You Have Consent. Under Which Law?

A patient fills out your intake form. They write their mobile number in one field and check a box a few lines down that says they agree to receive communications from the practice.

You now have permission for some things and not others, under two different laws that do not agree on what permission means. Most practices never find out which side of that line they are on, because nothing happens until something does.

HIPAA governs the content. The TCPA governs the channel.

That single sentence resolves most of the confusion.

HIPAA cares about what you say and whether you used protected health information to decide who to say it to. Its definition of marketing is a communication about a product or service that encourages the recipient to purchase or use it, and marketing generally requires written authorization from the patient before you send it.

The exceptions are wider than people expect. Communications about your own health related services are not marketing. Neither are treatment communications, which is where appointment reminders, refill reminders, and referrals to a specialist live. Care coordination and recommending alternative treatments are also carved out.

So a recall notice telling a patient they are due for a cleaning is not marketing under HIPAA. An email promoting a discounted cosmetic package to patients selected from their chart data is.

The TCPA does not care about any of that. It governs autodialed and prerecorded calls and texts to mobile numbers, and it asks a completely separate question, which is whether the person agreed to be contacted that way. Marketing texts require prior express written consent. Informational ones require prior express consent, a lower bar but still a real one.

Satisfying one law tells you nothing about the other. A message can be perfectly clean under HIPAA and still be a TCPA problem, and that is the more common shape of the mistake.

The healthcare texting exemption is narrower than it sounds

The FCC does provide relief here, and it is worth knowing precisely because so many groups either ignore it or lean on it far too heavily.

Under the FCC's 2015 declaratory ruling, certain healthcare treatment messages are exempt from the prior express consent requirement. Appointment and exam reminders, wellness checkups, pre-operative instructions, lab results, and post discharge follow up all qualify.

The conditions are strict. The message goes only to the number the patient provided. It runs 160 characters or less. It names the provider. It offers an easy opt out. And you get one message per day, capped at three per week per provider.

What the exemption explicitly does not cover is telemarketing, solicitation, or advertising, and it does not cover billing or collections content either. Which means the exemption is useless for the campaigns most practices actually want to run, and it quietly runs out the moment a reminder text ends with a line about your new membership plan.

The consent rules moved twice recently

Two changes are worth knowing if the last time you looked at this was a few years ago.

The FCC's one to one consent rule, which would have required separate consent for each individual seller named on a lead form, never took effect. The Eleventh Circuit vacated it in January 2025 in Insurance Marketing Coalition v. FCC, holding that the agency had gone beyond the statute. If you built a lead capture process in anticipation of that rule, it is not required. If you did not, nothing changed.

Revocation is the change that does apply to you. Since April 2025, a patient can revoke consent by any reasonable means, not only by the keyword you told them to use. Stop, quit, cancel, unsubscribe, end, and plain language equivalents all count, and so do replies that clearly express the desire to stop. You have ten business days to honor it, and the burden sits on you to show a revocation request was unreasonable. The broader provision, where revoking on one message type kills all messages from that caller, has been pushed back and is now scheduled for January 2027.

The practical read is that anything built to accept only the exact word STOP is already behind.

Where intake forms actually break

The failure is almost never the absence of a consent box. It is that the box collects one permission and the practice uses it for four things.

A single checkbox saying the patient agrees to receive communications does not distinguish between the appointment reminder they want, the recall notice they probably want, and the cosmetic promotion they did not ask for. It does not distinguish email from text. And it usually is not stored anywhere a marketing platform can read, which means the person building the campaign has no way to honor it even if they want to.

Four things worth capturing separately.

• Channel. Email and text are separate permissions, because they sit under different legal regimes and patients feel differently about them.
• Purpose. Reminders and clinical follow up are one bucket. Promotional content is another. Collecting them together means you cannot ever send the second one cleanly.
• Timestamp and source. What they agreed to, when, and on which form. This is the record that matters if anyone ever asks.
• Revocation state, in the same place. A patient who opts out at the front desk and a patient who replies STOP have done the same thing and should land in the same field.

None of that is exotic, but almost none of it survives the trip from the intake form into the system that sends the messages. That gap is where the exposure lives, and it is the same gap that shows up as inconsistent communication across locations when a group grows.

PatientCampaign holds consent per channel and per purpose alongside the patient record, so a promotional send physically cannot go to someone who only agreed to reminders. Any platform that takes healthcare seriously should do the same. If yours stores consent as a single boolean, that is the thing to fix before you worry about campaign strategy.

None of this is legal advice, and the specifics get fact dependent fast. If you are building a texting program at any real scale, have counsel look at your consent language before you send, not after. The rest of the picture, including where HIPAA and growth actually align, is in our best practices piece.