for calls and texts about the request, and a separate unchecked box for marketing?
• Can we export a record of the consent text each person saw and when they agreed?

Use and avoid

• Use: “We received your appointment request.” Avoid: “We saw you were interested in [treatment].”
• Use: “Call us at [main number].” Avoid: “About your [condition] consultation.”
• Use: “Reply STOP to opt out.” Avoid: a text with no way to opt out.
• Use: one call, one voicemail and one consented message. Avoid: a daily sequence until the person books.
• Use: a count of form starts and sends. Avoid: tools that record what visitors type.
• Use: location and keyword targeting for ads. Avoid: uploading request contacts or booking page visitors as an audience.

An illustration

This example is invented. [Practice name], a chiropractic office in [Town], notices that its booking page gets far more starts than sends. Its marketing tool offers to email anyone who typed an address and left. The office manager asks the form vendor and learns the tool records each field as it is typed and stores it on the vendor’s servers, with no BAA in place.

The practice turns off partial capture, removes the ad pixel and session replay script from the booking page, and shortens the form to name, phone, email and preferred time, with a free text box marked optional. It adds a consent line for calls and texts about the request. For submitted requests that are not booked within a business day, a staff member calls once and leaves the script voicemail, then sends one text if the person agreed to texts. The marketing tool’s ad audience from booking page visitors is switched off, and ads now target the town and search terms instead.

Checklist

• Partial capture, draft saving and field analytics are off on appointment, intake and symptom pages.
• Session replay and ad pixels do not load on those pages.
• Each vendor that receives form entries has a signed BAA that covers that use.
• The form shows a consent line for calls and texts about the request, and a separate unchecked marketing box.
• Follow-up goes only to submitted requests, by staff, with identity confirmed before any detail is discussed.
• Voicemails, texts and emails carry no condition, service or reason for the visit.
• Texts include STOP, and emails that promote services include an opt-out and a postal address.
• A set limit on attempts, logged in the scheduling system, and a do-not-call list for people who opt out.
• No ad audiences from request contacts or booking page visitors.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. On the sites and campaigns we run, appointment pages carry no ad pixels or session replay, forms do not save unsent entries, and ad audiences are built from location and keywords, not from patient requests. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 45 CFR 160.103: Definitions (health information, protected health information)
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (content last reviewed June 26, 2024)
• AHA News: HHS will not appeal AHA court victory in online tracking case (August 29, 2024)
• HHS FAQ: May health care providers leave messages for patients at their homes? (content last reviewed December 28, 2022)
• 47 CFR 64.1200: Delivery restrictions (TCPA rules)
• 15 U.S.C. 7702: Definitions (CAN-SPAM)
• 15 U.S.C. 7704: Requirements for transmission of messages (CAN-SPAM)
• Google Ads policy: Restricted targeting in Personalized advertising
• Google Ads policy: Health in personalized advertising

More in Phones, front desk and patient messages