Therapy appointment reminders by text and email

For OT, PT and SLP practices seeing children, adults or both: a reminder carries the practice’s name, the day, time and place, and how to change the visit, never the condition or treatment. HIPAA treats reminders as treatment; automated texts need TCPA consent or a narrow health care exemption; and the patient’s language and access needs set the channel.⁠^1,2

It covers reminders for visits already booked. Replies to people who have not yet booked, including the voicemail callback and the good faith estimate for a self-pay cost question, are in the reply standards guide and in why callers do not book.

What should a therapy appointment reminder say?

The practice’s name and a way to reach it, the day and time, where the visit happens, and how to change it; nothing about why the person is coming. That is enough for a parent or an adult patient to act on, and it is what the federal rules point to: HHS suggests an answering-machine message carry the provider’s name and number and the information needed to confirm an appointment, and the FCC’s health care exemption for texts requires the provider’s name and contact information in a concise message, generally 160 characters or less for a text.⁠^2,3

Which details should a reminder always leave out?

Anything clinical, anything financial and anything promotional, each for its own reason.

• Clinical detail. The condition, the diagnosis, the treatment, goals, test scores, and the visit type or clinician’s discipline where it reveals the reason for care. A text can show on a lock screen and a voicemail can play to a household; HHS asks providers to limit what an answering-machine message discloses, and the same care suits a text.⁠³
• Money. The exemption bars “accounting, billing, debt-collection, or other financial content,” so a late-cancellation fee, a copay or a balance in a reminder text takes that text outside it.⁠² State the cancellation policy in the intake paperwork and the financial agreement, and send balances by their own route; the insurance and fees guide covers that wording.
• Promotion. A line about a new group or a summer program is advertising the exemption excludes, and a review request is not among its listed purposes.⁠² In an email, promotion can make the whole message commercial under CAN-SPAM.⁠⁹

Are appointment reminders allowed under HIPAA without authorization?

Yes. HHS answers that “appointment reminders are considered part of treatment of an individual and, therefore, can be made without an authorization.”⁠¹ The Privacy Rule requires written authorization for marketing in most cases, but its definition of marketing excludes a communication made for a provider’s treatment of an individual, except where the covered entity receives financial remuneration, meaning payment from a third party whose product or service is being described.⁠^4,10

So a plain reminder needs no authorization, while a reminder that carries a message an outside company pays the practice to include is marketing and does. The fix is simple: reminders carry nothing but the visit.

HIPAA binds a practice only if it is a covered entity, and a provider is covered “only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.”⁠¹¹ A practice outside HIPAA still answers to the texting rules, which apply to every “person or entity”, and the health care texting exemption itself requires messages that comply with HIPAA privacy rules.⁠²

Does a reminder service need a business associate agreement?

For a covered practice, yes, when the service handles patient information on the practice’s behalf, as a reminder system does with names, numbers and appointment times. HHS permits a covered entity to disclose protected health information to a business associate when it obtains satisfactory assurances in a written business associate agreement, and its examples of business associates include a health care app developer providing patient messaging and a vendor chatbot handling medical reminders and appointment scheduling.⁠¹² HHS’s marketing guidance likewise allows a covered entity to use a business associate to make treatment communications.⁠¹⁰

Before switching reminders on in a scheduling system, an electronic health record or a separate texting service:

• The agreement. Sign one, or confirm that the existing agreement covers messaging.
• The default templates. Read them, and remove the visit type, the discipline or the clinician’s specialty where they appear.
• Email security. The Security Rule does not prohibit email, but the practice must assess how it protects information in transit, select a solution and document the decision.⁠¹³
• Who sees the logs. Limit message history to the staff who schedule, and remove access when someone leaves.

What does the TCPA require before a practice texts reminders?

Prior express consent from the person whose phone receives the text, or a message that meets every condition of the FCC’s health care exemption. The rule bars calls to a mobile number made with an automatic telephone dialing system or an artificial or prerecorded voice “other than a call made for emergency purposes or is made with the prior express consent of the called party,” and the exemption paragraph states that “the term ‘call’ includes a text message.”⁠² The FCC’s consumer guide says the same in plain terms: oral or written consent before an autodialed or prerecorded call or text to a wireless number, and written consent for commercial texts.⁠¹⁴

Whether a particular reminder platform counts as an automatic telephone dialing system is a question for counsel. A practice that records consent at intake and also writes its reminders to fit the exemption does not depend on the answer.

What conditions does the TCPA health care exemption set?

Nine: the eight lettered conditions and the requirement that the message cost the recipient nothing, and an exempt message meets every one. The rule exempts calls and texts “made by, or on behalf of, healthcare providers” when “all of the following conditions are met”; in its own words:⁠²

• Free to the recipient. The call must not be “charged to the called person or counted against the called person’s plan limits on minutes or texts.”⁠²
• The patient’s own number. Messages “must be sent only to the wireless telephone number provided by the patient.”⁠²
• Who is writing. They “must state the name and contact information of the healthcare provider.”⁠²
• Purpose. They “are strictly limited to” a list that starts with “appointment and exam confirmations and reminders” and also names wellness checkups, pre-operative instructions, post-discharge follow-up intended to prevent readmission and home healthcare instructions.⁠² A follow-up after a patient leaves care belongs to the discharging patients guide, and a message to a former patient to the former-patient check-ins guide.
• Content. They “must not include any telemarketing, solicitation, or advertising; may not include accounting, billing, debt-collection, or other financial content; and must comply with HIPAA privacy rules.”⁠²
• Length. They “must be concise, generally one minute or less in length for voice calls or 160 characters or less in length for text messages.”⁠²
• Frequency. A provider may initiate “only one message (whether by voice call or text message) per day to each patient, up to a maximum of three voice calls or text messages combined per week to each patient.”⁠²
• An opt-out in each message. The provider “must offer recipients within each message an easy means to opt out”; “text messages must inform recipients of the ability to opt out by replying ‘STOP’”; a call a person could answer needs an automated voice or key-press opt-out during the call; and one that could reach voicemail “must include a toll-free number that the consumer can call to opt out.”⁠²
• Speed. The provider “must honor opt-out requests immediately.”⁠²

A message outside that list, such as a balance reminder, a fee notice, a newsletter or a reply to someone who has not yet booked, needs consent of its own when it is sent automatically, and for a commercial text that consent is written.⁠^2,14

How does the weekly limit fit a child seen several times a week?

It can run out. The cap is three exempt messages a week to each patient, voice and text combined, and one a day,⁠² so a child with OT twice a week and speech therapy once, reminded before every visit, uses the whole allowance, and a fourth message that week, such as a schedule change, needs another basis. There are two ways through: one text at the start of the week listing the week’s visits, or consent recorded at intake for scheduling texts, so the practice is not relying on the exemption for that family. An adult in a block of frequent PT visits after surgery meets the same arithmetic.

What counts as an opt-out from reminder texts?

Any reasonable request to stop. Replies of “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” revoke consent on their own; any other reply a reasonable person would read as a request to stop must be treated as one; and a request made another way, such as a voicemail or email to the practice, creates a rebuttable presumption that consent is revoked.⁠² Revocations must be honored within a reasonable time not to exceed ten business days, while the health care exemption requires opt-outs to be honored immediately.⁠² The FCC’s guide tells consumers they may opt out at any time and in any reasonable manner.⁠¹⁴

Three consequences for the reminder system:

• Opt-out words are not commands. “Reply CANCEL to cancel this visit” invites a reply that revokes consent for every text. Use a digit to confirm, and a phone number to change a visit.⁠²
• One confirmation, then nothing. A single text confirming the opt-out is allowed if it only confirms, carries no marketing and is the only message sent; one sent within five minutes is presumed to fall within the earlier consent, and when the person agreed to several kinds of text, it may ask which they meant to stop.⁠²
• Replies need a reader. If the texting protocol cannot take replies, each text must say so and give other ways to revoke consent.⁠² If it can, someone owns the inbox, because “can’t make it Tuesday” reads as a reschedule request, not an opt-out.

What may a voicemail reminder say, and who may hear it?

The practice’s name and number, and only what confirms the visit or asks for a call back. HHS says the Privacy Rule does not prohibit answering-machine messages, but covered entities should limit what they disclose, for example by “leaving only its name and number and other information necessary to confirm an appointment, or ask the individual to call back.”⁠³ A message may also be left with a family member or other person who answers when the patient is not home, with professional judgment and limited information.⁠³

For a child, the person who answers is often a parent anyway. For an adult, the person answering a shared home phone may be someone the patient has not told about therapy, which is why the preference record says how much a message may say.

Automated voice reminders have rules of their own:

• Every prerecorded message. It states the identity of the business responsible at the beginning, and its telephone number during or after the message.⁠²
• To a residential landline. A prerecorded “health care” message from a HIPAA covered entity or its business associate needs no consent when the caller makes no more than one call a day and three a week to each patient’s line and honors opt-out requests.⁠²
• To a mobile phone. The health care exemption’s conditions apply, including the opt-out during a live call and the toll-free opt-out number for a call that reaches voicemail.⁠²

Can a practice send appointment reminders by unencrypted email?

Yes, with reasonable safeguards and the patient’s informed choice. HHS says covered providers may communicate with patients electronically, such as by email, if they apply reasonable safeguards, such as checking the address before sending, and that unencrypted email is not prohibited for treatment-related communications but should carry limited information.⁠⁵ The same answer uses reminders as its example: a provider should accommodate a request to get appointment reminders by email rather than on a postcard, if email is a reasonable means for that provider, and should offer more secure electronic methods, mail or the phone to a patient who finds unencrypted email unacceptable.⁠⁵ A provider who thinks a patient may not know the risks can explain them and let the patient decide.⁠⁵

• Subject line. The day and the practice, not the service: “Your appointment on [day and date].”
• Sender. A practice address the family recognizes, with someone reading the replies.
• Body. The same elements as a text, plus directions or the video-visit steps, and no attachment carrying clinical information.
• The address itself. The one confirmed at intake, confirmed again whenever a reminder bounces.

Does CAN-SPAM apply to an appointment reminder email?

Only in one respect, as long as the email is only a reminder: its routing information must be accurate. CAN-SPAM covers commercial messages, those whose primary purpose is advertising or promoting a product or service. Content that facilitates an already agreed-upon transaction is transactional, and an email containing only such content must not carry false or misleading routing information but is otherwise exempt from most of the law, a category the FTC reads narrowly.⁠⁹

Adding promotion changes the test. If a reader would take the subject line as an advertisement, or the transactional content does not appear mainly at the beginning, the message is commercial, and the full requirements follow, including a valid physical postal address and an opt-out honored within 10 business days.⁠⁹ Keep reminders as reminders, and send the newsletter separately to people who asked for it.

Who should receive reminders for a child, an adult or a representative?

For a child, usually a parent or guardian; for an adult, the patient, and anyone else only with the patient’s agreement or legal authority. HHS treats a parent, guardian or person acting in loco parentis as a minor’s personal representative in most cases, and defers to state law on what a parent may obtain.⁠⁷ Each group raises its own question:

• Children. Record which adults receive reminders and by which channel. A court may give authority over a child’s health care decisions to an adult other than the parent, so follow any such order the practice holds.⁠⁷
• Adolescents. Where state law lets a minor consent to a particular service and the minor does, the parent is not the personal representative for that care.⁠⁷ Check your state’s law before an adolescent’s reminders go only to a parent.
• Patients who turn 18. For an adult, the personal representative is a person with legal authority to make health care decisions for them, such as a court-appointed guardian, not a parent by default.⁠⁷ Take a new preference record from the patient; the pediatric-to-adult transition guide covers the rest of the handover.
• Adults. Reminders go to the adult. The Privacy Rule lets family members or others involved in a person’s care receive information without being personal representatives,⁠⁷ so a daughter who drives her father may receive his reminders when he agrees. Automated texts to her phone are safest with her own recorded consent: the consent the rule asks for is the called party’s, and the exemption reaches only a number the patient provided.⁠²
• Adults with a representative. A guardian or a health care agent stands in for the patient within the authority they hold; where that authority is limited to particular decisions, it reaches only the information relevant to it.⁠⁷ Keep a copy of the document with the record.

What if a patient asks for reminders at another number or address?

Use it, if the request is reasonable. A covered provider must let patients request communications by alternative means or at alternative locations and must accommodate reasonable requests; it may require the request in writing but may not require an explanation.⁠⁶ HHS gives calls at the office rather than at home, and mail to a post office box, as reasonable requests absent extenuating circumstances.⁠³

Flag the request where the scheduler sees it, and check that the reminder system sends to the alternative contact rather than the number in the demographics, every time the record is edited.

How should reminders work for patients with access needs?

Through a channel and format the person can use, chosen with them. The ADA requires businesses that serve the public to communicate effectively with people who have communication disabilities, the rule extends to a patient’s parent, spouse or companion in appropriate circumstances, and ADA.gov encourages consulting the person about which aid works.⁠¹⁵

• Deaf and hard of hearing patients and parents. Text or email may serve better than a call. Practices must accept relay calls, and staff must treat them like other calls.⁠¹⁵ Relay lets people with hearing or speech disabilities place and receive calls, and dialing 711 reaches some forms of it, though not captioned telephone services, video relay or IP Relay.⁠¹⁶ A provider may call a patient through relay without a business associate contract, and a patient who gives a TTY number can agree to its use then.⁠¹⁷
• Speech and language disabilities. Speech-to-speech relay serves people with speech disabilities.⁠¹⁶ For an adult with aphasia, the treating SLP can help write a reminder in short, plain sentences, and ADA.gov notes that allowing more time with someone who uses a communication board or device may provide effective communication.⁠¹⁵
• Low vision. The ADA’s aids include large print and electronic text for screen-reading programs,⁠¹⁵ so a plain-text email can work where an image-heavy reminder does not; adult OT practices seeing people with low vision should ask which suits each person.
• Companions. A deaf parent of a hearing child is the person the reminder has to reach, and the ADA’s rule on companions covers them.⁠¹⁵

The accessible inquiry forms guide covers collecting these needs before the first visit.

What does Section 1557 require for reminders in another language?

For a practice it covers, language help that is free, accurate and timely. The Section 1557 rule applies to every health program or activity receiving federal financial assistance from HHS, directly or indirectly; its definition of a health program names a physician’s practice among its examples, and federal financial assistance includes grants, loans, subsidies and contracts of insurance, so whether a particular therapy practice is covered depends on its funding and is a question for counsel.⁠^18,19

A covered entity must take reasonable steps to provide meaningful access to each person with limited English proficiency, companions included, and that help “must be provided free of charge, be accurate and timely.”⁠²⁰ Translation must come from a qualified translator; machine translation of text critical to meaningful access, or where accuracy is essential, must be reviewed by a qualified human translator; and a minor child may interpret only as a temporary measure in an emergency.⁠²⁰ Communication with people with disabilities must be as effective as with others, with aids provided free and in accessible formats.⁠²¹

• Templates. Have each reminder translated once by a qualified translator and store the approved versions; let the system choose by the recorded language rather than translate on the fly.
• The notice. The notice that language help and aids are available belongs on application and intake forms, among other places.⁠²²
• The record. A practice that documents a person’s primary language and aids, and sends all materials and communications in that language with those aids, is treated as meeting the notice requirement for that person.⁠²²

Staffing, interpreters and bilingual clinicians are covered in the bilingual services guide.

Which reminder channel fits each patient and purpose?

Read the purpose first, then the person. The first table sorts messages; the second sorts recipients.

What should a consent and preference record capture?

Who agreed, for whom, to which kinds of message, by which channel, in which language, and when, plus every later change. Take it from the person on the intake call or at the first visit and read it back. The texting consent belongs to the person whose phone receives the text,⁠² the confidential-communication request belongs to the patient,⁠⁶ and recording the primary language and aids is what lets every later message use them.⁠²²

Which reminder templates can a therapy practice copy?

Three, one per channel, each filled from the consent record and checked against it. Use the practice’s name as it is registered, replace every bracket, and count the filled text: an exempt text is concise, generally 160 characters or less.⁠²

What should an appointment reminder text say?

The practice, the patient as the record names them, the day, time and place, how to change it and how to stop. The confirmation version asks for a digit, not CANCEL or END, because those words revoke consent when sent in reply to a text.⁠²

What should an appointment reminder email say?

The same facts, with room for directions, the video-visit steps and any arranged interpreter or aid, and a line steering health details to a safer route.

What should a voicemail reminder script say?

Only what the record allows, and less when someone else answers.

How can a practice measure whether its reminders work?

By comparing kept visits in its own schedule, like with like, before and after one change. No outside figure stands in for a practice’s records. A systematic review of 105 studies of missed appointments found high lead time and a prior no-show history to be the most commonly reported significant determinants of no-shows,⁠⁸ so compare visits booked a similar distance ahead and patients with similar histories, or the comparison measures the calendar rather than the reminder.

1. Define the outcomes. Kept, canceled with the notice the policy asks for, canceled late, and no-show, written down once so every week is counted the same way.
2. Log every reminder. For each visit: whether a reminder went, by which channel, how many hours before, whether it was delivered or bounced, and any reply.
3. Take a baseline. Several weeks of the current process, long enough that one unusual week does not decide the result.
4. Change one thing. The send time, the channel, or asking for a confirmation; alternate it by week or by clinic day, and keep anyone who asked for a particular reminder, or needs one for access, on what they asked for.
5. Compare like with like. Split by lead time, by new and returning patients, by children and adults, and by discipline.
6. Read the failures. Wrong numbers, bounced emails, STOP replies and unreturned voicemails show where the contact record failed, not the reminder.

The review sheet holds counts; names and health details stay in the record system. Freed slots feed the waitlist.

How does a reminder plan work for a child and an adult?

Where does a DrSensory inquiry fit before reminders begin?

Before the first visit, and outside the reminder system. On a paid DrSensory listing, a family writes from the clinic’s profile, the clinic’s address for family inquiries is told a message is waiting, the clinic reads the message in its portal and answers from its own email address (DrSensory for therapists).

Writing an inquiry is not consent to reminder texts. Take the preference record when the family or adult patient books, on the intake call, and use it for every reminder after that. Booking the visit and sending its reminders run on the practice’s own systems; the listing brings the inquiry.

Sources

1. U.S. Department of Health and Human Services, Office for Civil Rights. Are appointment reminders allowed under the HIPAA Privacy Rule without authorizations? (HIPAA FAQ, created December 19, 2002; content last reviewed December 28, 2022). “Yes, appointment reminders are considered part of treatment of an individual and, therefore, can be made without an authorization.”. Checked October 23, 2026.
2. eCFR. 47 CFR 64.1200, Delivery restrictions (the FCC’s Telephone Consumer Protection Act rules, paragraphs (a)(1), (a)(3)(v), (a)(9)(iv), (a)(10), (a)(12) and (b); up to date as of October 22, 2026). Checked October 23, 2026.
   Show the passageHide the passage

   “(a) No person or entity may:”; “initiate any telephone call (other than a call made for emergency purposes or is made with the prior express consent of the called party) using an automatic telephone dialing system or an artificial or prerecorded voice”; “To any telephone number assigned to a paging service, cellular telephone service”; “provided that the call is not charged to the called person or counted against the called person's plan limits on minutes or texts. As used in this paragraph (a)(9), the term “call” includes a text message, including a short message service (SMS) call.”; “Calls made by, or on behalf of, healthcare providers, which include hospitals, emergency care centers, medical physician or service offices, poison control centers, and other healthcare professionals, provided that all of the following conditions are met:”; “(A) Voice calls and text messages must be sent only to the wireless telephone number provided by the patient;”; “(B) Voice calls and text messages must state the name and contact information of the healthcare provider (for voice calls, these disclosures would need to be made at the beginning of the call);”; “(C) Voice calls and text messages are strictly limited to those for the following purposes: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions;”; “(D) Voice calls and text messages must not include any telemarketing, solicitation, or advertising; may not include accounting, billing, debt-collection, or other financial content; and must comply with HIPAA privacy rules, 45 CFR 160.103;”; “(E) Voice calls and text messages must be concise, generally one minute or less in length for voice calls or 160 characters or less in length for text messages;”; “(F) A healthcare provider may initiate only one message (whether by voice call or text message) per day to each patient, up to a maximum of three voice calls or text messages combined per week to each patient;”; “(G) A healthcare provider must offer recipients within each message an easy means to opt out of future such messages;”; “voice calls that could be answered by an answering machine or voice mail service must include a toll-free number that the consumer can call to opt out of future healthcare calls; text messages must inform recipients of the ability to opt out by replying “STOP,””; “voice calls that could be answered by a live person must include an automated, interactive voice- and/or key press-activated opt-out mechanism that enables the call recipient to make an opt-out request prior to terminating the call;”; “(H) A healthcare provider must honor opt-out requests immediately.”; “using the words “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” sent in reply to an incoming text message”; “the caller must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent”; “Should the text initiator choose to use a texting protocol that does not allow reply texts, it must provide a clear and conspicuous disclosure on each text to the consumer that two-way texting is not available due to technical limitations of the texting protocol, and clearly and conspicuously provide on each text reasonable alternative ways to revoke consent.”; “All requests to revoke prior express consent or prior express written consent made in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt of such request.”; “A one-time text message confirming a request to revoke consent from receiving any further calls or text messages does not violate paragraphs (a)(1) and (2) of this section as long as the confirmation text merely confirms the text recipient's revocation request and does not include any marketing or promotional information, and is the only additional message sent to the called party after receipt of the revocation request. If the confirmation text is sent within five minutes of receipt, it will be presumed to fall within the consumer's prior express consent.”; “Delivers a “health care” message made by, or on behalf of, a “covered entity” or its “business associate,” as those terms are defined in the HIPAA Privacy Rule, 45 CFR 160.103, and the caller makes no more than one call per day to each patient's residential line, up to a maximum of three calls combined per week to each patient's residential line and honors the called party's request to opt out of future calls”; “At the beginning of the message, state clearly the identity of the business, individual, or other entity that is responsible for initiating the call.”; “During or after the message, state clearly the telephone number (other than that of the autodialer or prerecorded message player that placed the call) of such business, other entity, or individual.”.
3. U.S. Department of Health and Human Services, Office for Civil Rights. May physician’s offices or pharmacists leave messages for patients at their homes, either on an answering machine or with a family member, to remind them of appointments or to inform them that a prescription is ready? (HIPAA FAQ, created December 19, 2002; content last reviewed December 28, 2022). Checked October 23, 2026.
   Show the passageHide the passage

   “the Rule does not prohibit covered entities from leaving messages for patients on their answering machines. However, to reasonably safeguard the individual’s privacy, covered entities should take care to limit the amount of information disclosed on the answering machine. For example, a covered entity might want to consider leaving only its name and number and other information necessary to confirm an appointment, or ask the individual to call back.”; “A covered entity also may leave a message with a family member or other person who answers the phone when the patient is not home.”; “covered entities should use professional judgment to assure that such disclosures are in the best interest of the individual and limit the information disclosed”; “In situations where a patient has requested that the covered entity communicate with him in a confidential manner, such as by alternative means or at an alternative location, the covered entity must accommodate that request, if reasonable.”; “a request to receive mail from the covered entity at a post office box rather than at home, or to receive calls at the office rather than at home are also considered to be reasonable requests, absent extenuating circumstances”.
4. eCFR. 45 CFR 164.501, Definitions (HIPAA Privacy Rule, the definition of marketing; up to date as of October 22, 2026). Checked October 23, 2026.
   Show the passageHide the passage

   “marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.”; “Marketing does not include a communication made:”; “For the following treatment and health care operations purposes, except where the covered entity receives financial remuneration in exchange for making the communication: (A) For treatment of an individual by a health care provider”; “Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described.”.
5. U.S. Department of Health and Human Services, Office for Civil Rights. Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients? (HIPAA FAQ, created December 15, 2008; content last reviewed July 26, 2013). Checked October 23, 2026.
   Show the passageHide the passage

   “The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so.”; “checking the e-mail address for accuracy before sending, or sending an e-mail alert to the patient for address confirmation prior to sending the message”; “while the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications between health care providers and patients, other safeguards should be applied to reasonably protect privacy, such as limiting the amount or type of information disclosed through the unencrypted e-mail”; “a health care provider should accommodate an individual’s request to receive appointment reminders via e-mail, rather than on a postcard, if e-mail is a reasonable, alternative means for that provider to communicate with the patient”; “if the use of unencrypted e-mail is unacceptable to a patient who requests confidential communications, other means of communicating with the patient, such as by more secure electronic methods, or by mail or telephone, should be offered and accommodated”; “the provider can alert the patient of those risks, and let the patient decide whether to continue e-mail communications”.
6. eCFR. 45 CFR 164.522, Rights to request privacy protection for protected health information (paragraph (b), confidential communications; up to date as of October 22, 2026). Checked October 23, 2026.
   Show the passageHide the passage

   “A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations.”; “A covered entity may require the individual to make a request for a confidential communication described in paragraph (b)(1) of this section in writing.”; “A covered health care provider may not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis.”.
7. U.S. Department of Health and Human Services, Office for Civil Rights. Personal Representatives (Privacy Rule guidance, 45 CFR 164.502(g); content last reviewed January 5, 2024). Checked October 23, 2026.
   Show the passageHide the passage

   “In most cases under the Rule, a parent, guardian, or other person acting in loco parentis (collectively, “parent”) is the personal representative of the minor child and can exercise the minor’s rights with respect to protected health information, because the parent usually has the authority to make health care decisions about his or her minor child.”; “the Privacy Rule defers to State or other applicable laws that expressly address the ability of the parent to obtain health information about the minor child.”; “When State or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, and the minor consents to the health care service;”; “the Rule at 45 CFR 164.510(b) addresses situations in which family members or other persons who are involved in the individual’s health care or payment for care may receive protected health information about the individual even if they are not expressly authorized to act on the individual’s behalf”; “A court may grant authority to make health care decisions for the minor to an adult other than the parent”; “A person with legal authority to make health care decisions on behalf of the individual”; “Court appointed legal guardian”; “Where the authority to act for the individual is limited or specific to particular health care decisions, the personal representative is to be treated as the individual only with respect to protected health information that is relevant to the representation.”.
8. Dantas LF, Fleck JL, Cyrino Oliveira FL, Hamacher S. No-shows in appointment scheduling - a systematic literature review. Health Policy. 2018;122(4):412-421. doi:10.1016/j.healthpol.2018.02.002. PMID 29482948 (systematic review; abstract). Checked October 23, 2026.
   Show the passageHide the passage

   “A total of 727 articles and review papers were retrieved from the Scopus database (which includes MEDLINE), 105 of which were selected for identification and analysis.”; “the most commonly reported significant determinants of no-show were high lead time and prior no-show history”.
9. Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business (business guidance, August 2023, edited January 2024). Checked October 23, 2026.
   Show the passageHide the passage

   “It covers all commercial messages, which the law defines as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service,””; “Transactional or relationship content – which facilitates an already agreed-upon transaction or updates a customer about an ongoing transaction”; “If it contains only transactional or relationship content, its primary purpose is transactional or relationship. In that case, it may not contain false or misleading routing information, but is otherwise exempt from most provisions of the CAN-SPAM Act.”; “If a recipient reasonably interpreting the subject line would likely conclude that the message contains an advertisement or promotion for a commercial product or service or if the message’s transactional or relationship content does not appear mainly at the beginning of the message, the primary purpose of the message is commercial.”; “Keep in mind that the law views these categories narrowly.”; “Your message must include your valid physical postal address.”; “You must honor a recipient’s opt-out request within 10 business days.”.
10. U.S. Department of Health and Human Services, Office for Civil Rights. Marketing (Privacy Rule guidance, 45 CFR 164.501 and 164.508(a)(3); content last reviewed July 26, 2013). Checked October 23, 2026.
    Show the passageHide the passage

    “With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing.”; “(2) A communication is not “marketing” if it is made for treatment of the individual.”; “a covered entity may use a business associate to make the communication”.
11. U.S. Department of Health and Human Services. Covered Entities and Business Associates (content last reviewed August 21, 2024). Checked October 23, 2026.
    Show the passageHide the passage

    “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.”; “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.”.
12. U.S. Department of Health and Human Services, Office for Civil Rights. Business Associates (guidance; content last reviewed October 21, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement (collectively referred to as a “business associate agreement,” or BAA), that the business associate will appropriately safeguard the information, among other obligations.”; “Health care application (“app”) developer that contracts with a covered entity to provide the health care app to the covered entity’s patients and creates, receives, maintains, or transmit patients’ PHI for patient management services (e.g., remote patient health counseling, patient messaging, monitoring of patients’ food and exercise, electronic health record (EHR) access) on behalf of the covered entity.”; “Third-party vendor super intelligence (SI) chatbot on a provider’s patient portal that provides services involving the patient’s PHI such as symptom assessment, medical reminders, and appointment scheduling.”.
13. U.S. Department of Health and Human Services, Office for Civil Rights. Does the Security Rule allow for sending electronic PHI (e-PHI) in an email or over the Internet? If so, what protections must be applied? (HIPAA FAQ; content last reviewed July 26, 2013). Checked October 23, 2026.
    Show the passageHide the passage

    “The Security Rule does not expressly prohibit the use of email for sending e-PHI.”; “the covered entity must assess its use of open networks, identify the available and appropriate means to protect e-PHI as it is transmitted, select a solution, and document the decision.”.
14. Federal Communications Commission. Stop Unwanted Robocalls and Texts (consumer guide; last updated or reviewed February 27, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “FCC rules also require a caller to obtain your oral or written consent before making an autodialed or prerecorded call or text to your wireless number.”; “You may opt out of any robocall or robotext at any time and in any reasonable manner, even if you previously gave consent for such calls.”; “Commercial texts require written consent; for informational texts, your consent may be oral.”.
15. U.S. Department of Justice, Civil Rights Division, ADA.gov. ADA Requirements: Effective Communication (guidance; last updated February 28, 2020). Checked October 23, 2026.
    Show the passageHide the passage

    “The ADA requires that title II entities (State and local governments) and title III entities (businesses and nonprofit organizations that serve the public) communicate effectively with people who have communication disabilities.”; “The rules apply to communicating with the person who is receiving the covered entity’s goods or services as well as with that person’s parent, spouse, or companion in appropriate circumstances.”; “information in large print, Braille, or electronically for use with a computer screen-reading program”; “simply allowing more time to communicate with someone who uses a communication board or device may provide effective communication”; “Covered entities are also required to accept telephone calls placed through TRS and VRS, and staff who answer the telephone must treat relay calls just like other calls.”; “Title III entities are encouraged to consult with the person with a disability to discuss what aid or service is appropriate.”.
16. Federal Communications Commission. Telecommunications Relay Service – TRS (consumer guide; last updated or reviewed August 16, 2022). Checked October 23, 2026.
    Show the passageHide the passage

    “Telecommunications Relay Service allows persons with hearing or speech disabilities to place and receive telephone calls.”; “Text-to-Voice TTY-based TRS is a "traditional" TRS service using a TTY to call the CA at the relay center.”; “Speech-to-Speech Relay Service is used by a person with a speech disability.”; “Captioned Telephone Service is used by persons with a hearing disability but some residual hearing.”; “you can dial 711 to connect to certain forms of TRS anywhere in the United States”; “711 access is not available for CTS, IP CTS, VRS, or IP Relay.”.
17. U.S. Department of Health and Human Services, Office for Civil Rights. When a covered entity, such as a doctor, uses a certified Telecommunications Relay Service to contact patients with hearing or speech impairments, is the Relay Service a business associate of the doctor? (HIPAA FAQ, created April 6, 2004; content last reviewed January 9, 2023). Checked October 23, 2026.
    Show the passageHide the passage

    “a covered entity such as a doctor can contact a patient using a Telecommunications Relay Service (TRS), without the need for a business associate contract with the TRS.”; “Where the need for use of the TRS becomes apparent prior to a call being placed, such as when, during an office visit, the individual gives the health care provider his or her TTY number, the opportunity to agree or object to the TRS can be provided at that time.”.
18. eCFR. 45 CFR 92.2, Application (Section 1557 rule; up to date as of October 22, 2026). “Every health program or activity, any part of which receives Federal financial assistance, directly or indirectly, from the Department;”. Checked October 23, 2026.
19. eCFR. 45 CFR 92.4, Definitions (Section 1557 rule; up to date as of October 22, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “Covered entity means: (1) A recipient of Federal financial assistance;”; “Federal financial assistance means any grant, loan, credit, subsidy, contract (other than a procurement contract but including a contract of insurance), or any other arrangement by which the Federal Government, directly or indirectly, provides assistance”; “physician's practice”.
20. eCFR. 45 CFR 92.201, Meaningful access for individuals with limited English proficiency (Section 1557 rule; up to date as of October 22, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “A covered entity must take reasonable steps to provide meaningful access to each individual with limited English proficiency (including companions with limited English proficiency) eligible to be served or likely to be directly affected by its health programs and activities.”; “Language assistance services required under paragraph (a) of this section must be provided free of charge, be accurate and timely, and protect the privacy and the independent decision-making ability of the individual with limited English proficiency.”; “When translation services are required under this part, a covered entity must utilize the services of a qualified translator in its health programs and activities.”; “If a covered entity uses machine translation when the underlying text is critical to the rights, benefits, or meaningful access of an individual with limited English proficiency, when accuracy is essential, or when the source documents or materials contain complex, non-literal or technical language, the translation must be reviewed by a qualified human translator.”; “Rely on a minor child to interpret or facilitate communication, except as a temporary measure”.
21. eCFR. 45 CFR 92.202, Effective communication for individuals with disabilities (Section 1557 rule; up to date as of October 22, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “A covered entity must take appropriate steps to ensure that communications with individuals with disabilities (including companions with disabilities), are as effective as communications with non-disabled individuals in its health programs and activities”; “Such auxiliary aids and services must be provided free of charge, in accessible formats, in a timely manner, and in such a way to protect the privacy and the independence of the individual with a disability.”.
22. eCFR. 45 CFR 92.11, Notice of availability of language assistance services and auxiliary aids and services (Section 1557 rule; up to date as of October 22, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “A covered entity must provide a notice of availability of language assistance services and auxiliary aids and services”; “must be provided in English and at least the 15 languages most commonly spoken by individuals with limited English proficiency of the relevant State or States in which a covered entity operates”; “Application and intake forms;”; “Document the individual's primary language and any appropriate auxiliary aids and services and: (i) Provides all materials and communications in that individual's primary language and through any appropriate auxiliary aids and services;”.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice, not legal, compliance, billing or financial advice. It covers federal rules only, not state privacy or texting laws, and its examples are hypothetical, not DrSensory data or benchmarks.