HIPAA and patient outreach, what appointment reminders and review requests can say

What to take away

• HIPAA patient outreach splits into two buckets: treatment, payment and health care operations communications, which need no authorization, and marketing, which usually does.
• Appointment reminders, refill reminders and most care coordination messages sit inside treatment, so you can send them to a current patient without written permission.
• Review requests are the risky ones. Ask every patient for a public review and you have a marketing communication that needs an authorization.
• The HHS Office for Civil Rights marketing guidance is the document that draws the line, and it turns on who is paying and whether the message pushes a product or service.
• If a message crosses the line, you need a valid HIPAA marketing authorization, and you also need to watch the Telephone Consumer Protection Act and state laws such as California's CMIA.
• Write down why each campaign was classified as treatment or marketing. That record is what you hand an OCR investigator.

How the HIPAA Privacy Rule defines treatment, payment, and health care operations

The HIPAA Privacy Rule treatment, payment, and operations definition is the hinge for every reminder and review request you write. Get the classification wrong and the whole campaign is an unauthorized use of protected health information.

The Privacy Rule lives in 45 CFR Subchapter C, alongside the other administrative data standards. 45 CFR Subchapter C is where you look when a vendor asks whether a particular disclosure is permitted.

Treatment means providing, coordinating or managing health care, including consultations between providers. Payment covers billing, claims, eligibility checks and collections. Health care operations covers quality assessment, business planning, compliance and customer service.

All three are permitted uses. You do not need patient authorization to use or disclose protected health information for them, provided you follow the minimum necessary standard and your notice of privacy practices describes what you do.

Marketing is defined separately, and it is narrower than most practice managers assume. It is a communication about a product or service that encourages the recipient to buy or use that product or service.

Two exceptions matter most. A face-to-face communication is exempt. So is a promotional gift of nominal value. Neither exception helps a text message or an email, which is where most outreach happens.

There is also a treatment exception inside the marketing definition. If the communication is made to recommend or direct a patient to a product or service that is part of the patient's treatment, it is not marketing. That exception is doing a lot of work in reminder copy.

Read the baseline requirements before you draft anything. HIPAA Guidance Materials collects the Privacy Rule text, the marketing guidance and the refill reminder guidance in one place.

Where appointment reminders sit inside treatment communications

Appointment reminders are treatment communications. They coordinate care for someone already in a treatment relationship with your practice, and they do not encourage the patient to buy anything.

That means no authorization is needed to text, call or email a patient that their visit is on Thursday at 2:15. It also means the reminder can name the provider and the service, because that is care coordination, not promotion.

The reminder has to stay a reminder, though. The moment it starts selling, the classification shifts.

Here is the practical test. Does the message help the patient show up for care you have already scheduled, or does it try to get the patient to buy something new? The first is treatment. The second needs a closer look.

Reminders also sit comfortably inside the permitted uses and disclosures for patient communications. HIPAA FAQs for Professionals answers the common questions about what a covered entity may send a patient without authorization.

Treatment communications such as refill and appointment reminders get their own treatment in the HHS guidance. The HIPAA Privacy Rule and Refill Reminders explains how far the treatment exception reaches.

One caveat: the treatment relationship has to exist. A reminder to someone who has never been seen, or who has been discharged, is not coordinating anything. That is a prospect, and prospect outreach is marketing.

Many practices still ask how HIPAA-compliant call tracking fits into appointment reminders when the reminder also mentions a service line. The answer depends on whether the mention directs existing treatment or solicits new business.

If your no-show rate is the real problem, fix it with reminder timing and channel choice rather than promotional copy. You can cut no-shows without breaking HIPAA rules by keeping the message clinical and short.

Why review requests often tip into marketing under the Privacy Rule

A review request is not a treatment communication. Asking a patient to post a public rating does not coordinate care, bill a claim or improve your internal operations.

It promotes your practice. That is the definition of marketing under the Privacy Rule, and it triggers the authorization requirement.

Some practices argue that reputation management is a health care operation. It is not, in the ordinary case. Operations covers quality assessment and business planning, and a public review is neither.

There is a genuine gray zone. If you survey patients privately to assess quality, that is operations. If you ask them to publish that assessment on Google, Yelp or Healthgrades, the audience changes and so does the classification.

The distinction is where the feedback goes. Internal quality data is operations. Public persuasion is marketing.

The FTC also has an interest here. Its Health Products Compliance Guidance covers advertising claims for health-related products and services, and it applies to review solicitation that makes claims about outcomes.

State law adds another layer. California's Confidentiality of Medical Information Act and Washington's My Health My Data Act impose their own limits on using patient information, and neither is preempted by HIPAA where it is stricter.

So a compliant review request usually needs two things: a HIPAA marketing authorization signed by the patient, and a review of the state rules where the patient lives.

The good news is that a signed authorization removes most of the ambiguity. The bad news is that most practices have never asked a patient to sign one, and a box checked at the front desk is not it.

Our healthcare marketing compliance guide walks through the surrounding rules, including TCPA consent and vendor agreements.

Reading the HHS marketing guidance against real reminder wording

The HHS Office for Civil Rights marketing guidance is short and specific. It says a communication is marketing if it encourages a recipient to purchase or use a product or service, and it lists the narrow exceptions.

When patient outreach counts as marketing and requires authorization is the central question that document answers. Marketing | HHS.gov is the primary source to cite in your policy.

Apply it line by line to your templates. The table below shows how the same underlying message changes classification with a few words.

Message	Classification	Authorization needed
Reminder: your visit with Dr. Ruiz is Tuesday at 9:00	Treatment	No
Reminder: your diabetes follow-up is Tuesday, please fast	Treatment	No
Reminder: new patients get 20 percent off their first Botox visit	Marketing	Yes
Request: please tell us how we did on our patient survey	Health care operations	No
Request: please leave us a five-star review on Google	Marketing	Yes
Refill: your lisinopril is due for renewal, reply to confirm	Treatment	No
Refill: switch to our pharmacy's generic lisinopril and save	Marketing	Yes

The pattern is consistent. Clinical detail plus logistics stays in treatment. Discounts, incentives, brand promotion and public review requests move into marketing.

Watch for compound messages. A reminder that ends with a promotional line does not become treatment because the first sentence was. The whole communication is classified together.

That is why splitting campaigns matters. Keep the clinical reminder in one message and the promotional offer, if you send one at all, in a separate communication with its own lawful basis.

Refill reminder guidance and what it says about drug-specific outreach

The refill reminder guidance addresses a narrow but common case: communications about a drug or biologic the patient is currently prescribed.

The guidance says these communications are treatment communications, not marketing, when they are made to the individual currently being prescribed the drug. That covers refill reminders, adherence nudges and generic equivalents.

The limits matter. The communication cannot be paid for by a third party in a way that turns it into a promotional arrangement, and it cannot encourage the patient to switch to a different product for the manufacturer's benefit.

A refill reminder for the drug the patient already takes is treatment. A message promoting a competing drug, or a message subsidized by a manufacturer to push its own brand, is marketing.

Financial remuneration is the tell. If someone is paying you to send the message, examine the arrangement before you send it.

This is where the FDA's Office of Prescription Drug Promotion also enters, because promotional communications about prescription drugs carry their own requirements separate from HIPAA.

Practical rule: keep refill messages clinical and specific to the current prescription. Include the drug name, the renewal timing and a way to confirm. Leave out savings offers and brand comparisons.

Medication adherence reminders also fit here when they reference the current regimen. A reminder to take a prescribed drug is treatment. A reminder to try a new supplement is not.

When authorization is required and how to write one that holds

The Authorization requirement for marketing communications is the rule that governs review requests, promotional offers and most cross-selling. Without a valid authorization, those communications are not permitted.

An authorization is a specific document, not a consent form and not a privacy notice acknowledgment. It has required elements, and OCR has been clear that a deficient authorization does not protect you.

Here is what a workable authorization includes.

1. A specific description of the information to be used or disclosed, written so an average reader can follow it.
2. The name of the person or entity authorized to make the disclosure and the person or entity receiving it.
3. A description of each purpose of the disclosure, including whether it is for marketing.
4. An expiration date or event that ends the authorization.
5. A statement of the patient's right to revoke in writing, plus the effect of revocation.
6. A statement that the information may be redisclosed by the recipient and may no longer be protected.
7. The patient's signature and date, and a note that treatment, payment and enrollment cannot be conditioned on signing, with limited exceptions.

Every element has to be present. A missing expiration date is enough to invalidate the document.

Keep the authorization separate from your general consent paperwork. Bundling it into a stack of intake forms invites a claim that the patient did not knowingly agree.

Track revocations. If a patient revokes, stop the marketing communication, and make sure the suppression reaches any vendor running the campaign.

Marketing authorizations also interact with texting consent. The consent and opt-out rules for patient texting are a separate requirement, and TCPA consent is not the same thing as a HIPAA authorization.

You need both when you send marketing by text. HIPAA governs the use of the health information. The TCPA governs the call or message itself.

Wording that stays inside treatment versus wording that crosses the line

This section is the working reference. Use it when you are editing templates.

Appointment reminder wording examples that stay inside treatment:

• Your appointment with Dr. Chen is Thursday, March 5, at 2:15 p.m. Reply C to confirm or R to reschedule.
• This is a reminder for your annual physical on Monday. Please arrive 10 minutes early and bring your medication list.
• Your follow-up for your knee injury is scheduled for next Tuesday. Call us if you need to move it.
• Reminder: lab work is due before your visit. Fasting is required for this test.
• Your telehealth visit starts at 4:00 p.m. today. Click the link in your portal to join.

Patient review request wording examples that cross into marketing:

• We would love a five-star review on Google. It takes 30 seconds and helps other patients find us.
• Were you happy with your visit? Please rate us on Healthgrades.
• Leave a review and receive 10 percent off your next cosmetic service.
• Tell your friends about us, and share your experience on Yelp.
• Help us reach 500 reviews this year.

Notice the difference. The first list is logistics and clinical instruction. The second list asks the patient to promote the practice to the public, which is marketing.

A private satisfaction survey is different from a public review request. If the results stay inside the practice and feed quality improvement, the survey is a health care operation and no authorization is needed.

If you want to send review requests without authorizations, the safest path is to ask for feedback privately, then let satisfied patients decide on their own to post publicly. Do not direct them to a platform.

Some practices also rely on the treatment exception for messages that recommend a service. That exception is narrow. It covers directing a patient to a product or service that is part of their current treatment, not a general recommendation to try something new.

Audit your templates against these lists each quarter. Copy drifts, and a line added by a marketing vendor can reclassify an entire campaign.

If you are working through the edge cases, our guide to CASL healthcare email marketing compliance covers the questions that come up most often.

Documenting your outreach decisions for OCR

OCR investigations rarely start with a reminder. They start with a complaint, a breach report or a random audit, and they end with a request for your policies and your records.

What you want to be able to produce is a written rationale for each campaign. Why was this classified as treatment? What was the basis for sending it without authorization? Who approved it?

A simple campaign record works. Include the message text, the audience, the sender, the legal basis, the reviewer and the date.

Keep the classification decision with the template. A future staff member reading the file should see immediately why the message was permitted.

Document vendor arrangements too. A business associate agreement is required when a vendor handles protected health information on your behalf, and the agreement should describe what the vendor may do with the data.

If a vendor pays you to send a message, document that separately. Remuneration is the fact that most often turns a treatment communication into marketing.

Review the record annually and when the rules change. The ONC, CMS and state legislatures all touch patient communications, and state privacy laws in California, Washington and elsewhere keep moving.

A documented, consistent process is the strongest defense you have. It shows OCR that the practice made a reasoned decision rather than an accidental disclosure.

Common questions

Can we text appointment reminders without patient authorization? Yes, when the patient is in a current treatment relationship and the message coordinates that care. You still need a phone number the patient provided and a process for opt-outs, and TCPA rules apply to the message itself.

Do we need authorization to ask patients for online reviews? Usually yes. A public review request promotes the practice, which makes it marketing under the Privacy Rule. A private satisfaction survey that stays internal is a health care operation and does not need one.

What makes a HIPAA marketing authorization valid? It needs a description of the information, the parties, each purpose, an expiration date, a revocation statement, a redisclosure statement and the patient's signature. Missing any required element can invalidate it.

Can we include a discount in an appointment reminder? Not safely. A discount encourages the patient to buy a service, which pulls the whole message into marketing. Send promotional offers separately with an authorization.

Are refill reminders treated differently from other messages? Yes. Communications about a drug the patient is currently prescribed are treatment communications, provided no third party is paying to promote its own product and the message stays clinical.

What records should we keep if OCR asks about our outreach? Keep the message text, audience, legal basis for sending, approver and date, plus business associate agreements and any remuneration arrangements with vendors.