Do You Need Consent to Text Your Patients?

A dermatology office we talked to last spring had a smart idea. They pulled up every patient who had not been in for a year and sent a friendly text: we miss you, book your skin check, here is 50 dollars off. Simple, warm, good business. Two problems. Half the messages never arrived because their number was not registered with the carriers. And of the ones that did land, a handful went to people who had never agreed to marketing texts, and one of them knew exactly what the TCPA was. That one reply turned a nice reactivation idea into a very expensive afternoon.

So the honest answer to the question in the title is yes, sometimes you need consent, and the version of yes matters a lot. Texting patients is one of the highest return things a practice can do, because a text gets read when an email rots in a promotions folder and a call goes to voicemail. Around 98 percent of text messages get opened, most within a few minutes. But that same power is why the rules are tight. Let us make it clear, in plain language, so you can text with confidence instead of crossing your fingers.

Quick note before we start. This is a practical guide, not legal advice. The rules below are real, but your situation, your state, and your setup can change how they apply, so run your final process past your own attorney.

Two different texts, two different rules

The biggest mistake practices make is treating every text the same. The law does not. It splits your messages into two buckets, and the bucket decides what you need.

Bucket one: care messages

These are the texts about a patient's actual visit and health. Appointment reminders, running late notices, pre visit instructions, a nudge that it is time for a cleaning or a lab. The federal FCC rules under the TCPA give healthcare messages like these more room than marketing, when they come from a practice to a patient who gave you their number for contact. You still have to let people opt out and honor it, but a reminder is not treated like a sales pitch.

Bucket two: marketing messages

These sell something. A special on Botox, a fall promotion, a review request bolted onto a reminder, a we miss you offer to a patient who drifted away. Marketing and promotional texts need prior express written consent, which is the legal way of saying the patient clearly agreed to get promotional texts before you sent one. No clear yes on file, no marketing text. That is the line the dermatology office crossed without meaning to.

Here is where it gets slippery. A message can start as a reminder and become marketing the moment you add an offer. Time for your cleaning is a care message. Time for your cleaning, and ask us about our new whitening special is now marketing. If you want to promote, get the consent. If you are not sure which bucket a text falls in, treat it as marketing and you will never be on the wrong side of it.

What happens if you get it wrong

There are two costs, and most owners only worry about the first.

The legal cost is the TCPA. It lets a person collect 500 dollars for each text that broke the rules, and up to 1,500 dollars per text if the violation was willful. There is no cap on how many texts add up. Send a promotional blast to a thousand patients without consent and the exposure is not theoretical, it is a number with a lot of zeros. Healthcare texting is a favorite target for these claims precisely because practices send a lot of messages and often never set consent up properly.

The second cost is the one that bleeds money without a lawsuit: your texts simply do not arrive. This is the part almost nobody sees coming, and it deserves its own section.

The part nobody warns you about: A2P 10DLC

You can have perfect consent and still have your texts vanish. In the United States, the carriers now require businesses to register the numbers they text from. The system is called A2P 10DLC, which is just industry shorthand for Application to Person messaging sent from a normal ten digit phone number. You register your business and the kind of messages you send through The Campaign Registry, and only then do the carriers trust your traffic.

Skip it, and AT&T, T Mobile, and Verizon increasingly filter or block your messages as suspected spam. No error, no warning, no bounce that anyone at the front desk notices. The reminder just never lands, the patient forgets the appointment, and the chair sits empty. If you have ever wondered why your texting tool says delivered but patients swear they got nothing, unregistered A2P traffic is a common reason. We wrote about the wider version of this problem in is your practice number flagged as spam, and it is the texting cousin of why your emails go to spam.

The clean way to hold this in your head: consent is permission from the patient, registration is permission from the carriers. You need both. One keeps you legal, the other keeps you delivered.

Where HIPAA fits in

People assume HIPAA bans texting patients. It does not. HHS guidance says a practice may text a patient about their care as long as you use reasonable safeguards and the patient was told that plain text is not secure and still prefers it. The catch is what you put in the message.

Keep protected health information out of the text and your risk stays low. A message that says it is time to schedule your visit, or please call us about your recent results, is fine. A text that spells out a diagnosis, a medication, or a lab value is where you invite trouble, because a phone screen is easy for anyone to see. The habit to build is boring on purpose: light on detail, heavy on please reach out. Note in your records that you offered texting, warned about the security, and the patient chose it anyway. You can read the government's own take straight from HHS on HIPAA.

How to collect consent the right way

The good news is that doing this properly is not hard, it is just a step most practices never build. Here is what a clean setup looks like.

• Add a texting line to your intake form. A simple checkbox: yes, you may send me text messages, including reminders and occasional offers, and I can reply STOP to opt out any time. That single line, saved with the date, is the record that protects you.
• Ask again at the front desk and online. When someone books online or updates their info, capture the mobile number and the texting permission together. Consent you can prove is the only consent that helps you.
• Honor STOP instantly and automatically. The moment someone opts out, the texting stops, no exceptions. Good software does this for you. Ignoring an opt out is one of the fastest ways to earn a complaint.
• Keep the records. Who agreed, to what, and when. If a claim ever comes, the practice with clean consent logs sleeps fine and the one guessing does not.
• Register your number. Get your A2P 10DLC registration handled before your first big send, not after your delivery mysteriously drops.

Notice that none of this stops you from texting. It just makes your texting bulletproof. Once it is set up, you can send reminders that cut no shows, recall messages that fill slow weeks, and the occasional offer, all without looking over your shoulder. If reminders are your main goal, we broke down the cadence in how many appointment reminders to send and the wording in what an appointment reminder text should say.

Why bother with all this

Because texting, done right, is one of the best tools a practice has. It reaches people where they actually are. Reminders sent by text lower no shows more than a voicemail nobody checks. A well timed recall text brings back patients who simply forgot they were due, and a compliant win back message can refill a soft month, exactly the play the dermatology office wanted before the wheels came off. Most patients, when asked, would rather get a text than a call anyway, which we covered in do patients prefer a call or a text.

The practices that win with texting are not the ones who send the most. They are the ones who set the foundation once, then never have to think about it again.

How EtherealMinds handles this for practices

This is exactly the plumbing we set up inside our patient acquisition system, so owners never have to become texting compliance experts. When we build a practice's communication, the consent language lives in the intake and booking forms, so permission is captured the moment a patient signs up. We register the number through A2P 10DLC so the messages actually deliver instead of dying in a carrier filter. Opt outs are honored automatically the instant someone replies STOP, and every consent is logged with a date, so if anyone ever asks, the answer is a record, not a shrug.

Then the fun part works safely: reminder texts that shrink no shows, recall messages that fill the calendar, and reactivation campaigns that bring dormant patients back, the same kind of win back play we describe in reactivating past patients and leads, done the way that keeps you out of trouble.

Our honest take: texting is too good a channel to avoid out of fear and too risky to wing without a system. Build the consent and the registration once, and you get all of the upside with none of the 3am worry. Skip them, and you are gambling with both your delivery and your checkbook.