The TCPA healthcare exemption lets HIPAA covered entities and their business associates send automated health care messages without prior express written consent. Prior express consent is still required, usually the patient giving you their number. Marketing still needs written consent. A narrower exemption covers free-to-patient wireless calls and texts under strict conditions.
Takeaways
The exemption is from written consent, not from consent
Health care messages still need prior express consent.
AI voices count as artificial voices
The FCC ruled in 2024 that AI-generated calls fall under TCPA consent rules.
Opt-outs changed in 2025 and are changing again
Any reasonable method counts today, honored within 10 business days. The FCC voted on September 30, 2026 to revise the rules.
State laws can be stricter
Florida and Oklahoma limit hours and call frequency, with $500 per violation.
What the TCPA covers and what it costs
The Telephone Consumer Protection Act restricts calls and texts made with an autodialer or an artificial or prerecorded voice. The FCC's rules are at 47 CFR 64.1200.
Damages are set by statute: $500 per violation, or up to $1,500 if the violation was willful or knowing. Each call or text can be a separate violation. Patients can sue directly.
$500
Statutory damages per violation
47 U.S.C. 227(b)(3)
$1,500
Willful or knowing violation
Up to 3x damages
8am-9pm
Federal calling window
Called party's local time
The healthcare exemptions, read correctly
There are three healthcare rules in 64.1200. Each covers a different kind of line or message, and each has limits.
1. Health care messages: no written consent needed (a)(2)
Section 64.1200(a)(2) exempts calls that deliver a "health care" message, made by or on behalf of a HIPAA covered entity or business associate, from the written consent requirement.
That's all it does. You still need prior express consent, which usually means the patient gave you that phone number. Messages that are marketing don't qualify. Those need prior express written consent.
2. Residential lines: limits on prerecorded calls (a)(3)(v)
Prerecorded or artificial-voice health care calls to residential (landline) numbers can go out without consent, within limits. The cap is one call per day per patient, up to three per week, with opt-outs honored. Going past that requires prior express consent.
3. Free-to-patient wireless calls and texts (a)(9)(iv)
This exemption covers calls and texts to cell phones that cost the patient nothing. It removes the consent requirement, but only if every condition is met:
- No charge to the recipient.
- Sent only to the wireless number the patient provided.
- States the provider's name and contact information.
- Limited to appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-op instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home health instructions.
- No telemarketing, solicitation or advertising, and no billing, debt-collection or other financial content.
- Concise: generally one minute or less for voice, 160 characters or less for text.
- No more than one message per day per patient, and three per week.
- Includes an easy opt-out (STOP for texts), honored immediately.
Miss one condition and you're back to needing consent. A refill reminder that mentions a copay, for example, includes financial content.
AI voices are "artificial voices"
In February 2024, the FCC's Declaratory Ruling FCC 24-17 held that AI-generated voices, including voice clones, are "artificial" voices under the TCPA. So every rule above applies to AI calls exactly as it applies to prerecorded ones.
State law adds disclosure rules for AI on top of that. California, Utah and Texas each have one. See do patients have to be told they're talking to AI.
Patient outreach with opt-out on every path
Start free in the Rivvi workspace. Calls, texts and the website widget are on Team.
Opt-outs: the rules now, and what's coming
In effect since April 11, 2025
- Patients can revoke consent by any reasonable method. Replies like STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE count automatically.
- You must honor a revocation within 10 business days.
- You can't require patients to use one exclusive method.
- You may send one confirmation text that doesn't market anything. It's presumed fine if sent within 5 minutes.
The "revoke-all" rule and its replacement
The FCC's 2024 order also included a "revoke-all" rule. A STOP in reply to one type of message would have revoked consent for all robocalls and robotexts from that caller, on unrelated topics too. The FCC delayed it, most recently to January 31, 2027.
On September 30, 2026, the FCC voted to replace it:
- Informational messages: an opt-out applies only to that category. A patient who stops billing reminders can still get appointment reminders.
- Marketing: an opt-out from a marketing message still covers all marketing from that caller.
- Exclusive opt-out method: callers may designate one or more exclusive methods: an automated key press on the call, a standard text reply keyword, or a website or phone number. The method must be clearly disclosed. Callers who don't disclose one must still honor any reasonable method.
These changes take effect 30 days after publication in the Federal Register. As of October 1, 2026, they had not been published. Until then, the April 2025 rules govern. Check the Federal Register before you change any opt-out flows.
FCC 24-17
AI-generated voices are 'artificial' under the TCPA.
One-to-one rule vacated
11th Circuit strikes the FCC's one-to-one consent rule.
Revocation rules take effect
Any reasonable method, 10 business days, one confirmation text.
McLaughlin v. McKesson
Courts may read the TCPA independently of the FCC.
FCC votes to replace revoke-all
Category-specific opt-out for informational calls; exclusive method allowed.
Federal Register publication
New revocation rules effective 30 days later.
Two court decisions that changed the ground
One-to-one consent is gone. In Insurance Marketing Coalition v. FCC (January 24, 2025), the 11th Circuit vacated the FCC's rule that consent must name one seller and cover only "logically and topically related" calls. The court found it conflicted with the statute's meaning of prior express consent.
Courts no longer defer to the FCC. In McLaughlin Chiropractic v. McKesson (June 20, 2025), the Supreme Court held 6-3 that district courts can decide for themselves whether the FCC's reading of the TCPA is correct. The healthcare exemptions above are in the FCC's rules. A court could read the statute differently. Build in margin rather than relying on the edge of any exemption.
State mini-TCPAs
Some states add their own rules. Two that catch healthcare outreach:
- Florida (Fla. Stat. 501.616 and 501.059): no commercial solicitation calls before 8 a.m. or after 8 p.m. No more than three calls from any number to a person in 24 hours on the same subject. $500 per violation, trebled if willful.
- Oklahoma Telephone Solicitation Act (effective November 1, 2022): no sales calls between 8 p.m. and 8 a.m. No more than three calls in 24 hours on the same subject. Automated calls need prior express written consent. $500 per violation, trebled if willful.
Both target solicitation. But if a campaign mixes care messages with anything promotional, plan for the stricter window: 8 a.m. to 8 p.m.
TCPA checklist for healthcare outreach
- 1
Classify every campaign
Decide which rule each message relies on. If it promotes anything, treat it as marketing and require written consent.
- 2
Record consent and its source
Log when and how each patient gave their number, and keep written consent for marketing.
- 3
Check every (a)(9)(iv) condition
Free to the patient, provider name, allowed topics only, no billing content, short, one per day and three per week, opt-out in every message.
- 4
Respect calling hours
8 a.m. to 9 p.m. in the patient's local time federally. Use 8 a.m. to 8 p.m. where Florida or Oklahoma rules may apply.
- 5
Honor any reasonable opt-out
Accept STOP-type keywords and spoken requests. Apply opt-outs across every channel. Send at most one non-marketing confirmation.
- 6
Disclose AI at the start
AI voices are artificial voices under the TCPA. Several states also require AI disclosure. Say it first.
- 7
Watch the Federal Register
When the September 30, 2026 order is published, review whether category-specific opt-outs or an exclusive opt-out method fit your workflows.
Where Rivvi fits
Rivvi is a HIPAA-compliant AI workspace with an action layer for AI calls, texts and a website chat widget. TCPA opt-out is honored on every outreach path. Outcomes are recorded in Rivvi and pushed to HubSpot, Salesforce or Zoho if one is connected.
At Southeast Medical Group (August 2026), Rivvi reached 104,000+ patients with a 0.45% opt-out rate. For medication outreach specifically, see medication adherence.
Your consent decisions are still yours. Classify campaigns with counsel, and use the AI acceptable use policy template to set the rules for staff.
Start in the workspace
Free for you and two colleagues, with a HIPAA BAA. Calls and texts are on Team.
Sources
- 47 U.S.C. 227 (TCPA statute)
- eCFR: 47 CFR 64.1200
- FCC 24-17 Declaratory Ruling (AI voices)
- FCC DA 26-12: revoke-all effective date extended to Jan 31, 2027
- FCC fact sheet: draft revocation Report and Order for the Sept 30, 2026 meeting
- Tech Times: FCC votes to replace blanket robocall opt-out (Sept 30, 2026)
- Hunton: FCC adopts clarifying changes to the TCPA revoke-all rule
- Insurance Marketing Coalition v. FCC (11th Cir. 2025)
- McLaughlin Chiropractic Associates v. McKesson Corp. (U.S. 2025)
- Florida Statutes 501.616
- Florida Statutes 501.059 (FTSA)
- Benesch: Oklahoma mini-TCPA law