Is Texting Dental Patients HIPAA and TCPA Compliant? A Plain-English 2026 Guide

By Mouhamad Khodr, Founder, Loopfinity · Published October 27, 2026 · 6 min read

In this article

The short answer

Yes, dental practices can text patients about appointments and recall, and they do not need a signed HIPAA authorization to do it. Two federal rules shape how you text:

HIPAA (enforced by HHS) controls what patient information goes in the message and how it is protected.
The TCPA (enforced by the FCC) controls automated texts to cell phones, including consent, frequency, and opt-outs.

Stay compliant by keeping texts short and about care, sharing only the minimum information needed, using a vendor that will sign a Business Associate Agreement, and honoring STOP requests quickly. The details follow.

This guide is general information, not legal advice. Talk with a healthcare attorney about your specific situation.

What HIPAA allows

Appointment reminders are treatment. HHS has stated that appointment reminders are part of treating a patient, so they can be sent without a HIPAA authorization (Paubox, quoting HHS). Treatment communications are also excluded from HIPAA's definition of "marketing" (HHS FAQ).

Electronic messages need reasonable safeguards. HHS says the Privacy Rule lets providers communicate with patients electronically as long as they apply reasonable safeguards, citing 45 CFR 164.530(c) (HHS FAQ 570). In practice that means:

Minimum necessary content. Practice name, date, time, and how to confirm. No diagnosis, procedure details, or balances.
Verify the number. Confirm the mobile number at intake and update it at each visit.
Respect patient preferences. Patients can request communication by alternative means, such as text instead of a mailed postcard, and providers should accommodate reasonable requests (45 CFR 164.522(b)).
Warn before sending anything sensitive unencrypted. If a patient prefers plain SMS for more detailed information, tell them about the risk and document their choice.

Your texting vendor is a business associate. Any company that handles patient information on your behalf, including a texting platform or AI assistant, should sign a Business Associate Agreement (BAA) with your practice before it touches patient data.

Watch paid promotions. Under HIPAA, communications that a third party pays you to send can count as marketing and require written authorization (HHS marketing guidance). Keep recall and reminder texts free of sponsored offers.

What the TCPA requires

The Telephone Consumer Protection Act treats automated text messages like automated calls. The FCC generally requires prior express consent before autodialed texts go to a cell phone (Mintz).

The healthcare exemption

In 2015 the FCC created an exemption for certain time-sensitive healthcare messages, including appointment and exam confirmations and reminders and wellness checkups (Epstein Becker Green). To qualify, each message must meet conditions, including:

Condition	What it means for your office
Sent only to the number the patient provided	Use the mobile number in the patient record
No telemarketing, billing, or debt collection content	Keep reminders free of promotions and balances
160 characters or less	One short SMS segment
At most one message per day and three per week	Space out reminder and recall touches
Easy opt-out, honored right away	Include "Reply STOP to opt out"
Must comply with HIPAA	Minimum necessary content

Sources: Epstein Becker Green, Kutak Rock.

Adding an offer like "20% off whitening" turns a reminder into a marketing message, which needs prior express written consent. The simplest protection is a texting consent checkbox on your intake form, even for reminders.

The 2025 opt-out rules

New FCC consent revocation rules took effect April 11, 2025 (Kelley Drye):

Patients can opt out with any reasonable wording. Replies such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE must be treated as revocation.
You must honor opt-outs within a reasonable time, no longer than 10 business days.
You may not force patients to use one specific opt-out method.
You may send one confirmation text that acknowledges the opt-out, as long as it contains no marketing (Mondaq).

A related "revoke-all" rule, which would make one opt-out apply to every type of automated message from a business, has been delayed. On January 6, 2026, the FCC pushed its effective date to January 31, 2027 (Burr & Forman). The safest approach today is to treat any STOP as a full stop.

Compliance checklist for dental texting

Intake form collects the patient's mobile number and a texting consent checkbox
Signed Business Associate Agreement with every texting or AI vendor
Reminder and recall texts include only practice name, date/time, and how to reply
No diagnoses, treatment details, or balances in texts
No promotions or discounts in reminder or recall texts
Every automated text includes "Reply STOP to opt out"
Opt-outs honored immediately, and never later than 10 business days
At most one automated healthcare text per day and three per week per patient
Patient contact preferences documented and updated at each visit
Staff trained on what can and cannot be sent by text

Using an AI assistant to text patients

AI assistants can answer patient replies in seconds and book visits around the clock. Set them up with the same rules as your front desk, plus a few more:

Be clear it's automated. Never let the assistant claim to be a person. Some states, such as California, have bot-disclosure laws, and honesty builds trust anyway.
Hand off clinical questions. Pain, symptoms, medications, and treatment questions go to your team, not the AI.
Keep the AI inside the BAA. The assistant's provider handles patient data, so it needs the same BAA as any other vendor.
Log every conversation so your team can review what was said and fix issues fast.

For what compliant texting can do for your schedule, read our guides on reducing no-shows and patient reactivation.

Frequently asked questions

Is it legal for a dentist to text patients? Yes. HIPAA permits appointment reminders as part of treatment, and the TCPA allows healthcare reminder texts when you follow consent, content, and opt-out rules.

Do patients have to sign a HIPAA authorization for reminder texts? No. HHS treats appointment reminders as part of treatment, so no authorization is needed. Many practices still collect texting consent at intake for TCPA protection.

What can a HIPAA-compliant appointment text include? The practice name, appointment date and time, and how to confirm or reschedule. Leave out diagnoses, procedures, and balances.

How fast must we honor a STOP request? Under FCC rules effective April 11, 2025, within a reasonable time not to exceed 10 business days. Best practice is to stop immediately.

Can we include a promotion in a reminder text? Avoid it. Promotional content can take a message outside the TCPA healthcare exemption and require prior express written consent.

Does an AI texting assistant need a BAA? Yes. Any vendor that handles patient information for your practice should sign a Business Associate Agreement.

Compliant texting, built in

Loopfinity was built for dental practices: one-way PMS sync, minimum-necessary messages, easy opt-outs, and an AI assistant that says it's automated and hands clinical questions to your staff.

Book your free ROI assessment → or estimate your upside with the ROI calculator.