How California, Washington, and Florida differ on patient consent for outreach texts

What to take away

What to take away

The TCPA federal floor for text and email outreach

The Telephone Consumer Protection Act is the baseline every healthcare marketer in the United States already answers to. It restricts automated calls and texts to cell phones, and it treats a text message as a call for that purpose.

The Federal Communications Commission explains the robocall and robotext rules, including the prior express consent a caller needs before autodialed or prerecorded outreach. See the FCC's robocall and text rules.

Consent under the TCPA comes in two strengths. Prior express consent covers informational calls and texts. Prior express written consent is the higher bar, and it applies when the message is marketing. A patient who gives a phone number at check-in for appointment reminders has not necessarily agreed to promotional texts.

That distinction matters for a practice group running appointment reminders and service line promotions through one platform. The reminder may sit at the lower tier. The promotion generally does not.

Email is not covered by the TCPA's robocall provisions, but the CAN-SPAM Act applies to commercial email, and state law can add more. A patient portal message is a different channel again, and it usually falls under HIPAA and the platform's own terms rather than the TCPA.

The federal floor also gives patients a revocation right. A patient can withdraw consent at any time by any reasonable means, and the sender has to honor it. That is a floor, not a ceiling, and the three states below raise it.

Where HIPAA fits

HIPAA governs protected health information held by covered entities and their business associates. It does not require consent for treatment, payment, and operations, but marketing uses of PHI generally need written authorization. The HHS regulations at 45 CFR Subtitle A set out the authorization standard and the content it must include.

HIPAA does not preempt stricter state law. Where a state gives patients more control over their health data, the state rule stands. That is the mechanism that makes this a three-state comparison rather than a single federal answer.

California CMIA consent rules and what they add

The Confidentiality of Medical Information Act is California's medical privacy statute, and it is older and in some respects tighter than HIPAA. It limits disclosure of medical information by providers, health plans, and contractors without patient authorization.

The operative text sits in the California Civil Code: § 56.10 limits disclosure of medical information, § 56.11 sets out what a valid authorization must contain, and § 56.36 supplies the private right of action and the damages. The state publishes the CMIA consent provisions.

For outreach, CMIA adds three things a federal-only program can miss.

First, authorization is a defined instrument. It has to identify the information, who may disclose it, who may receive it, and the purpose. A blanket consent buried in an intake packet is weak evidence for a marketing disclosure.

Second, CMIA restricts use of medical information for marketing without authorization. California layers a second disclosure duty on the same outreach: a provider who communicates with a patient about a health-related product or service must disclose whether it received compensation for that communication, under Health and Safety Code § 119400.

That is not the end of the California list. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, Cal. Civ. Code § 1798.100 et seq., gives patients the right to opt out of the sale or sharing of their personal information and to limit the use of sensitive personal information, a category that includes health data. A marketing list built from patient records can trigger those rights.

Third, CMIA has a private right of action and statutory damages. That changes the risk profile. A TCPA claim is expensive, but a CMIA claim can be brought by the patient directly, and the statute sets nominal damages per violation.

What this means for a text campaign

If a California patient's phone number was collected in a clinical encounter, using it for a promotional text about a service line is a disclosure of medical information for a purpose beyond treatment. That is the fact pattern to test your consent language against.

A practical approach is to separate transactional messaging from promotional messaging at the point of capture, and to keep the authorization record for the promotional stream. Our article on consent and opt-out rules walks through how that split works in practice.

Washington My Health My Data and its reach

Washington's My Health My Data Act is the broadest of the three. It regulates consumer health data, a category that is defined by what the data reveals about a person's health, not by who holds it. Chapter 19.373 RCW is the controlling text, and the state publishes the My Health My Data chapter.

The obligations took effect for most regulated entities on March 31, 2024, and for small businesses on June 30, 2024. Enforcement runs through the state Consumer Protection Act, RCW 19.86.

The law reaches entities that are not covered entities under HIPAA. It also reaches data that never touched a medical record: a search on a symptom, a purchase, a location visit, a wearable reading. If a practice group buys audience data or runs a retargeting pixel on a symptom page, that activity can fall inside the statute.

Consent is the core obligation. A regulated entity must get consent before collecting consumer health data, and it must get separate consent before sharing it. Consent has to be collected in a way that is clear and separate from other terms.

There is also a geofencing provision. It restricts using geofences around health facilities to identify or track people for advertising. A marketing team running location-based ads near a clinic in Washington needs to check that rule before launch.

The law gives consumers rights to access and delete their health data, and it allows a private right of action under the state Consumer Protection Act. That is the same enforcement hook that has made the statute a priority for compliance teams nationwide.

Why it reaches out-of-state groups

My Health My Data applies based on the consumer's location, not the company's. A Texas practice group texting a patient who lives in Washington can be covered. So can a national campaign that includes Washington residents in its audience.

That is the practical trap. A compliance program built on HIPAA alone will not see this statute, because it governs data that HIPAA never covered.

Florida consent statutes and data protection obligations

Florida does not have a single comprehensive consumer privacy statute in the style of Washington. For outreach texts, the governing rule is the Florida Telephone Solicitation Act, Fla. Stat. § 501.059. Alongside it sits a data breach notification law that applies to health information.

The FTSA requires prior express written consent before a marketing call or text to a Florida number. The statute defines that consent as a signed written agreement that names the number to be contacted and states that signing is not a condition of any purchase. It also carries a private right of action, so a Florida patient can sue directly over an unwanted marketing text. A 2023 amendment reworked the statute's automated-system language, but the written-consent requirement for marketing outreach stands.

The Florida Information Protection Act, at Chapter 501 Section 171, sets the state's breach notification duties. It requires covered entities to notify affected individuals and the Department of Legal Affairs after a breach of personal information, including medical information and health insurance policy numbers. The Florida Senate publishes the Florida data protection statute.

The statute sets a notice deadline of 30 days after determination of a breach, which is tighter than the 60 days in the HIPAA breach rule. When both apply, the shorter clock governs. That is a concrete example of a stricter state rule winning.

Florida regulates HIV test results and other sensitive categories through separate statutes with their own consent duties. HIV testing and the confidentiality of results sit in Fla. Stat. § 381.004, and disclosure of patient records by a health practitioner sits in Fla. Stat. § 456.057, which requires written authorization as a rule. A general consent form does not satisfy those provisions.

Florida's telephone solicitation rules add another layer. The state maintains its own do-not-call list and restricts certain automated calls, which is why a Florida campaign should be screened against both the federal and state lists.

What Florida adds for outreach

Florida contributes a consent instrument of its own. A Florida marketing text needs the signed, number-specific written consent the FTSA describes, which is a narrower document than a single checkbox at check-in. The breach law then adds the exposure: if your outreach platform stores patient phone numbers and service line interest flags, that data is personal information under § 501.171.

A breach in that system triggers the 30-day clock, notice content requirements, and potential civil penalties. Vendor contracts and business associate agreements should name who notifies whom, and by when.

Where the stricter rule wins in each state

Stricter rule analysis is the discipline of comparing two applicable regimes and building to the one that gives the patient more control. It is not a legal opinion. It is an operational choice that keeps one campaign from failing in one state.

Read the table by column. A California patient in a Washington clinic is unusual, but a national campaign touches all three regimes at once, and the campaign has to satisfy each one for the patients it reaches.

In California, CMIA usually wins over the TCPA on the use of medical information, because it adds an authorization requirement and a purpose limitation. In Washington, My Health My Data wins over both, because it captures data the other two do not reach.

In Florida, the FTSA is the stricter rule on consent to marketing texts, and the 30-day breach notice clock in § 501.171 is the stricter rule on security incidents. The state do-not-call list is stricter than the federal floor on outbound calling.

Two more statutes sit underneath those three regimes and cover the same data. California's breach notification law is Cal. Civ. Code § 1798.82, and Washington's is RCW 19.255.010. Both require notice to affected individuals and to the state, on timelines that can run shorter than the federal one.

The rule of the stricter standard

When two rules apply, apply the one that gives the patient more control and requires more of you. That single operating rule resolves most multi-state conflicts without a state-by-state policy for every campaign.

It also simplifies vendor management. One consent standard, set to the highest bar, is easier to audit than three parallel ones.

Consent capture and documentation across three states

Consent documentation requirements are where most programs fail an audit. A patient may well have agreed to texts. If you cannot show what they agreed to, when, and through what channel, the agreement is hard to defend.

Build the record around five fields: the source of the consent, the timestamp, the channel, the scope of what the patient agreed to, and the exact language they agreed to.

Keep the record for the life of the consent plus the applicable limitations period. State statutes and the TCPA have different windows, so the safe practice is to keep the record longer than the shortest one.

A worked example

A practice group runs a flu shot reminder in October and a wellness program promotion in January. The reminder is transactional and the promotion is marketing.

The intake form captures a phone number and a single checkbox that says the patient agrees to receive text messages. That checkbox is enough for the reminder in most states.

It is not enough for the promotion in California, where the marketing use needs authorization, and it is not enough in Washington, where collection of health data needs its own consent.

The fix is a second, separate opt-in for promotional messages, with its own language and its own record. The patient who declines still gets the reminder. The patient who accepts gets both, and the record shows why.

Checklist before launch

Our patient outreach metrics healthcare guide covers the wider program, including the parts that sit outside texting.

Opt-out and revocation handling state by state

A patient can revoke consent, and the revocation does not need to use your preferred method. The TCPA honors revocation by any reasonable means, and state law does not narrow that.

California adds a practical wrinkle. If a patient asks you to stop using their medical information for a purpose, CMIA and the state's privacy framework give that request weight beyond the text channel. The opt-out has to propagate to email, direct mail, and any audience list the patient appears on.

Washington gives consumers rights to delete their health data, not just to stop messages. A deletion request is not the same as an opt-out, and the two need separate workflows. Deletion has to reach backups and vendors, not only the live marketing platform.

Florida's do-not-call list is a separate suppression source. A patient who is on the state list should be suppressed from outbound calling campaigns even if they gave consent, unless a specific exemption applies.

How fast is fast enough

The federal standard is to honor a revocation within a reasonable time, and the practical benchmark most compliance teams use is 10 business days or less. For texts, the expectation is closer to immediate, because the message channel is instant.

A revocation received at 9 a.m. should stop a 2 p.m. send. If your platform batches sends daily, the batch needs a suppression refresh before it goes out.

Record the revocation too

Document the revocation the same way you document consent: who, when, how, and what scope. A record that shows a patient opted out on a given date is your defense if a later message is disputed.

That record also matters because regulators and plaintiffs look for patterns across a program rather than a single error, which is how the hipaa compliant call tracking examples get used in disputes.

Building one outreach policy that satisfies all three

One policy can cover California, Washington, and Florida if you set it to the strictest element in each category. That is the whole method: pick the highest bar for consent, the highest bar for data scope, and the shortest clock for breach notice.

Start with scope. Assume the campaign touches consumer health data, because in Washington it may. That assumption pulls in Washington's consent requirements for collection and sharing, and it forces a data map of every system that holds patient contact data.

Then set consent. Use a separate promotional opt-in with versioned language, and add a CMIA-style authorization for California marketing uses. The Washington consent sits alongside it, not instead of it.

Then set the clocks. Use the 30-day Florida breach notice deadline as the internal standard for every state, because it is the shortest. Use 10 business days as the outside limit for opt-out processing, and shorter for text.

Then set the vendors. Every platform that touches patient contact data needs a business associate agreement where HIPAA applies, and a data processing addendum where it does not. The contract should name notification duties, deletion support, and the suppression refresh cadence.

Assign owners and test

A policy without an owner drifts. Name one person for consent capture, one for suppression, and one for vendor contracts. Review the consent language every time a campaign changes what it promotes.

Run a test each quarter. Send a promotional text to an internal number, revoke consent, and confirm the next send stops. Pull one California authorization and one Washington consent record and check that each has all five fields.

Our healthcare marketing compliance guide covers the program structure around this policy. Groups that also run outreach in Canada face a different privacy statute, and the cross-border patient review notes collect those edge cases.

Where the policy still needs counsel

This article describes statutes and operational practice. It is not legal advice. Consent language, authorization forms, and breach response plans should be reviewed by counsel licensed in each state where you operate, because the analysis turns on facts about your data flows that no general article can supply.

Common questions