Rules
HIPAA-Compliant Patient Texting: The Consent and Opt-Out Rules People Miss
HIPAA compliant patient texting turns on two rulebooks: TCPA consent and the HIPAA Privacy Rule, plus the opt-out records most clinics never keep.
What to take away
- Two rulebooks cover one patient text. HIPAA governs the health information inside the message; the TCPA governs permission to send it.
- A compliant disclosure names the sender, the purpose, the opt-out path, and message and data charges.
- A STOP reply ends marketing texts until the patient opts in again, and the opt-out log has to survive an audit.
- Consent records must be producible on request, because the sender carries the burden of proof.
- State law can add requirements, and the stricter rule governs.
A practice that sends appointment reminders is running a marketing channel whether it calls it that or not.
Who holds jurisdiction over patient text messages
The HHS Office for Civil Rights enforces the HIPAA Privacy and Security Rules, which control how protected health information may be used and disclosed. The FCC and the Federal Trade Commission enforce the TCPA, which controls whether you had permission to send the message at all. The HHS Privacy Rule overview lists the permitted uses and disclosures.
State attorneys general can also bring TCPA actions, and several states run health privacy statutes that reach clinics the federal rule already covers. A practice operating in more than one state needs the Healthcare Marketing Compliance picture before fixing message templates, because a state add-on can change the disclosure itself.
What a compliant consent disclosure contains
The disclosure a patient sees before the first text needs five elements.
Five Elements of Consent Disclosure
- Sender identitypractice name on statement
- Purposereminders, recalls, or billing follow-up
- Expected frequencystated as a range
- Opt-outword STOP and what follows
- Message and data rates may apply
Compliant consent disclosure
- Senderthe practice's legal name, not a short code or a staff member's first name.
- Purposewhat the messages cover, such as appointment reminders, billing notices, or service offers.
- Opt-out pathreply STOP, plus any other way to stop the messages.
- Message frequencyhow often messages arrive, stated as a count rather than a vague interval.
- Message and data chargesmessage and data rates may apply.
Sample language a practice can copy:
[Practice name] sends appointment reminders and service updates to this number. Message frequency varies. Message and data rates may apply. Reply STOP to stop messages. Reply HELP for help. Consent is not a condition of treatment.
Replace the brackets with what the practice sends, and archive the exact text each patient agreed to.
A TCPA consent is not a HIPAA authorization. If the text promotes a service the patient has not received, the Privacy Rule generally requires a separate written authorization describing the specific use and noting that the patient can revoke it. The HHS guidance on patient communications shows where that line falls.
Email uses a different consent model. The Healthcare Email Marketing Programs guide covers that channel, and the FTC CAN-SPAM compliance guide sets out the email rules for contrast.
How a STOP reply is handled
The platform suppresses the number as soon as it receives the reply. A person still has to confirm it, because the opt-out log is what an auditor or a plaintiff's lawyer reads.
- The messaging platform stamps the reply and moves the number into the opt-out queue.
- The privacy officer clears the queue at the start of each business day. The front-desk lead covers that duty in the privacy officer's absence.
- Every entry records the number, the STOP timestamp, the name of the person who cleared it, and the timestamp of the last outbound message.
- A send that goes out after a STOP is treated as a potential impermissible disclosure and runs through the same breach assessment as a wrong number.
Records to keep when patients opt in
Records to keep
| Record | What it proves | How long to keep it |
|---|---|---|
| Consent with a date and time | Prior express consent under the TCPA | Four years minimum, six is safer |
| Archived disclosure text | The exact language the patient agreed to | Six years |
| Opt-out requests | The request was honored promptly | Six years |
| Message logs by number | Whether a stray text exposed health data | Six years |
The HIPAA Privacy Rule requires documentation to be kept six years from creation or from the date it was last in effect. The TCPA gives private plaintiffs four years to sue, so an older consent record proves little in court.
Retention Periods by Record Type
Record
- Consent with date and time
- Four years minimum, six safer
- Archived disclosure text
- Six years
- Opt-out requests
- Six years
- Message logs by number
- Six years
Keep
- Consent with date and time
- Archived disclosure text
- Opt-out requests
- Message logs by number
Texting also changes the front end of Patient Acquisition.
What happens when a patient complains
A complaint to the Office for Civil Rights can end in a corrective action plan, outside monitoring, and civil money penalties. A TCPA suit allows statutory damages for every message sent after consent was withdrawn, so exposure scales with volume rather than with any single patient's harm.
A wrong-number text about lab results can start a breach analysis, because the message itself moved health information to someone who was not the patient.
Example: a reminder that reached the wrong phone
A clinic texts a reminder naming a specialist and a medication, but the number was reassigned months earlier and now belongs to a stranger.
The content is protected health information. The clinic must assess the risk and may owe notification under HHS breach notification requirements.
The clinic must document that assessment. The Breach Notification Rule lists four factors: the health information involved, the recipient, whether the recipient viewed it, and the steps taken to reduce the risk.
Keep clinical detail out of texts and ask the patient to log in or call, which avoids most of this.
Where the rules differ by place
Florida, Oklahoma, and Washington run their own telemarketing statutes that require prior express written consent with content the federal rule does not demand. Washington's My Health My Data Act adds separate consent for consumer health data.
Quiet hours vary. The FCC telemarketing window runs from 8 a.m. to 9 p.m. local time where the recipient is. That matters for patients across time zones.
State health privacy laws sit on top of HIPAA, not replace it, so the stricter standard governs. How much texting should carry in the channel mix is a Healthcare Marketing Strategy decision before a legal one.
