Patient Text Message Consent: Opt-Outs, Calling Hours and What to Record

Patient text message consent is the patient's agreement to receive texts from your practice, and the record that proves they gave it. Two sets of federal rules shape it: the TCPA, which governs automated calls and texts and is enforced by the FCC, and HIPAA, which governs how patient information is protected. This guide explains both in general terms, how to handle opt-outs and calling hours, and what to write down. It is not legal advice. Rules change and state laws can be stricter, so talk to your counsel before you set your policy.

Which rules apply when a practice texts patients?

Three layers can apply at once.

• The TCPA. It restricts calls and texts to mobile numbers sent with an autodialer or a prerecorded or artificial voice. In general, these need the patient's prior express consent, and marketing messages need prior express written consent. Texts count as calls for TCPA purposes.
• HIPAA. It does not ban texting. It sets rules for protecting patient information, including the minimum necessary standard, and it lets a patient ask to receive messages in a less secure form once they have been told the risk.
• State law. Some states have their own telemarketing, texting or calling-hours laws, and some are stricter than the federal rules.

On top of the law, business texting from a standard phone number is registered with the mobile carriers, and that registration asks how you collect consent. A vague answer can delay or block your texting.

What counts as consent to text a patient?

Consent comes in two strengths, and the kind of message decides which one you need.

The FCC has said that a patient who gives their phone number to a healthcare provider may have given prior express consent to healthcare calls and texts related to the reason they gave it, within limits. The FCC also recognizes a narrower exemption for certain healthcare messages to mobile numbers, with conditions on who sends them, what they contain, how often they go and how opt-outs are handled. Marketing and billing messages are outside it. Whether a given message fits is a question for your counsel, not a guess.

A safe operating habit: ask the patient directly, record the answer, and keep care messages and promotional messages separate.

Consent given to someone else does not always carry over

A patient may reach a practice through another business that referred them. Consent the patient gave to that business does not automatically cover texts from your practice. Ask again and record it under your practice's name.

How to handle opt-outs and STOP replies

Under FCC rules, a patient may revoke consent by any reasonable means. A STOP reply is the obvious one, but so is a patient telling a staff member on the phone "please stop texting me", or a reply with a similar word. The FCC has listed common words such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE as reasonable ways to revoke.

A practical opt-out process:

1. Treat every clear request to stop as an opt-out, whatever the channel it arrived on.
2. Record it on the patient's record the same day, with the date, the channel and who recorded it.
3. Stop automated and bulk texts to that patient right away.
4. If you send a confirmation, keep it to one short message that confirms the opt-out and does not try to change their mind.
5. Only resume texting when the patient opts back in, for example by replying START, and record that too.

The FCC rule effective in 2025 sets a deadline for honoring opt-outs. Confirm the current rule and its timing with your counsel, and aim to honor them faster than any deadline.

An opt-out from texts is not automatically an opt-out from calls. Ask the patient what they meant, and record both answers. A patient who asks not to be contacted at all belongs on your Do Not Call list.

What calling hours should a practice use for texts?

Federal telemarketing rules limit solicitation calls to the hours between 8 AM and 9 PM in the recipient's local time. That window is written for telemarketing, and it does not cover every healthcare call or text on its own. Some state laws set narrower hours or rule out certain days.

A simple practice policy avoids the question for routine messages:

• Set calling hours that apply to both calls and texts, and keep them comfortably inside the hours your counsel confirms.
• Use the patient's own time zone, not the practice's.
• Send scheduled and bulk texts only inside those hours.
• Ask staff to confirm before sending a one-off text outside them.

What HIPAA expects when you text patients

HIPAA permits a covered entity to text patients, but it expects reasonable safeguards.

• Minimum necessary. Say "please call us about your recent visit", not the diagnosis or the result.
• Patient preference. A patient may ask for texts even though standard texting is not encrypted. Tell them the risk and record that they still want them.
• Vendors. A service that sends or stores texts with patient information for you generally needs a business associate agreement (BAA). Our HIPAA compliant software checklist lists what to ask a vendor.
• Records. Keep sent and received texts with the patient's record, so you can show what was said and when.

What to record as proof of consent

Proof is what lets you answer "did this patient agree?" months later. For each patient and each phone number, record:

• The answer. Agreed, or refused.
• The kind. Care messages only, or also promotional messages.
• How. On a call, by a reply text, on a signed form or an uploaded document.
• When and who. The date, and the staff member who recorded it.
• The proof itself. The recording, the text reply or the document.
• Every change. A later refusal or a renewed consent is added beside the earlier record, never written over it.

Our guide to patient outreach strategies covers how consent fits into choosing between calls, texts and letters, and our patient outreach campaign guide shows where the consent check sits before a list goes out.

Frequently asked questions

Do we need consent to text patients?

For automated or bulk texts to mobile numbers, the TCPA generally requires prior express consent, and written consent for marketing. Some healthcare messages fall under narrower rules or an FCC exemption with conditions. Ask your counsel which applies to each kind of message you send.

Is texting patients HIPAA compliant?

HIPAA permits texting patients with reasonable safeguards: minimum necessary information, a BAA with vendors that handle the messages, and respect for the patient's preferences. A patient may choose unencrypted texts after being told the risk.

What if a patient replies STOP?

Treat it as an opt-out, record it, and stop automated texts to that patient. Do not resume until they opt back in, for example by replying START. Confirm with counsel the current FCC deadline for honoring opt-outs.

Does a STOP reply mean the patient cannot be called either?

Not necessarily. A STOP reply revokes consent to texts. If the patient also asked not to be called, add them to your Do Not Call list. When in doubt, ask the patient and record both answers.

Can we text patients in the evening?

Set calling hours for your practice, in the patient's own time zone, and send scheduled and bulk texts only inside them. Federal telemarketing hours and state laws can both matter, so confirm your window with counsel.

Sources

• 47 CFR 64.1200, Delivery restrictions (TCPA rules), Legal Information Institute at Cornell Law School
• Stop Unwanted Robocalls and Texts, FCC
• TCPA Omnibus Declaratory Ruling and Order (FCC 15-72), FCC
• Does the HIPAA Privacy Rule permit providers to use e-mail to discuss health issues with patients?, HHS
• HIPAA FAQ on receiving PHI in the manner requested, even if unsecure, HHS
• Business Associates Frequently Asked Questions, HHS
• Minimum Necessary Requirement, HHS