HIPAA SMS rules for dental practices — what you can and can't text patients

The short version

HIPAA doesn't prohibit SMS. It requires that (a) you have the patient's permission, (b) you use the minimum necessary PHI, and (c) you've warned the patient that SMS isn't secure. If you satisfy those three, a dental practice can send appointment reminders, recall messages, and general communications via SMS legally. Where practices get in trouble: sending clinical detail ('your root canal on tooth #14 is ready') instead of general timing ('your appointment is tomorrow').

What counts as PHI in SMS

Any combination of patient identifier + clinical fact. Clinical fact includes: procedure name (root canal, extraction, crown prep), tooth number, diagnosis, treatment plan, payment balance tied to procedure, insurance authorization status. A patient's name + 'appointment tomorrow at 10am' is NOT PHI in most readings. A patient's name + 'crown seat at 10am for tooth #14' IS PHI.

Consent and the sign-up form

HIPAA permission for SMS is satisfied by a written authorization or a clear disclosure + opt-in at intake. Most modern intake forms have an SMS consent checkbox. If your form doesn't, add one today. The checkbox should say: 'I agree to receive appointment reminders, recall messages, and general practice communications via SMS. Message and data rates may apply. Reply STOP to opt out.'

TCPA 10DLC — the overlay you cannot skip

TCPA requires separate carrier registration for all business SMS starting Q4 2023 (A2P 10DLC). This applies to every dental practice sending SMS via Twilio, Bandwidth, or Lighthouse 360. Non-registered campaigns will have messages filtered or blocked by carriers. Registration takes 14–21 days; you start it before the first SMS goes out. If you're using a dental comms platform, they handle this for you — verify with them.

Rate limits that TCPA case law suggests

TCPA statutory damages run $500–$1,500 per unwanted message. Case law (post-FCC 2023) suggests 1 marketing SMS per day and 3 per week per patient is defensible. Practice-transactional messages (appointment reminders, recall) have more latitude but still live under the same framework. Any dedicated reactivation tool should enforce these limits at the dispatcher layer, not by policy.

The STOP requirement — and what 'permanent' means

Every SMS must include 'Reply STOP to opt out.' STOP means permanently. The patient never gets another SMS from that number. Re-engaging later via a new short code is the kind of thing that generates TCPA class actions. If a patient texts STOP, add them to the DNC list immediately. Every competent platform does this automatically; verify that yours does.

Dental-board overlays

Most state dental boards exempt outreach to existing or former patients from solicitation rules, specifically because it's follow-up care rather than acquisition. Florida Rule 64B5-4.002 is the clearest example. Your state likely has an equivalent rule. This matters because a dental marketing firm doing cold outreach to non-patients is on different legal footing than a reactivation tool contacting your actual patients.

The three mistakes we see most often

Mistake 1 — sending procedure names in SMS. 'Your root canal is ready' is PHI in flight on an unsecured channel. Use 'your appointment with Dr. X tomorrow at 10am' instead.

Mistake 2 — no opt-in record. If the patient says 'I never signed up for this,' you need to produce the signed authorization or time-stamped checkbox from their intake. If you can't, you have an OCR complaint on your hands.

Mistake 3 — honoring STOP softly. If a patient texts STOP and gets another SMS from a different campaign the next week, that's a TCPA violation and a HIPAA complaint. STOP has to cascade across every campaign under the same number.

What usdpr. does to avoid these

We enforce the TCPA 1/day + 3/week caps at the DB dispatcher (not in a policy doc — in code, against the query layer). We run a PHI scrubber on every outbound message body that flags procedure codes, tooth numbers, and a long list of clinical terms. We honor STOP as a terminal state across all campaigns. We sign a Business Associate Agreement with every practice before any patient data moves. Full trust hub.

If you're not sure you're compliant

The cheapest defensible path is to pick a dental SaaS vendor that signs a BAA, handles 10DLC registration, enforces rate limits in code, and has a published PHI-handling policy. The most expensive defensible path is to build compliance in-house. The least defensible path — but most common — is to use a generic SMS vendor with no BAA, no 10DLC, and no HIPAA commitment. If that's you, migrate this quarter.