Texting Rules for Urology Practices: Consent, Privacy and Opt-Outs

In the United States, HIPAA governs the use and protection of patient information by covered practices and their business associates. The TCPA governs certain calls and texts, including consent requirements for covered automated messages. State laws may add requirements.

HHS treats appointment reminders as treatment communications that do not require a separate HIPAA authorization. That is not a blanket exemption from the TCPA or other texting laws. A signed intake form, an existing patient relationship or a number in your system is not proof that every kind of campaign is permitted.

A reminder about a due appointment or clinician-approved follow-up is different from a discount, elective-service offer or promotional campaign. Assess the actual wording and purpose, not simply the label “patient recall.” Adding an offer to a reminder can change the consent analysis.

For texts covered by the TCPA’s autodialer rules, prior express consent generally applies unless an exemption is satisfied. Advertising or telemarketing generally requires prior express written consent, with a specific exception to the written-consent requirement for qualifying HIPAA healthcare messages. That exception is not automatic permission to text without consent. Also, not every system described as “automated” is a TCPA autodialer.

A separate, narrow healthcare exemption covers certain free-to-recipient treatment messages under detailed conditions, including eligible purposes, a patient-provided number, identification, length and frequency limits, and immediate opt-out handling. It excludes advertising, solicitation, billing and other financial content. Ask counsel before relying on either exception rather than assuming all healthcare texts are exempt.

As a practical safeguard, obtain and document permission for care texts and use a separate, clearly explained promotional opt-in. Explain who will text, the purpose of the messages and how the patient can stop them. Do not bundle optional promotional permission into a condition of care.

• Record the number, date, method and exact wording used to obtain permission.
• Keep care-message preferences and promotional permission distinguishable.
• Check that the number is current and belongs to the intended recipient.
• Keep opt-outs and wrong-number reports in the same workflow as consent records.

For dormant files, review the original permission and any later withdrawal before sending. A purchased list, old export or previous visit is not a substitute for that review.

Identify the practice and make opting out straightforward. Process STOP and other reasonable requests, including a request made to reception or outside the texting platform. Stop affected messages promptly and synchronize suppression records across staff, scheduled campaigns and vendors.

For covered TCPA revocations, the FCC adopted a reasonable-time requirement not exceeding ten business days. That is an outer limit, not permission to keep sending for ten days; the narrow healthcare exemption requires immediate opt-out handling. Any permitted one-time confirmation must not contain marketing.

FCC revocation rules have changed. A January 2026 order extended a limited waiver concerning unrelated informational message categories until January 31, 2027; it did not suspend all opt-out obligations. Check the latest FCC guidance with counsel before launch. If the scope of a request is unclear, pause affected outreach while resolving it—do not treat it as permission to continue a promotion.

A phone can be shared, reassigned or visible on a lock screen. Even your practice name may disclose a sensitive care relationship. Verify contact details and communication preferences, and use reasonable safeguards. Avoid diagnoses, test results, procedure details, sexual-health information and unnecessary identifiers in ordinary reminder texts.

Direct sensitive conversations to an appropriately secured patient portal or a verified telephone conversation. A patient’s willingness to text does not remove your privacy and security duties. HHS guidance on electronic communications is not blanket approval of every SMS workflow.

Determine whether a vendor creates, receives, maintains or transmits protected health information on your behalf as a business associate. When it does, obtain an appropriate business associate agreement and assess its safeguards. Review staff access, security controls, incident handling, subcontractors and how opt-outs reach your practice records.

A “HIPAA-compliant” label or signed agreement is not a certification that every configuration and message is compliant. Your practice still needs approved templates, trained staff and a reviewed workflow.

Canada’s anti-spam legislation (CASL) applies to commercial texts. Unless an applicable exception applies, commercial electronic messages generally need consent, sender identification and contact information, and a working unsubscribe mechanism. Consent may be express or valid implied consent; an ongoing care relationship does not automatically permit every promotion.

Assess appointment and care messages by their actual content and purpose. A purely operational message may not be commercial, while adding a service offer can change the analysis. Some transaction-related messages have a consent exception without being exempt from every CASL requirement. Applicable unsubscribe requests must be acted on without delay and no later than ten business days.

CASL does not replace provincial health-information laws or applicable federal and provincial privacy rules. Have a qualified Canadian adviser review the requirements for your province and campaign.

1. Have a clinician approve the care reason and a privacy-conscious template.
2. Have counsel classify the message and review consent and any claimed exception.
3. Verify numbers, permission records, communication preferences and suppression lists.
4. Review the vendor’s safeguards and obtain a business associate agreement where applicable.
5. Test opt-out handling across the platform and your front desk before scheduling sends.
6. Pace outreach to appointment capacity and retain a record of the approved workflow.

Want to plan the opportunity without sharing patient data? Request a free dormant-file audit using practice-level counts, or estimate your dormant-list value. A planning call does not replace a legal review.

• HHS: Appointment reminders and HIPAA authorization
• FCC: TCPA order and healthcare-message exceptions (paragraphs 140–148)
• FCC: Consent revocation and opt-out requirements
• FCC: January 2026 limited consent-revocation waiver extension
• HHS: Safeguards for electronic patient communications
• HHS: Business associates and agreements
• CRTC: CASL questions, including commercial texts and unsubscribe requests

Rules and exceptions can change. These sources are a starting point for review, not a determination that a particular campaign is lawful.

Back to the reactivation FAQ