Ringless voicemail drops to patients: FCC consent rules and HIPAA limits

Ringless voicemail, also sold as a voicemail drop, puts a recorded message straight into a patient’s voicemail box without the phone ringing. For a busy practice it looks like a gentle way to send a reminder, a recall nudge or a promotion: no interruption, no missed call, just a message waiting. The FCC does not see it as gentle. In 2022 it ruled that a ringless voicemail to a cell phone is a call made with a prerecorded voice, so the consent rules for robocalls apply to it in full.

This guide is for practice owners and office managers who are offered a voicemail drop tool, or who already use one. It covers what the FCC decided, which consent each kind of message needs, the narrow health care exemption, what the message itself has to say, how patients opt out, and what HIPAA asks about the words you leave in a voicemail. Texting rules are covered in our guide to text message appointment reminders and our guide to marketing texts, and live and recorded sales calls in our guide to marketing calls, Do Not Call and the Telemarketing Sales Rule. Following up with people who start a booking form and leave is covered in our guide to abandoned appointment requests, and greetings with offers are covered in our guide to birthday and holiday messages.

The short version

• The FCC ruled in FCC 22-85 that a ringless voicemail to a cell phone is a call made with an artificial or prerecorded voice under 47 USC 227(b)(1)(A)(iii). It needs consent.
• A drop that advertises or promotes a service needs the patient’s prior express written consent (47 CFR 64.1200(a)(2), (a)(3)), unless it delivers a HIPAA health care message from a covered entity.
• Appointment reminders and the other listed health care messages to cell phones can go out under a narrow exemption in 64.1200(a)(9)(iv), with limits on content, length, frequency and opt-outs.
• Each prerecorded message must name the practice at the start and give a callback number (64.1200(b)). Exempt and marketing messages left in voicemail also need a toll-free opt-out number.
• HHS says practices may leave messages for patients but should limit what the message discloses. Leave the practice name, a number and what is needed to confirm an appointment.
• Patients can revoke consent by any reasonable means (64.1200(a)(10)). Stop the drops when they do.

What ringless voicemail is, and what the FCC decided

A ringless voicemail service uses the patient’s mobile number to deposit a recorded message in the voicemail box tied to that number, without the handset ringing. The company that asked the FCC to rule, All About the Message, LLC, argued that this was not a call at all and so needed no consent. The FCC denied that request in its Declaratory Ruling and Order FCC 22-85, adopted November 14, 2022 and released November 21, 2022, in CG Docket No. 02-278.

The ruling found that a ringless voicemail to a wireless phone is a call made using an artificial or prerecorded voice, covered by section 227(b)(1)(A)(iii) of the Telephone Consumer Protection Act, and so it requires consumer consent. The FCC said the ruling applies to any entity that provides ringless voicemail using the end user’s mobile number. It also said its decision does not stop anyone from using ringless voicemail. It means the sender must follow the TCPA while doing so.

The ruling addressed wireless phones. We found no FCC ruling on ringless voicemail to landlines as such. A recorded message to a residential line is covered by 47 CFR 64.1200(a)(3) whichever way it is delivered, and we recommend treating drops to landlines with the same care as drops to cell phones.

Which consent each message needs

47 CFR 64.1200(a)(1)(iii) bars a call to a cell phone using an artificial or prerecorded voice unless it is made for emergency purposes or with the prior express consent of the called party. Prerecorded voice is the part that matters here, because a voicemail drop is a recorded message. From there the rules split by what the message is for.

• Marketing. 64.1200(a)(2) bars a prerecorded call to a cell phone that includes or introduces an advertisement or constitutes telemarketing, unless the patient gave prior express written consent. 64.1200(a)(3) sets the same written consent rule for residential lines. Telemarketing is defined in 64.1200(f) as a call or message to encourage the purchase of goods or services.
• Written consent. Under 64.1200(f)(9), prior express written consent is a signed written agreement, electronic signatures included, that names the phone number and clearly authorizes prerecorded or autodialed marketing calls. It must disclose that the patient does not have to agree as a condition of buying anything.
• HIPAA health care messages. 64.1200(a)(2) and (a)(3) carve out a call that delivers a health care message made by, or on behalf of, a covered entity or its business associate, as those terms are defined in 45 CFR 160.103. Such a message does not need written consent, though the (a)(1) consent rule for cell phones and the limits below still apply.
• Residential health care messages. 64.1200(a)(3)(v) allows a health care message to a patient’s residential line with no more than one call per day, up to three calls combined per week, and the practice must honor opt-out requests.

A promotional drop, such as a new service, a seasonal offer or a membership plan, is the clearest case. Under the FCC rule it needs prior express written consent. Under HIPAA, a communication that is marketing needs the patient’s authorization under 45 CFR 164.508(a)(3), which is a separate document from TCPA consent. Our guide to birthday and holiday messages walks through when an added offer turns a message into marketing.

The health care exemption, condition by condition

47 CFR 64.1200(a)(9)(iv) exempts certain calls to cell phones made by, or on behalf of, health care providers from the (a)(1)(iii) consent rule. The paragraph says the term call includes a text message, and under FCC 22-85 a ringless voicemail is a call. The exemption only holds when the call is not charged to the patient or counted against their plan limits, and when the provider meets all of these conditions:

• Sent only to the wireless number the patient provided.
• States the name and contact information of the provider. For voice calls, this comes at the beginning.
• Strictly limited to these purposes: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions.
• No telemarketing, solicitation or advertising, and no accounting, billing, debt collection or other financial content. The message must comply with HIPAA privacy rules.
• Concise: generally one minute or less for a voice call.
• No more than one message per day to each patient, up to three voice calls or texts combined per week.
• An easy way to opt out in each message. A voice call that could reach voicemail must include a toll-free number the patient can call to opt out of future health care calls.
• Opt-out requests honored immediately.

Two points catch practices. A balance reminder or a payment link is financial content, so it falls outside the exemption. A recall drop that also mentions a new cosmetic service is advertising, so it falls outside the exemption too. Both then need the consent the rules above require. Our guide to text message appointment reminders covers the same exemption for texts.

What the message has to say

47 CFR 64.1200(b) applies to all artificial or prerecorded voice telephone messages, and a voicemail drop is one. It asks for three things:

• At the beginning, the identity of the business responsible for the call. For a business, that is the name under which it is registered with the state. A practice that markets under a trade name should check which name its state registration shows.
• During or after the message, a callback number for the practice, not the number of the system that placed the call. For telemarketing and for messages under the residential exemptions in (a)(3)(ii) to (v), that number must let the person make a do-not-call request during regular business hours.
• For telemarketing, and for messages under those residential exemptions, an automated opt-out. When the message is left on an answering machine or voicemail, it must also give a toll-free number that connects to the automated opt-out and records the number on the practice’s do-not-call list.

A ringless drop is built to land in voicemail, so plan for the toll-free opt-out line from the start. The health care exemption in (a)(9)(iv) asks for a toll-free opt-out number in voicemail messages as well.

When a patient says stop

Under 47 CFR 64.1200(a)(10), a called party may revoke prior express consent, including prior express written consent, by any reasonable method that clearly expresses a desire not to receive further calls or texts. Using an automated opt-out on a call, or a website or phone number the caller designated for opt-outs, counts as a reasonable means per se. Once revoked, the practice may not send more robocalls or robotexts on that consent.

A patient who calls the front desk and says “stop leaving me those messages” has used a reasonable method. No federal rule says how a practice should record that. We recommend one opt-out list shared by the front desk, the drop tool and the texting tool, so a stop request made in one place stops all prerecorded messages that rely on that consent.

HIPAA: what a voicemail may say

HHS answers this in its FAQ on leaving messages for patients. The Privacy Rule permits providers to communicate with patients at home by mail, phone or other means, and does not prohibit leaving messages on answering machines. HHS says practices should take care to limit the amount of information disclosed, and gives as an example leaving only the practice name and number and other information necessary to confirm an appointment, or asking the patient to call back. HHS appointment reminder guidance treats reminders as part of treatment, so they can be sent without an authorization.

A voicemail box is not a private space by design. A shared family phone, a work phone or a speaker can expose the message to others. 45 CFR 164.530(c) asks practices to reasonably safeguard protected health information from intentional or unintentional disclosure. 45 CFR 164.522(b) requires a provider to accommodate reasonable requests to receive communications by alternative means or at alternative locations, and HHS’s FAQ gives calls at the office rather than at home as an example of a reasonable request. When a patient has asked not to receive voicemails, the drop tool must honor it.

The minimum necessary standard in 45 CFR 164.502(b) does not apply to disclosures made to the patient themselves (164.502(b)(2)(ii)), so the reason to keep voicemails short is the risk that someone else hears them. We recommend scripts that leave out the visit type, the clinician’s specialty when it reveals a condition, test names and results. A drop can say a result is ready and ask the patient to call or check the portal.

What happens when it goes wrong

47 USC 227(b)(3) lets a person sue for a violation of the TCPA’s robocall rules and recover their actual loss or 500 dollars for each violation, whichever is greater. If the court finds the violation was willful or knowing, it may increase the award to up to three times that amount. Each unwanted drop can be a separate violation. The FCC can also bring its own enforcement action under 47 USC 227(b)(4).

Questions to ask a voicemail drop vendor

• Will your system send messages only to numbers we upload, and only the numbers patients gave us?
• Can we set separate campaigns for exempt health care messages and for marketing, with separate consent lists?
• How does the system cap messages at one per day and three per week per patient for exempt messages?
• Does each message start with our registered business name and give our callback number and a toll-free opt-out number?
• How do opt-outs from your toll-free line reach our front desk list, and how fast?
• Will you receive appointment details or other patient information? If so, will you sign a business associate agreement under 45 CFR 160.103?
• Where are message logs and recordings stored, for how long, and who can see them?

Use and avoid

Use: short reminder scripts with the practice name first, a callback number and a toll-free opt-out line; signed written consent before any promotional drop; HIPAA authorization when the drop is marketing; one shared opt-out list; frequency caps set in the tool; and records of consent with dates.

Avoid: drops to purchased or scraped numbers, promotions sent under the health care exemption, balance or payment messages under the exemption, test names or diagnoses in the message, drops to patients who asked for no voicemails, and vendors that will not say who receives your patient list.

An illustration

This example is invented. [Practice name], a chiropractic practice, is offered a voicemail drop tool and wants to use it for two things: next-day appointment reminders and a spring promotion for a new service. The office manager splits them. Reminders go to the cell numbers patients gave at intake, open with the practice’s registered name, run under thirty seconds, say only the day and time, give the front desk number and a toll-free opt-out line, and the tool caps them at one a day and three a week. The promotion goes only to patients who signed a written consent form for prerecorded marketing calls that names their number and says signing is not required to receive care, and who also signed a HIPAA marketing authorization. When a patient tells the front desk to stop the messages, staff add the number to the shared opt-out list the same day. The vendor receives appointment times, so the practice signs a business associate agreement before the first upload.

Checklist

• Messages sorted into exempt health care, other informational and marketing, with the consent each needs.
• Prior express written consent on file before any promotional drop, meeting 47 CFR 64.1200(f)(9).
• HIPAA marketing authorization under 45 CFR 164.508(a)(3) where the drop is marketing.
• Exempt messages limited to the listed purposes, no financial content, one minute or less, one per day and three per week.
• Registered business name at the start, callback number, and a toll-free opt-out number in each voicemail.
• One opt-out list across front desk, drop tool and texting tool, honored immediately.
• Scripts that leave out conditions, tests and results.
• Confidential communication requests honored in the tool.
• Business associate agreement with a vendor that receives patient information.
• State call and telemarketing laws reviewed by a health care attorney.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For patient outreach by phone, we help sort messages by the consent they need, set up intake consent wording for your attorney to review, and connect opt-outs to the front desk. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• FCC 22-85: Declaratory Ruling and Order on ringless voicemail, CG Docket No. 02-278 (released November 21, 2022)
• 47 USC 227: Restrictions on use of telephone equipment
• 47 CFR 64.1200: Delivery restrictions
• HHS FAQ: May health care providers leave messages for patients at their homes? (content last reviewed December 28, 2022)
• HHS FAQ: Are appointment reminders allowed under HIPAA without authorization? (content last reviewed December 28, 2022)
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.522: Rights to request privacy protection
• 45 CFR 164.530: Administrative requirements
• 45 CFR 160.103: Definitions (business associate, covered entity)

More in Phones, front desk and patient messages