How to check in with former therapy patients

For OT, PT and SLP practices seeing children, adults or both: under HIPAA, a check-in that follows up on care, recommends a return visit or describes your own services is not marketing unless a third party pays for it.⁠¹ Texting and email law judge promotions separately, so sort each message by purpose, then channel, and honor every opt-out.

What counts as a check-in with a former therapy patient?

Any message a practice sends to someone it no longer treats: an adult discharged from PT after a knee replacement, a family whose child finished a feeding program, a teenager who aged out of pediatric speech therapy, or someone who stopped booking. Closing the episode is covered in the guide to discharging patients; this guide starts after it. The kind of message decides the rules:

• Clinical follow-up. The treating clinician asks how the home program is going or whether a new concern has come up.
• Return-visit recommendation. A clinician who knows the case suggests a re-check.
• Administrative notice. A new address, a closed location, or how to get records.
• Program announcement. A new group, service or location.
• Review request. An invitation to describe the experience on a review site.
• Gift or offer. A holiday item, a discount or a free screen.

The first two are care; the last three promote something. HIPAA applies when the practice is a covered entity, which for a provider means one that transmits health information electronically in connection with a standard transaction, such as an electronic claim.⁠⁹ The federal texting, email and review rules below apply whether or not HIPAA does.⁠^3,4,10

Which permission does each kind of check-in need?

It depends on the purpose more than the channel: care messages need no HIPAA authorization, promotions need the consent their channel requires, and anything a third party pays for needs a written authorization.

Record each message’s row before drafting it. A message that mixes rows, such as a follow-up letter that also advertises a paid group, is split in two or given the strictest row’s treatment.

When is a former-patient check-in marketing under HIPAA?

When it encourages the recipient to buy or use a product or service and fits none of the exceptions. The Privacy Rule defines marketing as a communication about a product or service “that encourages recipients of the communication to purchase or use” it, then excludes communications for treatment, including care coordination and recommending “alternative treatments, therapies, health care providers, or settings of care,” and communications describing a health-related product or service the covered entity itself provides, unless the practice receives financial remuneration for making them.⁠¹ Financial remuneration means payment from or on behalf of a third party whose product or service is described; payment for treatment does not count.⁠¹

• Treatment, not marketing. A PT asking how stairs are going since discharge, an SLP asking whether a child’s carryover held over the summer, or an OT suggesting a re-check before handwriting demands rise in a new grade.⁠¹
• The practice’s own service, not marketing. A letter announcing the practice’s new adult vestibular clinic or pediatric feeding group, provided no third party pays. HHS gives the parallel example of a hospital using its patient list to announce a new specialty group through a general mailing.⁠¹¹
• Marketing. An email promoting a vendor’s sensory product or a partner gym’s membership, or anything a manufacturer pays the practice to send. HHS’s own example is a hospital telling former patients about an outside cardiac facility offering a baseline EKG for $39, when the message is not treatment advice.⁠¹¹

Marketing needs the patient’s written authorization, except for face-to-face communication and promotional gifts of nominal value; when a third party pays the practice, the authorization must say so, and the patient may revoke it in writing at any time.⁠² HHS adds that covered entities may not sell lists of patients to third parties without authorization from each person on the list.⁠¹¹ Its marketing guidance dates from 2002, revised in 2003; where its wording differs from the current regulation, the regulation governs.⁠^1,11

Does a message about the practice’s new program need an authorization?

Not under HIPAA, if it describes the practice’s own health-related service and nobody else pays for it.⁠¹ That answer is narrow. The same announcement is still commercial email under CAN-SPAM, and as a text or call it is telemarketing under the FCC’s definition, because both ask whether a message promotes a product or service, not whether HIPAA calls it marketing.⁠^3,4 A partner that pays toward the program or the mailing, such as a co-hosting dance studio, makes it HIPAA marketing again.⁠¹ The guide to sports leagues and dance studios covers such partnerships.

Which vendors may send check-ins on the practice’s behalf?

For a covered practice, only vendors bound by a business associate agreement. HHS states that a covered entity may use a business associate to make a communication under the marketing exceptions, with its agreement to use the information only for the practice’s communications,⁠¹¹ and the Privacy Rule requires satisfactory assurance of safeguarding first.⁠¹² An advertising platform that refuses to sign should not receive a former-patient list at all, and no vendor needs diagnoses to send a message.⁠¹²

Which rules apply when a check-in goes by text or phone?

The FCC’s Telephone Consumer Protection Act rules, which turn on the technology and the content. A call or text to a cell phone made with an autodialer or an artificial or prerecorded voice needs the called party’s prior express consent unless it is an emergency, and one that “includes or introduces an advertisement or constitutes telemarketing” needs prior express written consent.⁠^3,13 The FCC’s consumer guide puts it in one line: “Commercial texts require written consent; for informational texts, your consent may be oral.”⁠¹³

Two details matter here. The written-consent requirement carves out a call that delivers a “health care” message made by or for a HIPAA covered entity, a term the rule’s text does not define;⁠³ whether a program promotion qualifies is a question for counsel, and written consent makes it moot. And the rule defines an autodialer as equipment that can store or produce numbers using a random or sequential number generator;⁠³ whether a texting platform meets that definition is for the vendor and counsel to say, so plan as though the consent rules apply.

Does consent to appointment reminders cover promotional texts?

No. Prior express written consent is a signed written agreement that clearly authorizes the sender to deliver advertisements or telemarketing messages to a named number, with a disclosure that signing is not a condition of buying anything.⁠³ A phone number given at intake, or a yes to reminders, authorizes neither. Nor does the FCC’s health care exemption fill the gap: it covers free-to-the-patient messages “strictly limited” to purposes such as appointment reminders, wellness checkups and post-discharge follow-up intended to prevent readmission, and bars telemarketing, advertising and billing content.⁠³ The guide to appointment reminders covers the reminders themselves.

How fast must a practice honor a text or call opt-out?

Within 10 business days at most, by whatever reasonable method the person uses. The FCC’s rule lets a person revoke consent “by using any reasonable method,” treats replies such as stop, quit, cancel or unsubscribe as revocation, bars a sender from naming an exclusive way to revoke, and sets the ten-business-day limit.⁠³ One confirmation text is allowed if it only confirms and contains no marketing; sent within five minutes, it is presumed to fall within the person’s prior consent.⁠³ Treat a spoken request at the front desk the same way, and enter it in the record that day.

What rules apply to a live phone call to a former patient?

A hand-dialed call that promotes a program can be a telephone solicitation. Those may not go to a residential number on the national do-not-call registry, or to a residential subscriber before 8 a.m. or after 9 p.m. local time, but the definition excludes calls to a person with an established business relationship: a purchase or transaction in the previous 18 months, or an inquiry in the previous three.⁠³ A person’s own do-not-call request ends that relationship for telemarketing even if they stay a patient, and must be honored within 10 business days and for five years.⁠³ Many states keep their own do-not-call lists too.⁠¹³ A clinical follow-up call is not a solicitation, but its voicemail should say little: HHS suggests leaving only the practice’s name and number and other necessary information, or asking the person to call back.⁠¹⁴

What does CAN-SPAM require of a check-in email?

If the email’s primary purpose is to promote a commercial product or service, all of CAN-SPAM applies; the FTC’s own example of email that must comply is “a message to former customers announcing a new product line.”⁠⁴ Such an email needs a subject line that accurately reflects the content, a clear and conspicuous disclosure that it is an advertisement, the practice’s valid physical postal address, a clear way to opt out, and opt-outs honored within 10 business days, with opted-out addresses never sold or transferred. The practice stays responsible when a vendor sends for it, since a business “can’t contract away” that responsibility.⁠⁴

A clinical follow-up that promotes nothing is not a commercial message, but a program plug can change that: the FTC treats a mixed message as commercial when a reader of its subject line, or of its body, would likely conclude that its primary purpose is promotion.⁠⁴ Keep promotions out of care emails, and care details out of promotions.

How should a covered practice protect privacy in check-in emails?

With the safeguards HHS describes for any patient email, such as checking the address before sending and limiting the information in unencrypted email; a provider may assume email is acceptable to a patient who starts an email exchange, unless the patient says otherwise.⁠¹⁵ “Checking in after your stroke rehab” as a subject line discloses far more than “A note from your therapy clinic.”

Who may a practice contact about a former patient?

The patient, or the person with legal authority to act for them, through the routes they accept. HIPAA treats a personal representative, someone authorized under state or other law to make health care decisions for the patient, as the patient.⁠⁷

For a child, that is usually the parent. HHS says a parent is in most cases the minor’s personal representative, with exceptions that track state law on minors consenting to their own care, a court’s grant of authority to someone else, and a parent’s agreement to a confidential relationship between the minor and the provider.⁠⁷ Address pediatric check-ins to the parent or guardian on the record, and confirm that a custody change since discharge has not changed who that is.

For an adult, the message goes to the patient unless they have named someone or have a legal representative. A family member involved in the patient’s care may receive information directly relevant to that involvement,⁠¹⁶ which does not make them the default recipient of program news.

What changes when a pediatric patient turns 18?

The parent’s authority as a parent ends when state law makes the patient an adult, so check-ins go to the patient. For an adult, HHS lists the personal representative as a person with legal authority to make health care decisions, such as a health care power of attorney or a court-appointed guardian;⁠⁷ a parent who holds neither is a family member. The age and its exceptions come from state law, so check yours rather than assuming 18. Update a file that lists only a parent’s details; the guide to the pediatric-to-adult transition covers that handoff.

How should check-ins honor confidential-communication requests?

By following them for every kind of message, promotions included. A covered provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations, without asking why,⁠¹⁷ and HHS counts a closed envelope instead of a postcard, a post office box, or calls at work instead of at home as reasonable requests.⁠¹⁴ Store the request where every sending tool can see it.

How should a check-in list handle a patient who has died?

Remove the patient from every check-in and promotional list as soon as the practice learns of the death. HIPAA protects a decedent’s health information for 50 years after death, and in that time a practice may share relevant information with family members who were involved in the patient’s care, unless that conflicts with a known preference the patient expressed.⁠^8,9 A condolence note from the treating clinician is a personal choice; a program announcement or review request is not.

Can a check-in ask a former patient for a review?

Yes, if it asks everyone the same way and offers nothing tied to what they write. The FTC’s rule makes it unfair or deceptive to provide incentives in exchange for, or conditioned on, reviews expressing a particular sentiment, positive or negative.⁠¹⁰ Review sites add rules of their own; the guide to requesting and responding to reviews covers them, with neutral request wording and public replies that disclose nothing about care.

Send the request as its own message, not inside a clinical follow-up, so a note about a child’s progress does not read as a request for praise. For Medicare and Medicaid patients, any reward for a review is also a beneficiary-inducement question, covered next. A clinic with a paid DrSensory listing can show reviews and reply to them publicly, under the same reply rules.

Can a check-in include a gift or an offer for Medicare patients?

Only a small one, and never cash or a cash equivalent. OIG explains that a person who offers a Medicare or Medicaid beneficiary remuneration they know or should know is likely to influence the choice of provider may be liable for civil monetary penalties, and that remuneration includes waived copayments and deductibles and items or services given free or below fair market value.⁠⁵ In its December 7, 2016 policy statement, OIG says it is “interpreting ‘nominal value’ as having a retail value of no more than $15 per item or $75 in the aggregate per patient on an annual basis,” excludes cash and cash equivalents, and says a gift within those thresholds need not fit an exception.⁠⁵ OIG counts general-purpose prepaid cards and gift cards from big-box retailers as cash equivalents, an answer it says reflects only its own interpretation.⁠⁶

So a small branded item with a thank-you note can fit OIG’s reading, while a big-box gift card does not, whatever its amount.⁠^5,6 A “come back for a free screen” offer, or a waived copay on a return visit, is remuneration as the statute defines it; have counsel confirm that an exception or the nominal-value reading covers it first.⁠⁵

HIPAA’s exception for promotional gifts of nominal value concerns authorization only,⁠² and does not answer OIG’s question. For commercially insured and self-pay patients, ask counsel about state law and payer contracts before offering discounts.

How do language and disability access apply to check-ins?

As they apply to any patient communication: a check-in in a language the person cannot read, or by a channel they cannot use, has not reached them. Section 1557’s rule covers every health program or activity that receives federal financial assistance from HHS,⁠¹⁸ and HHS’s 2024 rule interprets Medicare Part B payments as such assistance, so its requirements reach practices paid through Part B.⁠¹⁹ A June 2, 2026 notice reports that a court vacated certain gender-identity provisions of that rule and that the other provisions remain in force; the language-access section, 45 CFR 92.201, is not on its list.⁠²⁰

• Meaningful access. Take reasonable steps to give each person with limited English proficiency meaningful access, with language help that is free, accurate, timely and private.⁠²¹
• Machine translation. Have a qualified human translator review a software-translated check-in when the text is critical or accuracy is essential.⁠²¹
• No child interpreters. Do not route a parent’s follow-up call through the child; the rule bars relying on a minor child to interpret except as a temporary measure in an emergency.⁠²¹
• The notice. Part 92 requires a notice of available language assistance in communications about a person’s services that request a response,⁠¹⁸ which a check-in asking for a reply can be.

The ADA requires businesses that serve the public to communicate effectively with people who have vision, hearing or speech disabilities, including a patient’s parent, spouse or companion in appropriate circumstances, and to accept relay calls and treat them like any other call.⁠²² Record each person’s communication method, since for some former SLP patients a phone call is the wrong channel. The guides to Spanish-language services and accessible inquiry forms cover the wider setup.

What should a clinical follow-up check-in say and leave out?

It should ask how the person is doing, offer a route back, and claim nothing it has not assessed; the professional codes apply to it as to a visit. ASHA’s Code of Ethics says certified members “shall provide services or dispense products only when benefit can reasonably be expected” and may offer a reasonable prognosis but not promise results;⁠²³ APTA’s code requires information about services that is “truthful and accurate,” with no misleading representations in any communication, and full disclosure of any financial interest in a recommended product;⁠²⁴ and AOTA describes an obligation of ethical conduct toward clients, families, caregivers and payers, guided by principles that include veracity and autonomy.⁠^25,26

• Ask; do not diagnose. “Are the exercises still part of your week?” rather than “Your balance has probably slipped.”
• Offer the way back as a choice. A call with the clinician, a re-evaluation, or nothing at all.
• Keep details out of what others see. No diagnosis in subject lines, text previews, postcards or voicemails.⁠^14,15
• Route replies to a clinician the same day when they describe a new problem.
• Stay in your discipline. An OT who notices a speech concern suggests the practice’s SLP rather than implying a speech assessment that did not happen.

What happens when a former patient wants to come back?

The clinician decides what the return needs, within the payer’s rules; the discharge guide covers that decision. If Medicare Part B pays, the services are again furnished under a plan of treatment, and when a therapist establishes the plan, a physician, NP, CNS or PA who knows the case certifies it, unless the record holds a written order or referral and the therapist documents delivering the plan to that practitioner within 30 days of the initial evaluation.⁠²⁷ PT direct access is a state matter: APTA reports that all 50 states, DC and the U.S. Virgin Islands provide some form of it, with provisions and limits that differ by jurisdiction.⁠²⁸ Check the patient’s plan for referral rules, and for OT and SLP your state practice act too. The intake call script covers the call that follows.

How should a practice announce a new program to former patients?

As a promotion, sent only to people who chose program news and are in its population, by a channel whose rules it meets. Email meets CAN-SPAM; autodialed texts go only to numbers with written consent to promotional messages; a partner’s payment means HIPAA authorizations first.⁠^2,3,4 Translations get a qualified translator’s review where the rule requires it.⁠²¹

How should a practice record consent, preferences and opt-outs?

In one record per person that every sending tool reads, with the source and day of each choice: the FCC’s written-consent definition makes a signed agreement the evidence for promotional texts,⁠³ and a confidential-communication request changes the default route for everything.⁠¹⁷

The opt-out confirmation is the one message sent after a stop request, and it carries nothing else; if the person had agreed to several kinds of text, it may ask which they meant, and without an answer every text that needs consent stops.⁠³

Keep opt-outs for good: the FCC requires a do-not-call request to be honored for five years, and the FTC bars selling or transferring an opted-out email address.⁠^3,4 Re-check the suppression list whenever records arrive from an old system.

How might one practice handle three different check-ins?

How can a practice measure what its check-ins do?

By recording each send and comparing it with a group that has not yet received it. No rule sets a target, and a figure borrowed from another practice measures that practice, so your own records are the benchmark.

1. Define one send. The message type from the decision table, the channel, the population and discipline, the day and the list size.
2. Hold back a comparison group. Set aside a random part of the eligible list and send to it a month later; comparing the two groups over the same weeks separates what the message changed from what would have happened anyway.
3. Count what you can verify. Replies, clinical questions routed to a clinician, re-evaluations booked within a window set in advance, opt-outs, complaints and undeliverable addresses.
4. Keep identities out of the report. Count inside the scheduling or records system and move only totals to any marketing spreadsheet, in line with the minimum-necessary standard.⁠¹²
5. Read the costs too. Opt-outs that rise with each send, or complaints about tone, are reasons to send less often or rewrite the message.

Set the interval from those results and the clinical plan, not from another practice’s calendar.

Where does a DrSensory listing fit in former-patient contact?

It is where former patients may find the clinic again, so it needs to be accurate; it is not a channel for check-ins. DrSensory is a free directory families use to find occupational therapy, physical therapy and speech therapy clinics for children and adults in all 50 states and Washington, DC. Every clinic has a basic listing at no cost, and claiming it is free. On a paid listing, a family’s inquiry is read in the clinic’s portal and answered from the clinic’s own email address, and the clinic can show reviews and reply to them publicly.

• An inquiry is not consent. A former patient who writes through the listing has asked a question, which is not the signed agreement promotional texts require⁠³ nor a yes to program news. Ask, and record the answer, before adding anyone to a list.
• Stale details turn people away. An out-of-date “accepting new patients” or typical wait gives a returning patient the wrong answer. The profile guide covers keeping a listing current, and the pricing page sets out what a paid listing adds.

Sources

1. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR 164.501, Definitions (HIPAA Privacy Rule) (current text; definition of marketing). Checked October 23, 2026.
   Show the passageHide the passage

   “marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.”; “For the following treatment and health care operations purposes, except where the covered entity receives financial remuneration in exchange for making the communication:”; “For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual;”; “To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication”; “Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described. Direct or indirect payment does not include any payment for treatment of an individual.”.
2. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR 164.508, Uses and disclosures for which an authorization is required (current text; §164.508(a)(3) and (b)(5)). Checked October 23, 2026.
   Show the passageHide the passage

   “a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of: (A) A face-to-face communication made by a covered entity to an individual; or (B) A promotional gift of nominal value provided by the covered entity.”; “If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.”; “An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing”.
3. Office of the Federal Register, Electronic Code of Federal Regulations. 47 CFR 64.1200, Delivery restrictions (Telephone Consumer Protection Act rules) (current text, up to date as of October 22, 2026). Checked October 23, 2026.
   Show the passageHide the passage

   “No person or entity may:”; “initiate any telephone call (other than a call made for emergency purposes or is made with the prior express consent of the called party) using an automatic telephone dialing system or an artificial or prerecorded voice;”; “To any telephone number assigned to a paging service, cellular telephone service”; “any telephone call that includes or introduces an advertisement or constitutes telemarketing, using an automatic telephone dialing system or an artificial or prerecorded voice, to any of the lines or telephone numbers described in paragraphs (a)(1)(i) through (iii) of this section, other than a call made with the prior express written consent of the called party”; “or a call that delivers a “health care” message made by, or on behalf of, a “covered entity” or its “business associate,” as those terms are defined in the HIPAA Privacy Rule, 45 CFR 160.103.”; “As used in this paragraph (a)(9), the term “call” includes a text message, including a short message service (SMS) call.”; “provided that the call is not charged to the called person or counted against the called person’s plan limits on minutes or texts.”; “Voice calls and text messages are strictly limited to those for the following purposes: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions;”; “Voice calls and text messages must not include any telemarketing, solicitation, or advertising; may not include accounting, billing, debt-collection, or other financial content; and must comply with HIPAA privacy rules”; “by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender.”; “using the words “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” sent in reply to an incoming text message;”; “All requests to revoke prior express consent or prior express written consent made in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt of such request.”; “may not designate an exclusive means to request revocation of consent.”; “A one-time text message confirming a request to revoke consent from receiving any further calls or text messages does not violate paragraphs (a)(1) and (2) of this section as long as the confirmation text merely confirms the text recipient’s revocation request and does not include any marketing or promotional information”; “If the confirmation text is sent within five minutes of receipt, it will be presumed to fall within the consumer’s prior express consent.”; “the confirmation message may request clarification as to whether the revocation request was meant to encompass all such messages; the sender must cease all further texts for which consent is required absent further clarification that the recipient wishes to continue to receive certain text messages.”; “A residential telephone subscriber who has registered his or her telephone number on the national do-not-call registry of persons who do not wish to receive telephone solicitations that is maintained by the Federal Government.”; “This period may not exceed ten (10) business days from the receipt of such request.”; “Any residential telephone subscriber before the hour of 8 a.m. or after 9 p.m. (local time at the called party’s location)”; “A do-not-call request must be honored for 5 years from the time the request is made.”; “on the basis of the subscriber’s purchase or transaction with the entity within the eighteen (18) months immediately preceding the date of the telephone call or on the basis of the subscriber’s inquiry or application regarding products or services offered by the entity within the three months immediately preceding the date of the call”; “The subscriber’s seller-specific do-not-call request, as set forth in paragraph (d)(3) of this section, terminates an established business relationship for purposes of telemarketing and telephone solicitation even if the subscriber continues to do business with the seller.”; “The terms automatic telephone dialing system and autodialer mean equipment which has the capacity to store or produce telephone numbers to be called using a random or sequential number generator and to dial such numbers.”; “The term prior express written consent means an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice”; “The person is not required to sign the agreement (directly or indirectly), or agree to enter into such an agreement as a condition of purchasing any property, goods, or services.”; “The term telemarketing means the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services, which is transmitted to any person.”; “but such term does not include a call or message: (i) To any person with that person’s prior express invitation or permission; (ii) To any person with whom the caller has an established business relationship;”.
4. Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business (business guidance). Checked October 23, 2026.
   Show the passageHide the passage

   “It covers all commercial messages, which the law defines as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service,””; “That means all email – for example, a message to former customers announcing a new product line – must comply with the law.”; “The subject line must accurately reflect the content of the message.”; “you must disclose clearly and conspicuously that your message is an advertisement.”; “Your message must include your valid physical postal address.”; “Your message must include a clear and conspicuous explanation of how the recipient can opt out of getting marketing email from you in the future.”; “You must honor a recipient’s opt-out request within 10 business days.”; “Once people have told you they don’t want to receive more messages from you, you can’t sell or transfer their email addresses, even in the form of a mailing list.”; “you can’t contract away your legal responsibility to comply with the law.”; “Keep in mind that the law views these categories narrowly.”; “A recipient reasonably interpreting the subject line would likely conclude that the message advertises or promotes a commercial product or service; or A recipient reasonably interpreting the body of the message would likely conclude that the primary purpose of the message is to advertise or promote a product or service.”.
5. U.S. Department of Health and Human Services, Office of Inspector General. Office of Inspector General Policy Statement Regarding Gifts of Nominal Value To Medicare and Medicaid Beneficiaries (policy statement, December 7, 2016). Checked October 23, 2026.
   Show the passageHide the passage

   “a person who offers or transfers to a Medicare or Medicaid beneficiary any remuneration that the person knows or should know is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of Medicare or Medicaid payable items or services may be liable for civil monetary penalties”; “the statute defines “remuneration” to include, without limitation, waivers of copayments and deductible amounts (or any part thereof) and transfers of items or services for free or for other than fair market value.”; “we are interpreting “nominal value” as having a retail value of no more than $15 per item or $75 in the aggregate per patient on an annual basis.”; “the items may not be cash or cash equivalents. If a gift has a value at or below these thresholds, then the gift need not fit into an exception to section 1128A(a)(5).”.
6. U.S. Department of Health and Human Services, Office of Inspector General. General Questions Regarding Certain Fraud and Abuse Authorities (FAQ, question 5). Checked October 23, 2026.
   Show the passageHide the passage

   ““Cash equivalents” include items convertible to cash (such as a check) or items that can be used like cash, such as a general-purpose prepaid card such as a Visa or Mastercard gift card.”; “Gift cards offered by large retailers or online vendors that sell a wide variety of items (e.g., big-box stores) could easily be diverted from their intended purpose or converted to cash.”; “Consequently, OIG considers such gift cards to be cash equivalents.”; “this answer reflects only OIG’s interpretation of these terms.”.
7. U.S. Department of Health and Human Services, Office for Civil Rights. Personal Representatives (HIPAA Privacy Rule guidance on 45 CFR 164.502(g); content last reviewed January 5, 2024). Checked October 23, 2026.
   Show the passageHide the passage

   “Under the Rule, a person authorized (under State or other applicable law, e.g., tribal or military law) to act on behalf of the individual in making health care related decisions is the individual’s “personal representative.””; “In most cases under the Rule, a parent, guardian, or other person acting in loco parentis (collectively, “parent”) is the personal representative of the minor child and can exercise the minor’s rights with respect to protected health information, because the parent usually has the authority to make health care decisions about his or her minor child.”; “These exceptions generally track the ability of certain minors to obtain specified health care without parental consent under State or other laws, or standards of professional practice.”; “When someone other than the parent is authorized by law to consent to the provision of a particular health service to a minor and provides such consent;”; “When a parent agrees to a confidential relationship between the minor and a health care provider.”; “A person with legal authority to make health care decisions on behalf of the individual”; “Examples: Health care power of attorney”; “The covered entity should not treat that person as the individual for other purposes, such as to sign an authorization for the disclosure of protected health information for marketing purposes.”.
8. U.S. Department of Health and Human Services, Office for Civil Rights. Health Information of Deceased Individuals (HIPAA Privacy Rule guidance; content last reviewed September 19, 2013). Checked October 23, 2026.
   Show the passageHide the passage

   “The HIPAA Privacy Rule protects the individually identifiable health information about a decedent for 50 years following the date of death of the individual.”; “the Privacy Rule permits a covered entity to disclose the relevant protected health information of the decedent to such persons, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity.”.
9. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR 160.103, Definitions (current text). Checked October 23, 2026.
   Show the passageHide the passage

   “Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”; “Protected health information excludes individually identifiable health information:”; “(iv) Regarding a person who has been deceased for more than 50 years.”.
10. Federal Trade Commission; Office of the Federal Register, Electronic Code of Federal Regulations. 16 CFR Part 465, Use of Consumer Reviews and Testimonials (current text; §§465.4 and 465.2(d)). Checked October 23, 2026.
    Show the passageHide the passage

    “It is an unfair or deceptive act or practice and a violation of this part for a business to provide compensation or other incentives in exchange for, or conditioned expressly or by implication on, the writing or creation of consumer reviews expressing a particular sentiment, whether positive or negative, regarding the product, service, or business that is the subject of the review.”; “paragraphs (b) and (c) of this section do not apply to: (1) Reviews or testimonials that resulted from a business making generalized solicitations to purchasers to post reviews or testimonials about their experiences with the product, service, or business”.
11. U.S. Department of Health and Human Services, Office for Civil Rights. Marketing (HIPAA Privacy Rule guidance, December 3, 2002, revised April 3, 2003; content last reviewed July 26, 2013; it predates the 2013 amendments, so the current definition is the one in 45 CFR 164.501). Checked October 23, 2026.
    Show the passageHide the passage

    “With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing.”; “A communication from a hospital informing former patients about a cardiac facility, that is not part of the hospital, that can provide a baseline EKG for $39, when the communication is not for the purpose of providing treatment advice.”; “covered entities may not sell lists of patients or enrollees to third parties without obtaining authorization from each person on the list.”; “This exception to the marketing definition permits communications by a covered entity about its own products or services.”; “A hospital uses its patient list to announce the arrival of a new specialty group (e.g., orthopedic) or the acquisition of new equipment (e.g., x-ray machine or magnetic resonance image machine) through a general mailing or publication.”; “For any of the three exceptions to the definition of marketing, the activity must otherwise be permissible under the Privacy Rule, and a covered entity may use a business associate to make the communication. As with any disclosure to a business associate, the covered entity must obtain the business associate’s agreement to use the protected health information only for the communication activities of the covered entity.”.
12. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR 164.502, Uses and disclosures of protected health information: General rules (current text; §164.502(b) and (e)). Checked October 23, 2026.
    Show the passageHide the passage

    “a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.”; “A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information.”.
13. Federal Communications Commission. Stop Unwanted Robocalls and Texts (consumer guide; last updated or reviewed February 27, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “Robocalls are phone calls made using an autodialer or a prerecorded or artificial voice message.”; “FCC rules also require a caller to obtain your oral or written consent before making an autodialed or prerecorded call or text to your wireless number.”; “You may opt out of any robocall or robotext at any time and in any reasonable manner, even if you previously gave consent for such calls.”; “Commercial texts require written consent; for informational texts, your consent may be oral.”; “Many states now have statewide do-not-call lists for residents.”.
14. U.S. Department of Health and Human Services, Office for Civil Rights. May physician’s offices or pharmacists leave messages for patients at their homes, either on an answering machine or with a family member, to remind them of appointments or to inform them that a prescription is ready? (HIPAA FAQ, created December 19, 2002; content last reviewed December 28, 2022). Checked October 23, 2026.
    Show the passageHide the passage

    “the Rule does not prohibit covered entities from leaving messages for patients on their answering machines. However, to reasonably safeguard the individual’s privacy, covered entities should take care to limit the amount of information disclosed on the answering machine.”; “a covered entity might want to consider leaving only its name and number and other information necessary to confirm an appointment, or ask the individual to call back.”; “the Department considers a request to receive mailings from the covered entity in a closed envelope rather than by postcard to be a reasonable request that should be accommodated.”; “a request to receive mail from the covered entity at a post office box rather than at home, or to receive calls at the office rather than at home are also considered to be reasonable requests”.
15. U.S. Department of Health and Human Services, Office for Civil Rights. Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients? (HIPAA FAQ, created December 15, 2008; content last reviewed July 26, 2013). Checked October 23, 2026.
    Show the passageHide the passage

    “The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so.”; “checking the e-mail address for accuracy before sending”; “limiting the amount or type of information disclosed through the unencrypted e-mail”; “Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual.”.
16. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR 164.510, Uses and disclosures requiring an opportunity for the individual to agree or to object (current text; §164.510(b)(1)(i)). Checked October 23, 2026.
    Show the passageHide the passage

    “disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s health care or payment related to the individual’s health care.”.
17. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR 164.522, Rights to request privacy protection for protected health information (current text; §164.522(b)). Checked October 23, 2026.
    Show the passageHide the passage

    “A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations.”; “A covered health care provider may not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis.”.
18. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR Part 92, Nondiscrimination in Health Programs or Activities (current text; §§92.2 and 92.11). Checked October 23, 2026.
    Show the passageHide the passage

    “Every health program or activity, any part of which receives Federal financial assistance, directly or indirectly, from the Department;”; “A covered entity must provide a notice of availability of language assistance services and auxiliary aids and services”; “Communications related to an individual’s rights, eligibility, benefits, or services that require or request a response from a participant, beneficiary, enrollee, or applicant;”.
19. U.S. Department of Health and Human Services, Office for Civil Rights, and Centers for Medicare & Medicaid Services. Nondiscrimination in Health Programs and Activities (final rule, 89 FR 37522, May 6, 2024; notice of interpretation). Checked October 23, 2026.
    Show the passageHide the passage

    “The Department is finalizing its interpretation that Medicare Part B (“Part B”) funding meets the definition of “Federal financial assistance” for the purpose of title VI, title IX, section 504, the Age Act, and section 1557.”; “Thus, the requirements of section 1557 and other civil rights statutes apply to entities that receive payments through Medicare Part B.”.
20. U.S. Department of Health and Human Services, Office for Civil Rights, and Centers for Medicare & Medicaid Services. Notice of Vacatur Regarding Certain Provisions of the 2024 Nondiscrimination in Health Programs and Activities Final Rule (notification of court decision, 91 FR 32887, June 2, 2026). Checked October 23, 2026.
    Show the passageHide the passage

    “Specifically, the court vacated certain provisions of the regulation to the extent they expand Title IX’s definition of sex discrimination to include gender-identity discrimination.”; “45 CFR 92.101(a)(2)(iv), 45 CFR 92.206(b)(1)-(4), 45 CFR 92.207(b)(3)-(5), 45 CFR 92.8(b)(1), 45 CFR 92.10(a)(1)(i), and 45 CFR 92.208.”; “The other provisions of the Section 1557 Rule remain in force.”.
21. Office of the Federal Register, Electronic Code of Federal Regulations. 45 CFR 92.201, Meaningful access for individuals with limited English proficiency (current text (Section 1557 rule)). Checked October 23, 2026.
    Show the passageHide the passage

    “A covered entity must take reasonable steps to provide meaningful access to each individual with limited English proficiency (including companions with limited English proficiency) eligible to be served or likely to be directly affected by its health programs and activities.”; “Language assistance services required under paragraph (a) of this section must be provided free of charge, be accurate and timely, and protect the privacy and the independent decision-making ability of the individual with limited English proficiency.”; “If a covered entity uses machine translation when the underlying text is critical to the rights, benefits, or meaningful access of an individual with limited English proficiency, when accuracy is essential, or when the source documents or materials contain complex, non-literal or technical language, the translation must be reviewed by a qualified human translator.”; “Rely on a minor child to interpret or facilitate communication, except as a temporary measure”.
22. U.S. Department of Justice, Civil Rights Division. ADA Requirements: Effective Communication (guidance; last updated February 28, 2020). Checked October 23, 2026.
    Show the passageHide the passage

    “The ADA requires that title II entities (State and local governments) and title III entities (businesses and nonprofit organizations that serve the public) communicate effectively with people who have communication disabilities.”; “Covered entities must provide auxiliary aids and services when needed to communicate effectively with people who have communication disabilities.”; “The rules apply to communicating with the person who is receiving the covered entity’s goods or services as well as with that person’s parent, spouse, or companion in appropriate circumstances.”; “information in large print, Braille, or electronically for use with a computer screen-reading program”; “Covered entities are also required to accept telephone calls placed through TRS and VRS, and staff who answer the telephone must treat relay calls just like other calls.”.
23. American Speech-Language-Hearing Association. Code of Ethics (effective March 1, 2023). Checked October 23, 2026.
    Show the passageHide the passage

    “they shall provide services or dispense products only when benefit can reasonably be expected.”; “Individuals may make a reasonable statement of prognosis, but they shall not guarantee—directly or by implication—the results of any treatment or procedure.”; “Individuals shall protect the confidentiality of information about persons served professionally”; “Individuals’ statements to the public shall provide accurate information regarding the professions, professional services and products, and research and scholarly activities.”.
24. American Physical Therapy Association. Code of Ethics for the Physical Therapy Profession (PDF; Principle 6, Responsible Business and Organizational Practices). Checked October 23, 2026.
    Show the passageHide the passage

    “Physical therapists and physical therapist assistants shall provide information about their services that is truthful and accurate and shall not make misleading representations in any forms of communication, including billing.”; “Physical therapists and physical therapist assistants shall fully disclose any financial interest they have in products or services that they recommend to patients and clients or to the public.”.
25. American Occupational Therapy Association. Ethics (Practice Essentials; the page links the AOTA 2025 Occupational Therapy Code of Ethics). “Occupational therapy personnel, including occupational therapists, occupational therapy assistants, and students, have an obligation to demonstrate ethical conduct that reflects professional values when working with clients, families, caregivers, administrators, colleagues, policymakers, payers, and other health care professionals.”. Checked October 23, 2026.
26. American Occupational Therapy Association. AOTA Occupational Therapy Code of Ethics Core Values and Principles (infographic, © 2025; the guiding ethical principles it shows are beneficence, nonmaleficence, autonomy, justice, veracity and fidelity). “Core values and principles are aspirational goals to help guide professional behavior and promote integrity, compassion, and respect for all individuals.”. Checked October 23, 2026.
27. Office of the Federal Register, Electronic Code of Federal Regulations. 42 CFR 424.24, Requirements for medical and other health services furnished by providers under Medicare Part B (current text; §424.24(c)). Checked October 23, 2026.
    Show the passageHide the passage

    “The services were furnished under a plan of treatment that meets the requirements of § 410.61 of this chapter.”; “If the plan of treatment is established by a physical therapist, occupational therapist, or speech-language pathologist, the certification must be signed by a physician or by a nurse practitioner, clinical nurse specialist, or physician assistant who has knowledge of the case, except as specified in paragraph (c)(5) of this section.”; “If the plan of treatment is established by a physical therapist, occupational therapist, or speech-language pathologist, and there is a written order or referral from the individual’s physician, nurse practitioner (NP), physician assistant (PA), or clinical nurse specialist (CNS) in the patient’s record and the therapist has documented evidence that the plan of treatment has been delivered to the physician, NP, PA, or CNS within 30 days of completion of the initial evaluation, the certification does not need to be signed by a physician, NP, CNS, or PA who has knowledge of the case.”.
28. American Physical Therapy Association. Levels of Patient Access to Physical Therapists Services in the U.S. (Direct Access by State resource, dated September 4, 2024). “While all 50 states, the District of Columbia and the U.S. Virgin Islands, provide some form of direct access to physical therapist services, the specific provisions and limitations differ across jurisdictions.”. Checked October 23, 2026.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice, not legal, compliance, billing or financial advice. HIPAA, texting, email, gift and access duties depend on the practice’s facts and state law, and its examples are hypothetical, not DrSensory data or benchmarks.