Governing outreach: who you contact, when, and why

Governing patient outreach in the United States is not a marketing campaign with a clinical coat. It is an operating policy: who you may contact, when relative to the visit, why (purpose), on which channel, and what evidence you keep. HHS treats appointment reminders as part of treatment under HIPAA — so authorization is not the first question — while the FCC’s TCPA framework still constrains autodialed and prerecorded healthcare messages to wireless numbers. Practices that skip governance end up with either silence (lost access) or noise (compliance and trust debt).

The real problem is not “more reminders”

Most US practices already send something: a portal ping, an automated call, a text. The failure mode is rarely “zero contact.” It is ungoverned contact — different pods using different scripts, no record of who was reached, voicemails that over-disclose, and campaigns that blur reminder and promotion.

That failure shows up as empty chairs, staff burnout on the phone, and compliance anxiety after the fact. It also shows up as the twin of unanswered phones: after-hours demand that never becomes a booked visit. Outreach without a policy is just another queue.

If you operate in the United States, the design question is sharper than “which vendor.” It is: what is allowed, what is wise, and what you can prove.

What HIPAA already settles — and what it does not

HHS is direct: appointment reminders are considered part of treatment and therefore can be made without an authorization. That FAQ is old (created 2002, last reviewed 2022) and still the backbone answer practices need when someone asks “do we need a signed form to remind?”

The broader TPO frame matters too. HHS explains that covered entities may use and disclose protected health information for treatment, payment, and health care operations without prior consent in the sense many clinics assume. Treatment communications can happen by phone and other reasonable means when safeguards are in place.

What HIPAA does not do:

• It does not erase patient rights to request confidential communications by alternative means or locations.
• It does not bless oversharing diagnosis, specialty, or lab detail on a household voicemail.
• It does not replace TCPA, state telemarketing rules, or your own BAAs with vendors that persist PHI.

For the voice-specific yes/no map, see HIPAA voice appointment reminders. This post zooms out to governance: the policy layer above any single channel.

TCPA is a different question with different failure modes

The FCC’s TCPA Omnibus Declaratory Ruling and Order (FCC 15-72) and later exemption guidance (including FCC 20-186) carve space for certain healthcare messages — appointment and exam confirmations and reminders among them — subject to conditions. The operational gist for a practice leader:

• Caller class: by or on behalf of a healthcare provider.
• Purpose: healthcare treatment / informational, not telemarketing or advertising.
• Volume limits on exempt paths (the Commission has discussed conditions such as one message per day and a weekly cap on combined voice/texts for certain exemptions — treat counsel’s memo as authoritative for your stack).
• Opt-out: interactive, honored, and recorded.

When content or frequency drifts outside the exemption’s box, ordinary consent rules return. That is why TCPA appointment-reminder compliance is not a one-time checkbox: it is a living boundary on scripts and cadence.

Who you contact: eligibility is a clinical-ops decision

“Everyone with an appointment tomorrow” is a starting heuristic, not a policy. Eligibility should answer:

• Visit type — new vs. return, procedure prep, behavioral health, pediatrics with caregiver.
• Risk of no-show — prior miss history, long lead time, insurance or transportation flags (use carefully; avoid discriminatory proxies).
• Channel readiness — valid number, preferred language, documented preference, STOP/opt-out status.
• Sensitivity — specialties where a leave-behind message must stay generic.

Outreach that ignores eligibility wastes staff time and increases complaint risk. Outreach that over-targets without documentation looks arbitrary when a patient asks why they were called and a neighbor was not.

When you contact: windows that match the visit, not the vendor default

Timing is governance. A seven-day call that enables concrete planning is a different intervention from a same-morning nudge. Evidence from primary-care trials (covered in the companion playbook on no-shows) shows that early, purposeful contact can move cancellations earlier — which is how you refill the slot. Late spam does not.

A practical US default many practices can defend:

• T-7 to T-5 for high-risk or prep-heavy visits (planning call).
• T-72 to T-48 for standard confirmation.
• T-24 only if the first attempts failed or the visit is high value / high prep.
• Stop the sequence once the patient confirms or reschedules.

Write the windows into policy. Do not leave them in a salesperson’s slide.

Why you contact: purpose statements beat “reminders”

Every campaign needs a named purpose:

1. Confirm attendance.
2. Collect a cancellation early enough to refill.
3. Deliver prep instructions.
4. Offer a same-day or waitlist slot.
5. Route a clinical question to a human (not the agent’s invention).

If the purpose is “fill the schedule with anyone,” you are in solicitation territory. If the purpose is “protect access for patients who already have a visit,” you stay closer to treatment and operations.

What you may say: minimum necessary in practice

HIPAA’s treatment lane does not mean “say everything.” On SMS and voicemail, default to:

• Patient first name or initials (per policy).
• Date, time, location or department label that is not a diagnosis.
• Callback number.
• How to confirm, cancel, or opt out.

Avoid: condition names, test results, medication details, “your psychiatry appointment,” or marketing for cosmetic or cash-pay add-ons in the same thread. Portal messages behind authentication can carry more detail; public channels should not.

That discipline is the same operational mindset behind front-desk overflow design: automation finishes the safe jobs; humans own the sensitive ones.

Evidence: if it is not logged, it did not happen

Governance without an attempt log is theater. Minimum fields:

• Patient / appointment ID
• Channel and destination (masked in reports)
• Timestamp
• Agent or system identity
• Outcome (confirmed, canceled, rescheduled, left message, no answer, invalid, opted out)
• Script version or purpose code

Without those fields you cannot defend a complaint, improve a sequence, or prove you honored STOP.

Common failure modes in US practices

1. Reminder + promo in one message — “Confirm Tuesday and ask about our new wellness package.”
2. Shared cell / household overshare — detailed voicemail that another person hears.
3. Ignoring confidential-communication requests — calling a work number after the patient asked for mail only.
4. Infinite retries — burning trust and pushing past exemption frequency logic.
5. Shadow channels — staff texting from personal phones with no log.
6. No owner — “the front desk handles it” with no named accountable role.

Each of these is cheaper to prevent in policy than to remediate after a complaint.

Roles, RACI, and the weekly review

Governance dies when it lives only in a PDF. Assign:

• Accountable — practice manager or ops lead who owns the outreach policy.
• Responsible — pod leads who run Layer A/B sequences and refill lists.
• Consulted — compliance/privacy for script changes that touch PHI or marketing edges.
• Informed — clinicians when specialty-specific language or prep instructions change.

Hold a 30-minute weekly review: ten random attempts, two opt-outs, one complaint (if any), refill rate of released slots. If you cannot sample attempts, you do not have governance — you have hope.

Scripts as controlled documents

Treat confirmation and voicemail scripts like controlled documents: version ID, owner, effective date, and a change log. Staff should not “improve” wording on the fly for sensitive specialties. Marketing should not insert offers into treatment sequences without a new purpose code and a new compliance pass.

When you introduce an AI voice layer for overflow, the same rule applies: the model speaks a published script family, not free improvisation. That is how you keep the treatment lane HHS described for reminders while still answering the phone.

How governance connects to access economics

Empty chairs and abandoned calls are the same access problem on different clocks. Ungoverned outreach fixes neither: it adds contact cost without recovering capacity. Governed outreach recovers capacity when early cancels refill and when high-risk patients get a planning conversation before the day of the visit.

That is why this guide sits next to front-desk overflow and after-hours cost: channel capacity without purpose still wastes demand.

What your practice can do this week

1. 1
   Inventory every outbound path

   Portal, autodialer, SMS, manual staff calls, after-hours answering — list owners.

2. 2
   Classify each path by purpose

   Treatment reminder vs. operations vs. marketing. Split any mixed campaign.

3. 3
   Align windows to visit risk

   High-risk and prep-heavy get earlier contact; routine visits get a simpler stack.

4. 4
   Train for handoff

   Automation confirms; humans handle clinical questions, threats, and sensitive specialties.

5. 5
   Review opt-outs weekly

   Sample ten contacts; verify STOP and confidential-comms requests were honored.

Closing

In US primary and specialty care, outreach that works is outreach that is governed. HHS already told you reminders can sit inside treatment. The FCC told you channel rules still bind. Your job is to decide who, when, and why — and to keep the evidence. That is how access improves without turning the phone into a liability.

Write the policy. Version the scripts. Sample the attempts. Refill the slots. Everything else is decoration.

For market context on how Arbol frames US practice operations, see United States.

Appendix: decision tree for a new campaign

Before any new outbound sequence ships:

1. Purpose? If you cannot name one primary purpose, stop.
2. Treatment vs marketing? If marketing, leave the reminder lane; get the consent posture right.
3. Eligibility? List inclusion/exclusion in one paragraph.
4. Window? T-7 / T-72 / T-24 — written, not implied.
5. Channel? Match content risk; voicemail stays generic.
6. Opt-out / confidential communications? Path tested end-to-end.
7. Evidence? Outcome codes live in production before volume.
8. Owner? Named human for weekly sample review.

If any step is “TBD,” the campaign is not ready. That tree is the operational expression of HHS’s reminder-as-treatment answer plus the FCC’s channel constraints — without pretending one statute answers both.

What “good” looks like after 90 days

• Written policy approved and findable.
• ≤5 active purposes.
• ≥95% of attempts coded.
• STOP and confidential-comms requests sampled with zero silent failures.
• Early-cancel refill rate reported beside no-show rate.
• Mixed marketing+reminder campaigns eliminated.

Those are access and trust metrics. They beat vanity dial counts.

Sensitive specialties and minors

Behavioral health, infectious disease, reproductive health, and adolescent care need tighter scripts and often human-only paths for anything beyond a generic “please call the office about your visit.” Caregiver outreach for pediatric visits should use the guardian contact on file and avoid leaving clinical detail with siblings or household members. Governance is how you encode those exceptions — not tribal knowledge at the desk.

Coordinating with legal without freezing ops

Send counsel a one-pager: purposes, channels, sample scripts, exemption/consent assumptions, retention of logs, and BAAs in play. Ask for a written edge list (“never include X,” “stop after N attempts,” “escalation for specialty Y”). Ops then executes the edge list. Infinite legal review of every SMS adjective is how outreach dies; zero legal review is how complaints are born. The governance middle is a signed edge list plus weekly sampling.

One-page policy outline (copy into your wiki)

1. Purpose catalog (named).
2. Eligibility rules.
3. Windows by visit class.
4. Channel matrix + minimum-necessary examples.
5. Opt-out and confidential-communications handling.
6. Outcome codes.
7. Weekly sample procedure.
8. Change control for scripts.

If those eight headings exist with owners, you have governance. If they exist only in a vendor SOW, you do not.

Ship the edge list. Sample weekly. Refill what you free.