Is Email and SMS Marketing HIPAA Compliant for a Clinic?

What consent does the TCPA require for marketing texts?

The TCPA requires prior express written consent: its rules at 47 CFR 64.1200 require that consent for marketing texts and for calls made with an automatic dialing system or an artificial or prerecorded voice, and they set the disclosure and opt-out mechanics. The FCC's one-to-one consent rule for lead generators was vacated in January 2025, so a single consent may again name more than one seller, but nothing about the written-consent requirement itself changed.

For a clinic that means a consent line on every form and call that names the clinic, states the message types and frequency, includes STOP language and links to terms, plus a timestamped record kept for every number. Speed-to-lead sequences run on that consent. Reactivation of an old list runs only where the consent records exist and cover what is being sent; where they do not, the reactivation is by email, or not at all.

Where should a clinic capture SMS consent?

For a clinic that runs paid ads, most new numbers arrive through one form: the one on the ad landing page. That makes the form the place where TCPA consent is won or lost. The consent line sits next to the phone field, names the clinic, says the person agrees to receive marketing texts and calls, including automated ones, states frequency and that consent is not a condition of purchase, and includes STOP language with a link to terms. The submission stores a timestamp, the exact consent text shown, the page URL and the ad click that brought the person, so the record can be produced later. MedScale builds ad landing-page forms to this standard.

The ad landing page form also decides what leaves for the ad platforms. The booked or submitted event goes server-side under a business associate agreement with a neutral name, tied to the ad click; no form field, condition or program name is sent to Meta or Google.

Which rules apply to health brands that are not HIPAA covered entities?

For health brands outside HIPAA, the FTC's Health Breach Notification Rule can apply instead. Cash-pay wellness businesses that are not covered entities are not outside the law. The FTC's Health Breach Notification Rule covers vendors of personal health records and related services, and the FTC has used it against health apps that shared user data with ad platforms. The same discipline about where data lives and what leaves the system is the safe default regardless of HIPAA status.

Which email and SMS sequences matter most for a clinic?

• Speed-to-lead: a text and an email within two minutes of a form or a call, with a booking link, then a short timed sequence until they book or opt out. Three touches over two days is enough.
• No-show recovery: reminders at 48 hours and 2 hours, a same-day reschedule path, and a sequence for the people who missed.
• Refill and retention: reminders timed to the program so a subscription patient renews on schedule, with the program name behind the login rather than in the text.
• Reactivation: past patients and old leads segmented by last visit and program stage, re-engaged with a plain offer to come back, email-first where SMS consent is missing.
• Reviews: requests sent after a completed visit to the platforms that decide the local map results, with no condition mentioned in the request.

Where do clinics get email and SMS compliance wrong?

Clinic email and SMS failures are rarely dramatic. A subject line generated from a merge field pulls the program name into the inbox preview. A reactivation segment is named after the medication because that is how the EHR labels it. A speed-to-lead text is sent from a number the platform provided without anyone checking that the form's consent language named the clinic and described marketing texts. A review request mentions the treatment. Each is a small decision made inside a marketing tool by someone who was never told the rule, and each is a disclosure or a consent failure that can be found in a breach or a complaint months later.

The fix for those failures is procedural rather than technical: a naming rule for segments and templates, a consent line owned by the clinic rather than the vendor, a monthly review of every active template against the rule, and a written data-path document that says which vendor holds what, under which agreement.

In what order should a clinic build its email and SMS sequences?

Speed-to-lead goes first, because it acts on leads the clinic is paying for today and the return is immediate. No-show recovery goes second, because it recovers visits already booked. Refill and retention sequences go third and pay for the longest, since a subscription patient who renews on schedule is worth more than any new lead. Reactivation goes last and only once consent records have been checked, because it is the sequence most likely to reach people who never agreed to hear from the clinic again. Review requests run continuously from the first completed visit. Each sequence is short, stops when the person acts, carries an opt-out, and reports its own response and opt-out rates so the clinic can see when a message has become noise.

What does MedScale do alongside a clinic's email and SMS?

MedScale Health does not sell or run email and SMS programs; the clinic's team or its lifecycle partner owns the sender, the sequences and the segments. MedScale runs the paid side: the Meta and Google ads, the landing pages with consent-capturing forms built to the TCPA and HIPAA rules on this page, and the server-side tracking that reports booked consults back to the campaigns with no personal or health data. The free growth audit at medscale.health/audit checks the landing-page forms, the consent line and what the tracking sends, and the written report is the clinic's to keep.