TCPA Healthcare Exemption: Appointment, Refill, and Care Messages

One message a day, no more than three a week, free to the patient, and nothing about money or marketing. Those are the core limits on the FCC’s healthcare exemption, which lets providers send automated reminders and other care messages to a patient’s cell phone without consent. A second rule lets HIPAA “health care” messages go out on ordinary consent instead of written consent. Both are narrow, and a provider that keeps the records each one requires is in a far better position to defend a robotext claim.

Which TCPA rules reach appointment and care messages?

The statute bars calls to a cell phone made with an autodialer or an “artificial or prerecorded voice” unless the caller has the called party’s prior express consent or the call is for emergency purposes, under 47 U.S.C. § 227(b)(1)(A)(iii). A prerecorded call is one that plays a recorded or synthetic voice instead of a live person. For an autodialer, the Supreme Court held in Facebook, Inc. v. Duguid that a necessary feature of one is “the capacity to use a random or sequential number generator to either store or produce phone numbers to be called.” In my view, a platform that sends to a stored patient list in order doesn’t meet that test, though the opinion’s footnote 7 notes that a device might use a random number generator to pick numbers from such a list. The recorded-voice reminder call is the bigger risk.

The statute sets damages at actual loss or $500 per violation, whichever is greater, and a court may treble the award, up to $1,500 per violation on the $500 figure, if it finds the violation was willful or knowing, under § 227(b)(3). Four regulatory paths matter most for patient messages, and they’re easy to confuse:

Every regulatory provision quoted below is the text in effect on May 15, 2026. The § 64.1200 paragraphs quoted here have been unchanged since at least August 29, 2025. Later amendments to the section touched only carrier call-blocking provisions.

Does a patient who gives us a phone number consent to reminders?

Usually yes, for messages related to the care the patient sought. In its 2015 order, the FCC said that “provision of a phone number to a healthcare provider constitutes prior express consent for healthcare calls subject to HIPAA” when the covered entity or its business associate stays within the scope of that consent and absent instructions to the contrary, as stated in FCC 15-72. The order’s footnote 474 sets the limit: “the call must be closely related to the purpose for which the telephone number was originally provided.”

That consent matters because of the HIPAA carve-out in § 64.1200(a)(2). The FCC normally requires prior express written consent, meaning a signed agreement naming the number, for robocalls and robotexts that advertise or telemarket. Paragraph (a)(2) exempts a call that delivers a HIPAA “health care” message made by or for a covered entity or its business associate. Those messages still need ordinary consent. They just don’t need a signature.

The Second Circuit applied that structure to a flu-shot reminder text in Latner v. Mount Sinai Health System, Inc., 879 F.3d 52 (2d Cir. 2018). The patient had given his number at a 2003 visit and signed a privacy acknowledgment. The court held that he “provided his prior express consent to receiving a single text message” about a health-related benefit and affirmed judgment for the health system and the medical group.

The order also lets a third party consent to healthcare calls for a patient who lacks legal capacity, but only until capacity returns. Being too ill isn’t enough: declining to treat a number a doctor’s office passed to a pharmacy as consent, the order repeats that “an intermediary may only convey consent that was provided by the consumer,” according to FCC 15-72.

What can a provider send to a cell phone without any consent?

A short list of treatment messages, under conditions the provider has to meet on every message. The statute says the FCC “may, by rule or order, exempt from the requirements of paragraph (1)(A)(iii) of this subsection calls to a telephone number assigned to a cellular telephone service that are not charged to the called party,” under § 227(b)(2)(C). The FCC used that authority in 2015 for “calls for which there is exigency and that have a healthcare treatment purpose,” per FCC 15-72, and the conditions now sit in the rule itself.

The permitted purposes are listed in § 64.1200(a)(9)(iv)(C): “appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions.”

The message has to go only to the number the patient provided and must identify the provider with contact information, at the start of the call for a voice message. It must comply with HIPAA privacy rules. It has to be concise, generally 160 characters or less for a text and a minute or less for a voice call. The rule allows “only one message (whether by voice call or text message) per day to each patient, up to a maximum of three voice calls or text messages combined per week to each patient.” Voice calls need an interactive opt-out if a person answers and a toll-free opt-out number if voicemail picks up. Each text must tell the patient about replying STOP, “which will be the exclusive means by which consumers may opt out of such messages,” and the provider “must honor opt-out requests immediately,” under § 64.1200(a)(9)(iv).

The exemption also applies only if “the call is not charged to the called person or counted against the called person’s plan limits on minutes or texts,” per § 64.1200(a)(9). Before launching a reminder program, I’d ask the texting vendor, in writing, how it delivers free-to-end-user messages and what records prove it. Keep those records in the program file. Banks’ fraud-alert exemption carries the same free-to-end-user condition, covered in our post on the TCPA’s financial institution exemption.

I’d treat STOP as final across the whole exempt stream the moment it arrives, because the rule says “immediately,” and I wouldn’t count on the exemption to protect a reminder queued before the opt-out but sent after it. The exemption is also written around the patient, so a reminder that reaches a reassigned number is shaky ground. Our earlier post on wrong-number TCPA exposure covers those claims.

For landlines, a prerecorded health care call to a residential line needs no consent if the caller makes “no more than one call per day to each patient’s residential line, up to a maximum of three calls combined per week to each patient’s residential line” and honors opt-out requests under the rule’s identification and do-not-call procedures, per § 64.1200(a)(3)(v). Our post on prerecorded calls to home landlines covers the limits that apply to other callers.

When does a refill reminder turn into marketing?

When it tries to sell something, or when it talks about money. The cell-phone exemption bars messages that include “telemarketing, solicitation, or advertising,” and separately says they “may not include accounting, billing, debt-collection, or other financial content,” under § 64.1200(a)(9)(iv)(D).

Pharmacies face two definitions of marketing. HIPAA’s Privacy Rule excludes communications “To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual,” so long as any third-party payment is reasonably related to the cost of the message, under 45 C.F.R. § 164.501. The TCPA rule uses its own test. Telemarketing is “the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services,” per § 64.1200(f)(13). A HIPAA compliance sign-off doesn’t answer the TCPA question.

The rule’s list of healthcare providers names hospitals, emergency care centers, physician offices, and poison control centers, then ends with “other healthcare professionals,” per § 64.1200(a)(9)(iv). It doesn’t name pharmacies, so a pharmacy relying on the exemption should expect to argue that it fits. Either way, a plain ready-for-pickup notice is the safest message a pharmacy sends. The rule bars financial content, so a copay amount takes the message outside the exemption, and I’d treat a transfer-your-prescription offer as solicitation. HIPAA’s definition of “health care” covers dispensing a prescription, per 45 C.F.R. § 160.103, but the D.C. Circuit assumed that some messages about a prescription sale would concern billing, which the cell-phone exemption excludes, in ACA International v. FCC, 885 F.3d 687 (D.C. Cir. 2018). My view is simple: keep payment and promotional content out of the reminder stream. One copay line is the cheapest way to lose the exemption.

Free programs aren’t automatically telemarketing, though. In Hulce v. Zipongo Inc., 132 F.4th 493 (7th Cir. 2025), a nutrition company’s calls and texts promoted no-cost visits through a Medicaid health plan, with gift cards attached. The Seventh Circuit held they weren’t telephone solicitations under the Do Not Call rules because the company didn’t urge the patient to pay for anything. The court added: “Do not overread our decision to create a sweeping loophole within the prohibition of telephone solicitations.” A judge dissented, and the decision binds only the Seventh Circuit. Hulce addressed the Do Not Call definition of telephone solicitation only. It doesn’t decide whether a free-program message is “advertising” under the healthcare exemption, which the rule defines separately in § 64.1200(f)(1).

How does McLaughlin change reliance on the FCC’s healthcare rules?

It lets either side in a private suit ask the court to decide what the statute means for itself, with the limits noted below. In my view, it bears hardest on the FCC’s readings of the statute and less on exemptions Congress expressly authorized. In McLaughlin Chiropractic Associates v. McKesson Corp., 606 U.S. 146 (2025), the Supreme Court held: “District courts are not bound by the agency’s interpretation, but instead must determine the meaning of the law under ordinary principles of statutory interpretation, affording appropriate respect to the agency’s interpretation.” Our post on McLaughlin v. McKesson covers the decision in more detail.

The consent clarification is the most exposed, because it interprets the statutory phrase “prior express consent.” A plaintiff can now ask a court to read that phrase more narrowly. I don’t think providers should panic. The clarification rests on the FCC’s 1992 view, quoted in Latner, that “persons who knowingly release their phone numbers have in effect given their invitation or permission to be called at the number which they have given,” and the Second Circuit, before McLaughlin, found consent in Latner from the number plus the patient’s signed privacy acknowledgment. Utilities face the same question about the FCC’s 2016 ruling on service calls, covered in our post on TCPA rules for utilities.

I think the no-consent exemption stands on firmer ground. The FCC granted it under the express power in § 227(b)(2)(C) to exempt free-to-the-recipient calls “subject to such conditions as the Commission may prescribe as necessary in the interest of the privacy rights this section is intended to protect,” quoted from the statute. A challenger can still argue that the rule is arbitrary or otherwise unlawful, which footnote 2 of McLaughlin allows. The D.C. Circuit has reviewed the exemption once. In ACA International, it rejected a pharmacy’s arguments that the exemption was too narrow, concluding that “The Commission was empowered to draw the distinction it did, and it adequately explained its reasons for doing so.” That holding doesn’t address a plaintiff’s argument that the exemption goes too far. McLaughlin’s footnote 3 says a district court in the same circuit as a prior pre-enforcement ruling “may be bound under principles of vertical stare decisis to adhere to the court of appeals holding,” per the opinion. Outside the D.C. Circuit, ACA International is persuasive, not binding.

McLaughlin cuts both ways. The written-consent requirement for marketing robocalls is itself an FCC rule, and in Bradford v. Sovereign Pest Control of TX, Inc. the Fifth Circuit held that “prior express consent” covers oral consent for telemarketing calls too, as our post on the Fifth Circuit’s oral-consent ruling explains. Still, I’d treat an attack on the exemption’s own conditions as a last resort, not a plan. If you rely on the exemption, plan to meet every condition in the codified text.

Records to gather when a patient-message claim arrives

1. Put a litigation hold on the messaging platform’s logs for the number, with each message’s text, time stamp, and template, plus the intake record showing when and how the patient provided the number.
2. Export the STOP replies and other opt-out requests for that number, with the time each was received and the time the number was suppressed.
3. If any message to the number promoted a product or service, pull the National Do Not Call Registry scrub records and version dates for those campaigns.
4. Collect the texting vendor’s contract and business associate agreement, its free-to-end-user records, and any recorded or AI-voice call files.
5. Talk to a lawyer before responding to a demand letter, contacting the patient, or offering a credit to settle.

The firm’s California TCPA defense lawyers page explains how it approaches claims involving automated appointment reminders and prescription notifications.

Questions providers and pharmacies ask about the healthcare exemption

Does the healthcare exemption cover billing or balance reminders?

No. The cell-phone exemption expressly excludes billing and other financial content. Rejecting a pharmacy’s argument that HIPAA required exempting billing calls, the D.C. Circuit said that otherwise “healthcare providers could use ATDS equipment to bombard nonconsenting wireless users with calls and texts concerning outstanding charges without incurring TCPA liability,” per ACA International. Billing robocalls and robotexts to cell phones need the patient’s prior express consent, so keep them on a separate, consent-based stream.

Can a pharmacy text a refill reminder to a number the prescriber supplied?

Be careful. Outside the narrow rule for patients who lack legal capacity, the FCC said a doctor’s office can’t supply consent on a patient’s behalf, because an intermediary may only pass along consent the patient actually gave. If the patient gave the number to the prescriber for that purpose, the pharmacy may have a consent argument. The free-to-patient exemption doesn’t avoid the question, because it also requires the number the patient provided. Document how each number reached the pharmacy.

Do flu-shot and wellness reminders qualify?

Sometimes, but not automatically. Wellness checkups are on the exemption’s list of permitted purposes, and I’d read a reminder from a patient’s own provider to come in for a recommended shot as close to that line. A flu-shot reminder sent on consent fared well in Latner, which involved a single text from the patient’s own medical group. One that advertises a retail clinic to people who’ve never been patients looks like marketing, and it needs the consent required for marketing calls.

If a patient-message claim lands on your desk

If your company is accused of sending automated reminders or refill texts without consent, the exemption’s conditions turn on what each message said and when opt-outs were honored, so the templates and opt-out logs are the records that matter. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving automated appointment reminders and prescription notifications. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as in effect on May 15, 2026. The HIPAA definitions are at 45 C.F.R. § 160.103 and 45 C.F.R. § 164.501. The FCC’s 2015 healthcare exemption and consent clarifications are in FCC 15-72, 30 FCC Rcd 7961 (2015), paragraphs 140 to 148.

The court decisions are McLaughlin Chiropractic Associates v. McKesson Corp., 606 U.S. 146 (2025); Facebook, Inc. v. Duguid, 592 U.S. 395 (2021); ACA International v. FCC, 885 F.3d 687 (D.C. Cir. 2018); Latner v. Mount Sinai Health System, Inc., 879 F.3d 52 (2d Cir. 2018); Hulce v. Zipongo Inc., 132 F.4th 493 (7th Cir. 2025); and Bradford v. Sovereign Pest Control of TX, Inc., No. 24-20379 (5th Cir. Feb. 25, 2026).

This post is general information about the Telephone Consumer Protection Act and related laws as of May 15, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.