A text offering a discount on injectables or a first month of a weight-loss program is a marketing message, even when a licensed clinician sends it. The FCC’s TCPA rules have two health care exemptions, but neither one is built for promotions. For med spas, aesthetics practices, and telehealth companies, the safer assumption is that a promotional text needs the patient’s prior express written consent. A business that has that consent, and can prove it, starts a TCPA case in a strong position.
Do TCPA rules apply to a med spa’s texts?
Yes. The Supreme Court noted in Campbell-Ewald Co. v. Gomez (2016) 577 U.S. 153 that “A text message to a cellular telephone, it is undisputed, qualifies as a” call under the statute’s cell phone provision. Texts sent through a scheduling or marketing platform are calls for TCPA purposes.
What rules apply depends on how the text is sent and what it says. The FCC’s rule at 47 C.F.R. § 64.1200(a)(2) requires prior express written consent for a call that “includes or introduces an advertisement or constitutes telemarketing” when it’s made with an autodialer or an artificial or prerecorded voice. After the Supreme Court narrowed the autodialer definition in Duguid, many text platforms fall outside it, as the post on autodialer defenses after Duguid explains. Do Not Call claims are different, because they don’t depend on the equipment at all.
Is a promotional text a health care message?
Usually not, and that’s where many clinics get it wrong. The rule’s advertising provision carves out calls that deliver a health care message made by or for a HIPAA covered entity or its business associate, using the definitions in 45 C.F.R. § 160.103. Both halves of that phrase have to fit.
The first is the sender. Under section 160.103, a health care provider is a covered entity only if it “transmits any health information in electronic form in connection with a transaction covered by this subchapter.” Those transactions are things like insurance claims and eligibility checks. A cash-pay med spa that never bills insurance may not be a covered entity at all, and if it isn’t, the exemption can’t apply to its texts.
The second is the message. HIPAA’s own rules separate care from sales. Section 164.501 defines marketing as a communication “about a product or service that encourages recipients of the communication to purchase or use the product or service,” with exceptions for things like treatment communications. A flash sale on filler reads like marketing under that definition, and a court deciding the TCPA question isn’t bound by the clinic’s label for it.
What about the FCC’s exemption for health care texts to cell phones?
It’s narrower still. Paragraph (a)(9)(iv) of the FCC’s rule exempts certain free-to-the-patient calls and texts by health care providers, but limits them to listed purposes such as “appointment and exam confirmations and reminders” and “prescription notifications.” The same paragraph says they “must not include any telemarketing, solicitation, or advertising.”
That exemption also comes with conditions. Messages go only to the number the patient provided, are limited to one per day and three per week, and must include an easy way to opt out. An appointment reminder that ends with a promo code can lose the exemption. Clinics should keep reminders and promotions in separate message streams. Most texting platforms let a practice set up separate templates and sender profiles, and the extra setup costs far less than defending a class action over a mixed message.
| Message | Likely TCPA treatment | What protects the business |
|---|---|---|
| Appointment reminder, no promotion | May fit the (a)(9)(iv) exemption if its conditions are met | Number from the patient, limits on frequency, opt-out in each text |
| Post-treatment care instructions | Informational, not marketing | Records showing the patient provided the number |
| Discount, package, or new-treatment promotion | Advertising or telemarketing | Prior express written consent naming the business |
| Promotion sent to a Do Not Call Registry number | Telephone solicitation | Written consent, or an established business relationship within its limits |
| Reminder with a promo code added | Mixed message, exemption at risk | Separate the promotion into a consented stream |
What does written consent need to say?
It has to be specific. Under paragraph (f)(9), prior express written consent is a written agreement “bearing the signature of the person called” that authorizes the seller to send advertisements or telemarketing, and lists the number. The disclosure must say signing isn’t “a condition of purchasing any property, goods, or services.”
The intake form is the natural place for it. A new-patient form that includes a separate, unchecked box for marketing texts, with the disclosure next to it, gives the clinic a clean record. Burying consent in a medical history form or making it mandatory to book weakens it, as the post on consent checkboxes as a condition of purchase covers. Electronic signatures work if the form is set up for them, and the post on web form consent and e-signatures explains how.
Where do med spa and telehealth TCPA claims usually start?
With lists the business didn’t build itself. Telehealth companies often buy leads, and a consent obtained by a lead generator only helps if it names the company that sends the texts. Med spas tend to run into trouble with old patient lists imported into a new platform, or with review requests that turn into promotions, a pattern discussed in the post on review request texts.
A telehealth company buying leads should read the consent language on the lead generator’s form before the first text goes out. The written consent rule asks whether the person authorized “the seller” to send marketing, so a form that names a different brand, or a long list of partners, gives the buyer little to stand on. The vendor contract matters too. Indemnity and audit rights, discussed in the post on TCPA vendor contracts, decide who pays if the consent doesn’t hold up.
Opt-outs are the other common source. A patient who replies STOP and still gets the next promotion has an easy claim to describe, and every text after the request can be counted separately. That’s why California TCPA defense lawyers typically start with the platform’s opt-out logs.
Records to pull when a patient sues over marketing texts
- Put a litigation hold on the text logs, platform and campaign data, and the intake or web forms showing consent for each number.
- Pull the opt-out and internal do-not-call records with dates, including STOP replies and requests made at the front desk.
- Gather the National Do Not Call Registry scrub records and the Registry version dates used for each campaign.
- Collect the texting platform and lead-source contracts, the message templates, and any prerecorded or AI-voice files used for calls.
- Talk to a lawyer before responding to a demand letter, contacting the patient, or offering credits or refunds to settle.
Questions about med spa and telehealth marketing texts
Is a med spa a HIPAA covered entity?
It depends on whether it conducts covered electronic transactions, such as billing a health plan. A provider qualifies under 45 C.F.R. § 160.103 only if it transmits health information electronically in connection with those transactions. Many cash-pay aesthetics practices don’t, which means the TCPA’s covered-entity exemption may not be available to them at all, even for messages that are about care.
Can a telehealth company text people who started but didn’t finish sign-up?
Only with the right consent for what it sends. A message about finishing an application the person started may be informational, but one promoting a program or a discount is marketing. If the sign-up form included a clear written consent for marketing texts that named the company, that consent is the defense. Without it, the follow-up campaign is where the exposure sits.
Do appointment reminders need written consent?
Not usually, if they’re purely informational and meet the FCC’s conditions. Paragraph (a)(9)(iv) exempts reminders sent to the number the patient provided, within frequency limits, with an opt-out in each message. Adding a promotion to the reminder changes the analysis, so the safer practice is keeping reminder templates free of offers and sending promotions only to patients who gave written consent.
Does the established business relationship help with Do Not Call claims?
It can, for existing patients. The FCC’s definition of a telephone solicitation excludes calls to a person with whom the caller has an established business relationship, defined by a purchase or transaction within 18 months or an inquiry within three months. It doesn’t replace written consent for autodialed or prerecorded marketing, and an opt-out request ends it.
Defending claims over patient marketing texts
If your practice or telehealth company has been sued over promotional texts, the intake forms and the platform’s consent and opt-out records usually decide how strong the claim is. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving promotional texts to patients. Contact Rosenberger + Kawabata online for a confidential consultation, or call (310) 894-6921.
Sources
The FCC’s rules are at 47 C.F.R. § 64.1200. The HIPAA definitions are at 45 C.F.R. § 160.103 and 45 C.F.R. § 164.501.
The court decision is Campbell-Ewald Co. v. Gomez (2016) 577 U.S. 153.
This post is general information about the Telephone Consumer Protection Act and related laws as of April 10, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.