Missed-Call Text-Back for Medical Practices: HIPAA, TCPA, and Opt-Out Rules
When a caller reaches voicemail, many never call back. An automatic text with a scheduling link recovers some of them. It also puts your practice inside three sets of rules at once: HIPAA, the TCPA, and the carriers' own requirements. Here is what to get right.
The short version: Missed-call text-back is a reasonable thing for a practice to do. Keep the message free of health information, treat it as regulated messaging (consent, carrier registration, working opt-outs), and have a Business Associate Agreement with the vendor if it stores messages tied to patients. This article is general information, not legal advice.
How missed-call text-back works
When a call to your practice goes unanswered, the system detects it and immediately sends a text to the caller's number with a short message and a link to book, request a call back, or ask a question. If the person replies, the conversation can continue by text and be handed to staff. The point is speed: the person who just called is the most motivated they will ever be.
HIPAA: keep the message generic and watch the vendor
A person who calls a medical practice may be a patient, and the fact that they contacted you can itself be sensitive. Two practical rules follow.
- Keep health information out of the text. No condition, treatment, provider, or appointment details. A generic message with a link to a secure page avoids putting PHI into an unencrypted channel. HHS guidance allows communicating with patients by unencrypted text in some situations, for example when a patient has been warned of the risk and prefers it, but limiting what is sent is the safer design.
- Sign a BAA with the vendor. If the platform stores message content, caller numbers, or call logs linked to people who may be your patients, it is handling PHI on your behalf and should be a business associate. Confirm that the exact product and plan you use is covered, and that call recordings and transcripts, if any, are included.
The booking page the link leads to matters too. If it collects health details, it needs the same safeguards as any other patient intake form. Our overview of the HIPAA controls for automated workflows covers what to check.
TCPA: consent and message content
Under the Telephone Consumer Protection Act, automated text messages to mobile numbers are regulated, and consent is the central issue. Marketing messages need a higher level of consent than purely informational ones. A reply to a call the person placed to you is generally seen as lower risk, because they initiated the contact and you are responding to it. That is not a blanket exemption, and the risk goes up if the message includes promotions, is sent repeatedly, or goes to someone who has opted out.
Keep missed-call replies informational (a scheduling link or a way to reach a person), send one message per missed call rather than a sequence, and avoid anything promotional. Several states also have their own telemarketing and texting laws. Have counsel review the message and the consent approach before you launch.
Carrier rules: register your number
US carriers require businesses that send automated texts from standard 10-digit numbers to register under the A2P 10DLC framework: you register your business (the brand) and describe the kind of messaging (the campaign) through your messaging provider. Unregistered traffic is increasingly filtered or blocked, so a missed-call text-back system that skips registration may silently stop delivering. Registration can take days to weeks, so start it before you plan to go live.
Opt-outs that actually work
- Honor STOP and common equivalents immediately. Send one confirmation, then nothing.
- Support HELP with a short reply that identifies your practice and how to reach you.
- Record every opt-out and apply it across every tool that can send texts, including reminders and marketing.
- Treat a clearly worded request in plain language ("please stop texting me") as an opt-out too. The FCC has been tightening revocation rules, so check the current requirements.
A sample message
Short, generic, and clear about how to stop:
"Thanks for calling [Practice Name]. Sorry we missed you. Book or request a call back here: [link]. Reply STOP to opt out."
A launch checklist
- BAA signed with the messaging vendor, covering the exact product and plan.
- Message reviewed: no PHI, no promotions, one message per missed call.
- 10DLC brand and campaign registered and approved.
- STOP and HELP tested end to end, with opt-outs shared across systems.
- Booking page secured like any other intake form.
- Staff process for replies, with after-hours handling defined.
- Counsel or your compliance officer has reviewed the setup.
Where Truvaldi fits
We build missed-call text-back for practices on your existing number, with HIPAA-aware design and security review led by a CISSP-certified practitioner. It pairs with our AI receptionist for medical practices and wider healthcare automation work. We do not provide legal advice, so run the consent and messaging approach past your own counsel.
Elija leads security and compliance strategy at Truvaldi. As a CISSP-certified practitioner, he architects HIPAA-aware AI systems for medical, aesthetics, and financial practices — and delivers the Security Risk Assessments that keep them audit-ready.
Frequently asked questions
Is missed-call text-back HIPAA compliant?
It can be, depending on what the message says and which vendor sends it. Keep the text free of health information (no condition, treatment, or appointment details), send only a link or a general prompt, and sign a Business Associate Agreement with any vendor that stores messages linked to a person who may be a patient. HIPAA allows patient communications by unencrypted text in some cases, but you should limit PHI and follow your own policy.
Do I need consent to text someone who called my practice?
Under the TCPA, automated texts to a mobile number generally require consent. A reply to a call the person placed is often viewed as lower risk because they initiated contact, but it is not a blanket exemption, and adding promotions raises the bar. Keep the message informational, such as a scheduling link, and have counsel review your approach.
What is 10DLC registration, and do we need it?
A2P 10DLC is the US carrier framework for business texting from standard 10-digit local numbers. Brands and messaging campaigns are registered through your messaging provider, and unregistered traffic is increasingly filtered or blocked. If you send automated texts from a local number, you should expect to register.
How should opt-outs work?
Honor STOP and similar requests immediately, confirm the opt-out once, and stop sending. Support HELP with a short response. Keep a record of opt-outs, apply them across every system that sends texts, and avoid making people jump through hoops. The FCC has been tightening revocation rules, so check the current requirements.
What should a compliant missed-call text say?
Something short and generic, such as: "Thanks for calling [Practice]. Sorry we missed you. Book or request a call back here: [link]. Reply STOP to opt out." No health details, no promotions, and a clear way to reach a person.
Stop losing callers to voicemail, safely.
We set up missed-call text-back with the registration, opt-out handling, and BAA coverage a medical practice needs.